Three researchers and engineers have published a presentation from the 35th Chaos Communication Congress revealing claimed vulnerabilities in cryptocurrency hardware wallets. Trezor and Ledger have responded saying in short, their user’s cryptocurrency balances are safe.
Dmitry Nedospasov, Thomas Roth, and Josh Datko, created the website wallet.fail and promised to publish their presentation to the Chaos Communication Congress online after the event. Within 24 hours the researcher’s claims have been published and two leading hardware wallet makers have responded.
Ledger Says Your Crypto Assets Are Secure
Ledger has gone all out in response with a blog post saying that although it is happy to see people challenging its security that:
They presented 3 attack paths which could give the impression that critical vulnerabilities were uncovered on Ledger devices. This is not the case.
Despite the researchers saying they all “love cryptocurrency” and are cryptocurrency owners themselves Ledger also seems somewhat disappointed adding:
In the security world, the usual way to proceed is responsible disclosure… We regret that the researchers did not follow the standard security principles outlined in Ledger’s Bounty program.
Ledger also believes the three researchers did not provide “practical vulnerabilities.”
Firstly, the researchers performed an attack that modified the physical wallet and used malware on the cryptocurrency owner’s PC in combination with a potential attacker in a nearby room needing to remotely enter the hacked PIN and launch the cryptocurrency application. Ledger says of this type of attack:
It would prove quite unpractical, and a motivated hacker would definitely use more efficient tricks.
Secondly:
They tried to perform a supply chain attack by bypassing the MCU check, but they did not succeed. The MCU manages the screen but doesn’t have any access to the PIN nor the seed, which are stored on the Secure Element.
Though Ledger does acknowledge there is a bug in its firmware update function which allowed the researchers to add software. Ledger says this bug has been solved in the device’s next firmware version and that the bug doesn’t allow anything other than a JTAG debug interface. The researchers were unable to access cryptocurrency funds.
Lastly, for the Ledger Blue wallet, the researchers measured radio emanations when a PIN was entered, this tactic could lead to an attacker calculating a user’s PIN. Ledger says the posed attack is “interesting” but in real conditions would mean a device has to remain in the same position as when a “dictionary” of emanations was recorded so is again, unlikely.
It looks like Ledger had already been considering such an attack responding with:
We already implemented a randomized keyboard for the PIN on the Ledger Nano S, and the same improvement is scheduled in the next Ledger Blue Firmware update.
Trezor: If You Have Your Device…Keep Using It
Though Trezor appears to be “working with the info as it arrives” it is acknowledging a vulnerability but says as it is a physical vulnerability that has been identified:
An attacker would need physical access to your device, specifically to the board—breaking the case. If you have physical control over your Trezor, you can keep on using it, and this vulnerability is not a threat to you.
Trezor has also said that concerned users can enable the “passphrase feature” on their Trezor hardware wallets, but that any loss of a user’s passphrase will lead to “loss of funds.”
Regarding the presentation at #35c3, we were not informed ahead of time about the details of the disclosure. We are working with the info as it arrives.
We will address the vulnerability in due time—as soon as possible.
Details in thread:
— Trezor (@Trezor) December 28, 2018
The researchers do seem to have identified some potential weaknesses, however unlikely. It also appears that Ledger and Trezor are ahead of identifying vulnerabilities and responsive to parties like the wallet.fail three, even if they don’t use the wallet’s own bug bounty programs.
Ledger sold over a million of its wallets in 2017 alone and continues to be an industry leader with a flow of new partnerships. Trezor too continues to develop its wallets, adding native Ethereum support just recently.
Featured image from Shutterstock.
Get Exclusive Crypto Analysis by Professional Traders and Investors on Hacked.com. Sign up now and get the first month for free. Click here.
