Rendered at 15:40:45 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
cowlevel 5 hours ago [-]
Not mentioned in article: MediaMarkt, the German equivalent of Best Buy, was selling these compromised devices on store shelves in every city in Germany.
mikeryan 3 hours ago [-]
Selling Ledger wallets or compromised Ledger wallets? My understanding was a reputable reseller (Cryptobilis) was bought and then the wallets were modified via the reseller chain. This isn’t on Ledger it’s a (literal) supply chain attack. Unless MediaMarkt was buying via the reseller?
They would remove them regardless of known compromise, because they have no way to verify it in-house and it’s the simplest PR and legal strategy.
chinathrow 3 hours ago [-]
> This isn’t on Ledger it’s a (literal) supply chain attack.
Supply chain attack?
"Can't do shit, not my problem."
If it was that easy to shed responsibility.
mikeryan 2 hours ago [-]
TBF that characterization was mine. It’s not been Ledger’s response AFAIK.
blensor 4 hours ago [-]
I wonder what the liabilities are for that
drob518 3 hours ago [-]
Not much unless you can show that they knew about it. Otherwise, they are just as much a victim.
V__ 3 hours ago [-]
They are liable. In Germany the seller of a product is responsible not the producer.
superze 1 hours ago [-]
Why doesn't it surprise me that the shittiest company Media Markt is somehow involved in this. These guys are about to close shop anyway, rest in piss Mediamarkt.
They should have posted the weight with and without the device in it.
Also: never leave empty space in a hardware key, pot the whole thing in
epoxy.
theamk 53 minutes ago [-]
No, this is May version. If you look at the twitter thread, the October version is different and looks much more "stock"
(sadly I have not found nice website with newer version photos yet)
flibble 5 hours ago [-]
I heard they reduced the battery size to make space for their chip.
jacquesm 5 hours ago [-]
Yes, hence the potting. You'd have to figure out a way to open the device without breaking it.
londons_explore 5 hours ago [-]
When there are millions of dollars to be stolen, someone can figure out how to remove the potting.
If need be, just grind and cut till you are back to the one silicon wafer that contains crypto keys, then rebuild the whole lot from scratch, add your evil parts, then re-pot it.
jacquesm 4 hours ago [-]
That would work on an already configured wallet that you stole but the skill level required is orders of magnitude higher than what's on display here. I know all of the theory on that one but I would probably not be able to pull that off.
The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip. You'd have definitely been able to spot the difference. This was at the millimeter level. Recently there was a post about a group doing this at the chip level, which I thought was extremely impressive, and again, even with the recipe out there duplicating it would still be very hard.
justinclift 2 hours ago [-]
> The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip.
Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.
With hardware wallets (aka substantial incentive), then the attackers could order a bunch of them for sacrificial zero-ing in the exact places to drill with a CNC/microscope/etc.
jacquesm 1 hours ago [-]
> Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.
Yes, initially I had just the one. But once I had it figured out there were lots of other people that wanted their device 'improved' so that jig got used plenty of times. Even so working on other people's hardware always felt very scary, especially poking around with a drill in a sensitive piece of hardware. Even so, they all worked, it was a neat little trick.
bcraven 3 hours ago [-]
Xbox Kamikaze hack (How a drill defeated the Xbox 360’s console security)
Hah! Very similar, they even made a jig like I did.
curiousObject 4 hours ago [-]
This story is a case of someone tampering with devices in the supply chain, before the user first receives them.
What you’re describing is a different thing. It’s an “evil maid” attack, when you tamper with a wallet that is already set up by the user. Also, it would be ultra difficult and expensive.
What you’re saying is possible. But:
It would probably be cheaper to build a total fake Ledger Wallet, then just replace the new real wallet and deliver a fake with a weak entropy generator. Any case, that’s not what has happened this time.
londons_explore 12 minutes ago [-]
The legit wallets have an online way to verify they are genuine by cryptographic means. A totally new fake couldn't do that.
j-bos 4 hours ago [-]
millions out of thousands of wallets. Epoxy potting raises the lottery ticket and odds of getting caught by a great deal.
m4rtink 3 hours ago [-]
Well, still a safer reason for clandestinely reducing the size of a battery in a mobile device many people carry around close to their body.
This is May version. If you look at the twitter thread, the October version is different and looks much more "stock"
jacquesm 5 hours ago [-]
Ah good one, more useful info in that one. That kapton circuit might be traceable to whoever ordered it.
curiousObject 5 hours ago [-]
And the Vodafone NL SIM could also offer some leads
hocuspocus 2 hours ago [-]
Vodafone NL data only SIMs are very common for IoT connectivity when devices need to roam in Europe, such as in connected cars.
