During the conference, the Chaos Communication Congress presented a report on problems affecting the Trezor and Ledger hardware wallets. The authors of the study are Dmitry Nedospasov, Thomas Roth and Josh Datko. They simultaneously identified several security breaches in the wallets: attacks on a third-party channel, supply chain attacks, and vulnerabilities at the firmware and chip level.
Many manufacturers of such devices apply protective stickers to their products and packaging, indicating that the packaging or the device itself has not been opened. The experts began their presentation with a simple demonstration: using an ordinary hair dryer, the stickers affixed to the Trezor One box and the wallet’s USB port were removed without leaving any traces. The key is to monitor the temperature and not to overheat the stickers and gadgets.
Ledger devices are shipped without a security label, as they effectively guarantee that an integrity check is performed each time the device is powered on, and the Secure Element chip prevents any attempt at physical tampering. Therefore, after getting rid of the stickers on the Trezor, the experts turned to Ledger, “opened” the wallets and gained access to their hardware components.
Next, the experts said that in Trezor wallets, the microcontroller can be replaced. “Once this is done, you can install your compromised bootloader on Trezor devices,” explains Datko. During the presentation, the experts skipped this step, but explained to the attendees that in the lab, they had managed to connect to the hardware debugger and gain free access to the chip, which allowed them to reflash the components with malicious code.
The Ledger wallet, in turn, was fitted with the simplest hardware implant, which allows transactions to be approved without any user intervention. The experts spent only $3.16 on it: they installed an RF switch on the device, which can be controlled remotely via radio frequencies (at a distance of at least 11 meters with a 50W transmitter).
As for the software component of the wallets, the researchers managed to reverse-engineer the firmware update mechanism on the Ledger Nano S and find a bug allowing a custom firmware to be written to the device. The manufacturer had provided protection against such attacks: the authenticity of the firmware image is verified using a cryptographic function. However, once the test is completed, the constant 0xF00BABE is written to memory, and the test is performed only once, not at every device startup. As a result, the researchers concluded that to bypass the protection mechanism, it was enough to place the memory address 0xF00BABE at a specific location. Having done so, they were able to launch the game “Snake” on the compromised device, using the two available buttons to control movement on the wallet’s tiny display.
On the Ledger Blue, a side-channel attack was possible. While studying the device’s hardware, Thomas Roth found that the wallet had a long conductor that behaved like an antenna. The signal is amplified if the device is connected to a USB cable. Using SDR equipment, the experts intercepted and analyzed these radio waves. Roth therefore developed a framework that automatically recorded a signal when a PIN code was entered and used an artificial intelligence model to convert this data into human-readable information. As a result, the experts achieved 90% accuracy in these “predictions”.
Another problem was revealed in the Trezor One wallet, which runs on the STM32F205 microcontroller, essentially controlling the operation of all components. The fact is that in 2017, microcontrollers of this model were found to have a vulnerability to fault injection attacks. Last year, the experts did not know whether this problem extended to hardware wallets, but experts from the CCC reported that after studying the download and update procedures, they discovered that a private key or seed key could be extracted from RAM. Such an attack would give the attacker access to the cryptocurrency and allow them to transfer funds to another wallet.
The manufacturers have already responded to the expert report presentation. Thus, the developers of Ledger stated that all the attacks demonstrated were difficult to carry out, required physical access to the device, and that ordinary users had no reason to worry, since such a compromise is hard to achieve in practice.
The developers of Trezor, in turn, indicated that they were already preparing patches, although they also emphasized that the attacks are only feasible with physical access to the device.
