Crypto wallet Ledger hardware hacked by 15-year-old

Hardware wallet Ledger Nano S had a breakdown: teenage security expert found a problem
22 March 2018   1173

The security expert Saleem Rashid detected an issue connected with the “tamper-free” wallet. This began in November, 2017 when Rashid informed Nicolas Bacca (Ledger CTO) about the fault that could allow hackers to steal financial means from wallet users.

Rashid identified that the wallet`s  microcontroller was insecure. As long as it allowed using displays and buttons in order to enter data, it was joined to the Secure Element (SE) as a proxy. The recent one contained private keys and this fact meant that a hacker could ploy the SE using various methods.

Retailers and resellers might change microcontroller`s firmware that could confirm its “identity” to the SE. According to his view, the attacker could control the user interface and then use malicious code to set coincidence to zero and add the semblance of their own choice. To prove his point, the expert uploaded the video which shows how simply any hacker can get private keys.

After he had sent the results of his research to Ledger, he noticed that the issue was not taken seriously by the team. Then Rashid published a firmware update and seriously criticized it. He had been stating his opinions on Twitter until he was sure that the team posted his critical update and became disturbed so that the attackers didn`t have enough time to use these methods.

Many users were captured by panic. Ledger`s CEO, Eric Larchevêque, gave his answer to one of such messages.  He considered that Rashid had just been trying to become the center of public attention.

Ledger posted another update on March the 20, which explained 3 problems released by progressive program researchers: Timothee Isnard, Saleem Rashid and Sergei Volokitin. Rashid wondered if this really possible to achieve security of the model by using a combination of timing and difficult-to-compress firmware. He got the report from Matthew Green (the cryptographer) that explained the feasible thread and the way how the teenager was able to break through Ledger`s security tactic.

The UK teenager who had recently unveiled a weak spot in cryptocurrency hardware wallet TREZOR One.So, the issue was solved with a healthy communication between both sides. Marek Polatinus (SatoshiLabs CEO) praised Saleem Rashid and said that his hard work as well as creative and extraordinary way of thinking helped them to make modern and even more secure products.

Ledger to Discover HSM Vulnerability

HSM is an external device designed to store public and private keys used to generate digital signatures and to encrypt data, used by banks, exchanges, etc
10 June 2019   1255

A group of researchers from Ledger identified several vulnerabilities in the Hardware Security Module (HSM) devices, which can be used to extract keys or perform a remote attack to replace the firmware of an HSM device. The problem report is currently available only in French, the English-language report is scheduled to be published in August during the Blackhat USA 2019 conference. HSM is a specialized external device designed to store public and private keys used to generate digital signatures and to encrypt data.

HSM allows you to significantly increase protection, as it completely isolates keys from the system and applications, only by providing an API to perform basic cryptographic primitives implemented on the device side. Typically, HSM is used in areas where you need to provide the highest protection, for example, in banks, cryptocurrency exchanges, certification centers for checking and generating certificates and digital signatures.

The proposed attack methods allow an unauthenticated user to gain complete control over the contents of the HSM, including extracting all the cryptographic keys and administrative credentials stored on the device. The problems are caused by a buffer overflow in the internal PKCS # 11 command handler and an error in the implementation of the cryptographic protection of the firmware, which bypasses the firmware check using the PKCS # 1v1.5 digital signature and initiates loading the own firmware in the HSM.

The name of the manufacturer, the HSM devices of which have vulnerabilities, has not yet been disclosed, but it is argued that the problem devices are used by some large banks and cloud service providers. At the same time it is reported that information about the problems was previously sent to the manufacturer and it has already eliminated vulnerabilities in the fresh firmware update. Independent researchers suggest that the problem may be in the devices of the company Gemalto, which in May released an update to Sentinel LDK with the elimination of vulnerabilities, access to information about which is still closed.