I'd assume it's not a coincidence and fraudsters made sure there's no easy way to trace anything back from the SIMs.
jacquesm 2 hours ago [-]
Yes, this is quite true. Virtual providers are quite easy to set up that way but the amount of KYC for this kind of service is substantial. Even so, these SIMs/eSIMs have turned up in all kinds of bad places such as SIM farms.
jacquesm 5 hours ago [-]
I have some friends there, I will ping them.
lxgr 4 hours ago [-]
Is that safe for devices containing a lithium battery?
jacquesm 4 hours ago [-]
Good question: the battery here doesn't look like it had any room for expansion so it wouldn't be worse per se. But normally you want a little bit of room around a battery, I guess a thin foam liner would allow for that and would still allow you to pot the whole thing.
lxgr 2 hours ago [-]
Worst case, a bloating battery cracking open a plastic enclosure or being able to vent gas through the gaps in one would be preferable too, right?
jacquesm 2 hours ago [-]
Absolutely and it is why I hate these little pouch cells in wearables. Phones, headphones, in-ear pods, sports gear, toys (which kids take to bed), they're absolutely everywhere and if you look at the way they are usually mounted it is a small miracle there aren't more issues. Powerbanks in particular are a pretty serious hazard.
varispeed 4 hours ago [-]
They could x-ray it, carve out epoxy with nothing inside, put the logger, apply epoxy.
jacquesm 2 hours ago [-]
Not that easy. The potting epoxies made for this purpose are nothing like your regular epoxies. They're pricey and when you try to break them you are very likely to tear the parts right off the board. This is the brand I have used in the past:
The devices we made were put in places where there was a significant risk of tampering and to the best of my knowledge nobody ever managed to break the epoxy bond to the point that the circuit was still functional. But as I wrote above: not cheap.
InsidiousWombat 4 hours ago [-]
Take off the case, put your own entire module in, put the case back in. Epoxy doesn't solve much.
...frankly, selling one as DIY kit have highest chance for tamper resistance. Tho pretty untenable with small SMD components sadly
Man, I wish there were some pictures. I didn’t even know that there are LTE modems that small.
TacticalCoder 6 hours ago [-]
There are pictures online. And for an unexplainable reason it is the person behind the biggest Bitcoin exchange SNAFU of all times (where hackers stole something like 800 000 Bitcoins), Mark Karpeles of "Mt. Gox" (who did jail time btw), who was the first to post them:
Apparently the hacker did remove the battery and replace it with a smaller one, leaving enough room for the tiny eSIM/LTE modem / OCR chip that did recognition of the secret on screen.
LOL why would anyone want a hardware wallet when you can just store your Bitcoins on your own encrypted hard disk or USB stick? Bitcoin is merely a file.
These people are being suckered into a false sense of security with hardware cryptowallets. I mean, it would be very tempting to sell a hardware wallet with a backdoor inside of it to steal everyone's cryptocurrency, wouldn't it?
karel-3d 5 hours ago [-]
Not your factory, distributor, warehouses, fulfillment centers and entire supply chain, not your coins.
chinathrow 3 hours ago [-]
I wonder why they only managed to steal 100M so far. Like with the order of effort needed, why haven't they waited for the really big fish to unlock their ledger?
agos 2 hours ago [-]
because the longer they wait, the higher the chance of being discovered before they're able to steal anything. I'm sure there's some game theory about this
stingraycharles 4 hours ago [-]
Reminds me of that time when state actors wanted to spread the Stuxnet worm into an air gapped nucleair facility in Iran, and basically hijacked the whole USB supply chain and put the worm in there.
When enough resources / money is involved, these things are to be expected.
curiousObject 5 hours ago [-]
Here’s a new market for $500 Faraday Cages, if any HN readers are interested in selling that
wildzzz 4 hours ago [-]
Makes the claim from BI that Supermicro had malicious hardware implants a little more believable, eh?
ArtRichards 4 hours ago [-]
"Because whoever can read the screen wins." This is a bit surprising from Heise.de?
tom_ 23 minutes ago [-]
At the bottom:
> This article was originally published in German. It was translated with technical assistance and editorially reviewed before publication.
Presumably "technical assistance" covers just about everything.
The technique is so coool. I mean taping the screen output on the way to the display to get around having to hack the secure element. :)
grishka 4 hours ago [-]
I had a similar idea to bypass DRM for a while. Some kind of board that goes between the display panel driver and whatever sends it the signal, and outputs something you can capture, e.g. DVI or unencrypted HDMI. Not sure how practical it is.
You should have a paper backup of your hardware wallet anyway. The point of the wallet is to perform cryptographic calculations you’ll probably rather not do in your head.
alchemist1e9 3 hours ago [-]
This was stealing the seed phrases as they were being displayed so the user could make the paper backup you suggest and in the process have all their current and future coins stolen.
lxgr 2 hours ago [-]
Yes, somehow the hardware wallet does need to import or export the seed phrase in some form.
TacticalCoder 6 hours ago [-]
I already commented the other day on this exploit but really it's fascinating.
I don't care about cryptocurrencies but I've always been fascinated by the cryptography behind it. I've also dabbled with hardware wallets for non-cryptocurrencies stuff: like U2F auth.
The idea of a master secret that is behind a secure element which I control and which I can duplicate is amazing to me (as opposed to, say, "your" passkeys which Google/Microsoft/Apple can basically backup and transfer to other devices for you).
