TREZOR: Bitcoin Gold’s codebase is incomplete

Trezor wallet makes a statement concerning Bitcoin Gold, claiming it will not support it yet
23 October 2017   1526

Days (or rather hours?) away from the Bitcoin hardfork, the crypto community is getting more and more concerned about Bitcoin Gold.

Now, Satoshi Labs, the makers of the hardware wallet TREZOR, make a statement about the upcoming Bitcoin Gold fork. The company claims that it will not support Bitcoin Gold yet.

Still, Trezor team highlights that if there are any Bitcoins held on TREZOR before the block, the customers will have the same Bitcoin Gold balance as their Bitcoin balance. 

In other words, Bitcoin Gold is an altcoin, using Bitcoin’s history similarly to the case of Bitcoin Cash. However, Bitcoin Gold does not launch immediately at the point when the chains diverge.
 

TREZOR team

As for TREZOR (the device), it, in fact, supports Bitcoin Gold. According to the company, with TREZOR, you own your private keys (in form of the seed), therefore you have control over all of your coins, including forked coins. Yet, there are some obstacles.

Bitcoin Gold’s codebase is, at the moment of the writing, incomplete. Most importantly, it lacks replay protection. For this reason, TREZOR Wallet will not support Bitcoin Gold yet, as it would endanger your Bitcoins.
 

TREZOR team

The TREZOR team, as well as Hong Kong Gatecoin team earlir today, stresses out that replay protection, that prevents you from “double spending” your coins after the hardfork, is crucial. 

Talking about supporting Bitcoin Gold if it implements replay protection, the company detailes that they "will make all efforts to develop support for Bitcoin Gold, but will not do so if it will risk your coins". 

What the future has in stock for Bitcoin and Bitcoin Gold, remains to be seen. Just wait for a little while. 

Ledger to Report on Trezor Vulnerabilities

As reported, the security research by the Attack Lab found 5 serious vulnerabilities 
12 March 2019   1085

The leading manufacturer of cryptocurrency hardware wallets Ledger spoke about the vulnerabilities identified in the devices of his direct competitor Trezor. This is stated in a message distributed by the French company on Monday, March 11.

The Ledger study states that the vulnerabilities were discovered by employees of Attack Lab, a division of the company, which, to increase security, hacks both own wallets and competitors' devices. Representatives of Ledger claim that they have repeatedly contacted Trezor regarding the weak points in their Trezor One and Trezor T wallets, and after the disclosure period ended, they decided to make them public.

The first problem is related to authenticity of devices. As Ledger claims, the Trezor device can be simulated by hacking it with malware, and then resealing it in a box, forging a sticker designed to protect against unauthorized access. The latter, said the French company, is easy to remove. It is also claimed that this vulnerability can be eliminated only by reformatting the entire design of Trezor wallets, in particular, by replacing one of the main components with the Secure Secure chip.

Secondly, Ledger hackers were able to pick up a PIN on a Trezor wallet using an attack on a third-party channel. Later, Trezor solved this problem in its firmware update 1.8.0.

The third and fourth vulnerabilities, which Ledger also proposes to eliminate by replacing the main component with the Secure Element chip, are the possibility of stealing confidential data from the device. Ledger claims that an attacker with physical access to Trezor One and Trezor T can extract all data from flash memory and gain control over the assets stored on devices.

The last discovered weakness is also related to the Trezor security model: as stated by Ledger, the Trezor One cryptographic library does not contain adequate countermeasures against hardware attacks. It is alleged that a hacker with physical access to the device can extract the secret key through an attack on a third-party channel, although Trezor claimed that his wallets are resistant to such an attack.

It is noteworthy that in November 2018 Trezor representatives themselves warned that an unknown third party was distributing individual copies of their flagship device, Trezor One, urging users to buy wallets only through their official website.

However, in its report, Ledger claims that users cannot be sure, even if they buy equipment on the Trezor website. An attacker can buy multiple devices, hack them, and then send them back to the manufacturer for compensation. Ledger researchers conclude that if a compromised device is resold, user cryptocurrencies may be stolen.

There's no comment from Trezor team yet.