Posted by thm 1 day ago
https://crypto.news/ledger-confirms-hidden-chip-in-crypto-wa...
https://www.youtube.com/watch?v=8JnHdr30v4g
Apparently the hacker did remove the battery and replace it with a smaller one, leaving enough room for the tiny eSIM/LTE modem / OCR chip that did recognition of the secret on screen.
They're here. It's wild.
Give me a shitty html4 page with the text ffs.
tl;dr Implant is just a little cell phone that does OCR of the hardware wallet's screen during setup to steal the recovery phrases. The implant's design has improved notably three different times before landing on a pretty darn sleek spot-welded overlay that is laminated flat onto the host.
I guess the sweatshop workers would then need to be trained in reballing BGAs if they did that.
We're dealing with reasonably sophisticated state actors here in this dark forest; not script kiddies.
Cheap $5 PCB + programmable small FPGA is a very viable route too for hardware implants; but even a microcontroller / ESP32/etc will probably do.
Cellular communications hardware seems very sophisticated and expensive compared to a simple microcontroller.
Eg. https://dangerousthings.com/products/apex-flex?Antenna=Narro...
They did, in fact, appear to mass-manufacture a custom-built flat flex implant with cellular (LTE-M!), eSIM, and everything that hid right inside the Ledger, sniffing the SPI reads to the display to read the recovery phrases it pukes out and send 'em over cellular to the ringleader.
It's an EXTREMELY well built implant. I'm impressed. Multiple revisions, even.
The money's too hot to not build shit like this and slip it into the stream. Even a few thousand in R&D netting a six figure ROI is worth it, getting millions is just the icing.
Amateur hour all around.
You're better off just having a dedicated laptop for crypto transactions.
Actually the only one I know is the Gnosis Safe. Talk about creating a huge risk if it would have a problem.
If you can't get to the insides without breaking it, the only devices verified to likely be safe would be unusable too, so the product would in practice be even more unsafe.
If the user first inspects it and then glue it on their own, that would work, but it wouldn't solve this problem. Evil maid attack is something else and obviously harder at scale.
Even if one were to ignore the latest incident, which arguably isn't their fault, the first three incidents make up a pretty bad security track record.
How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
I'd not release them soo easily from their share of responsibility. Tamper-proof hardware is a thing, electronic funds transfer terminals for example already implement ways to detect or prevent physical intrusion into safety-relevant parts of the device. Would probably have cost a few cents in manufacturing to add countermeasures to physical modification into the Ledgers. The fact that there is not even the slightest attempt at securing the device against this kind of attacks is entirely on the manufacturer.
> How a French (EU based) company is still in business after all of this, is an indicator of selective enforcement of EU privacy laws (GDPR, etc).
Surely you can name a dozen of US companies that have been driven out of business by enforcement of EU privacy laws. But I'd be glad if you'd at least name a single one!