Cryptocurrency hardware wallets such as Trezor and Ledger are not completely safe and have numerous exploits, as three hardware experts – Thomas Roth, Dmitry Nedospasov, and Josh Datko – showed during an hourlong demonstration at the 35th annual Chaos Communication Congress (35C3) in Leipzig, Germany.
The three broke into the most popular commercial cryptoasset storage devices using both hardware and software methods. Most of the methods employed during the demonstration required physical possession of the devices. After obtaining possession of a device, the possibility of installing corrupt and compromised software is very real and, as the trio proved, not even very difficult.
For this reason, one of the focuses of the talk was the possibility for so-called supply chain attacks, when a device is compromised after it has been shipped from the factory but before it is bought and used by a customer. Josh Datko showed the ease of spoofing the supposedly tamper-proof packaging of the Trezor wallet using only a hairdryer and some steady hands.
Hardware Wallets Are Vulnerable in the Wrong Hands
Demonstrating what can happen after packaging has been breached, Datko built a very simple physical device using only about $3.00 worth of consumer parts, to be implanted into wallets – using the Ledger Nano S as a test case. The implant device does not even need to penetrate any core firmware or systems, simply bypassing them by emulating a physical button press on the Nano using a radio trigger.
Another successful breach allowed installing over core software on the Nano by exploiting the device’s computing architecture. Thomas Roth built the exploit, and installed the classic Snake video game on it instead of the manufacturer software, to show how vulnerable it is.
(source: Youtube.com)
Roth also found a way into the Ledger Blue device, by using the long “trace” (connection) between the two key processing chips as an antenna to glean passwords entered on the device’s touchscreen – with over 90% accuracy. But the method was limited to a “couple of meters” of reception.
The upshot of the talk was that, for the most part, attackers must have possession of devices. This perhaps makes the supply chain attacks most concerning for users, and buyers must be very wary of where they buy their hardware wallets. Attacks from third-party sellers, who have sold compromised devices, have already been reported earlier this year and cost some customers dearly.