But really to me in the cryptocurrencies world people have been sold the lie that a hardware wallet was secure: it's not. It could be tampered with (as happened in this hack, where an additional rogue chip reading the screen and then sending it using an eSIM steals the secret) but it can also contain a bug (like the recent Coldcard exploit where Coldcard hardware wallets fell back on a RNG with only 32 bits of entropy and some dark-hat hacker cracked those and stole Bitcoins) and, most of all, the vendor of the hardware wallet itself can do nasty attacks (like "kleptography").
From the very start everybody in the ecosystem should have pushed of "n-of-n" schemes (say even just 2-of-2), where one secret goes on a hardware wallet from one vendor and the other secret goes on a hardware wallet from another vendor.
For years and years the tune has been: "PCs cannot be trusted, use a hardware wallet" but it mislead people.
PCs indeed cannot be trusted but unsuspecting users should have learned how to use 2-of-2 or 3-of-3 schemes, to become immune from hacks affecting one hardware wallet vendor.
The typical, non-sensical, response to this is the idiotic: "but if you have two secrets, if you lose one of them you lose everything". It's totally idiotic for people basically save a list of 24 words (the "seed", which is the master secret). Well, guess what: instead of saving a list of 24 words, you save a list of 48 words. Exact same thing, just twice longer.
That's my take: the entire "your coins will be safe if you use a hardware wallet" was misguided.
cowlevel 5 hours ago [-]
You might be interested by the Tillltis TKey - it's an open-source open-hardware programmable-by-the-user secure element.
thinkmassive 3 hours ago [-]
m-of-n provides increased security AND redundancy.
2-of-3 allows loss of one key, 3-of-5 allows loss of two keys, etc
The cost is increased complexity, but the alternative is potentially losing everything due to a single mistake. So far people seem to overweigh the complexity of multisig, and to overestimate their understanding of using a single signing device.
tokai 3 hours ago [-]
+15 years later and it still doesn't do anything but provide idiots a way to lose their money. It really is impressive.
djohnston 5 hours ago [-]
[dead]
InsidiousWombat 4 hours ago [-]
finally, good use for eSIMs /s
But damn, it's hard problem to fix. Put it in epoxy and while tampering is harder (not impossible! also can just replace whole module), you can't verify it
knorker 6 hours ago [-]
If you lie down with dogs, you will get up with fleas.
Dogs = cryptocurrencies. Fleas = scammed.
JKCalhoun 5 hours ago [-]
Yep. Crypto is more clever than I am—and there are scammers in the field equally so.
(My hardware wallet is made of pleather and holds paper bills.)
birdsongs 6 hours ago [-]
Garbage website that doesn't allow me to reject tracking cookies without paying.
> Data processing by advertising providers including personalised advertising with profiling
> Consent [required for free use]
jocoda 2 hours ago [-]
Just delete the cookies after if you absolutely must go to the site.
cowlevel 5 hours ago [-]
Most websites do this, they just don't give you the option.
Oh-Kay_Labs 4 hours ago [-]
Oh-Kay_Labs have said it for years. Not only hackers and thieves go for them, but also kidnappers and robbers. If anyone knows you have one, and things could be much worse. Use paper-wallets, old phones and encrypted USBs instead.
arccy 3 hours ago [-]
use leather wallets and paper cash...
KetoManx64 2 hours ago [-]
Government currencies deflates at 15% a year, Bitcoin doesn't.
expedition32 3 hours ago [-]
Or just open a bank account like a normal person. But I suppose that requires deprogramming yourself out of the crypto cult.
akimbostrawman 4 hours ago [-]
>Use paper-wallets, old phones and encrypted USBs instead.
None of these prevent thieves or anybody from knowing you have one worth stealing. The actual solution is to not use fundamentally broken transparent crypto like BTC that broadcasts to the whole world your exact funds and ties them to your identity on every transaction. With monero your funds could be 0,10 or 10 billion and that is nobody's business.
Supply chain attack?
"Can't do shit, not my problem."
If it was that easy to shed responsibility.
https://grandideastudio.com/portfolio/security/ledger-hardwa...
They should have posted the weight with and without the device in it.
Also: never leave empty space in a hardware key, pot the whole thing in epoxy.
(sadly I have not found nice website with newer version photos yet)
If need be, just grind and cut till you are back to the one silicon wafer that contains crypto keys, then rebuild the whole lot from scratch, add your evil parts, then re-pot it.
The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip. You'd have definitely been able to spot the difference. This was at the millimeter level. Recently there was a post about a group doing this at the chip level, which I thought was extremely impressive, and again, even with the recipe out there duplicating it would still be very hard.
Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.
With hardware wallets (aka substantial incentive), then the attackers could order a bunch of them for sacrificial zero-ing in the exact places to drill with a CNC/microscope/etc.
Yes, initially I had just the one. But once I had it figured out there were lots of other people that wanted their device 'improved' so that jig got used plenty of times. Even so working on other people's hardware always felt very scary, especially poking around with a drill in a sensitive piece of hardware. Even so, they all worked, it was a neat little trick.
https://www.xda-developers.com/how-drill-defeated-the-xbox-3...
What you’re describing is a different thing. It’s an “evil maid” attack, when you tamper with a wallet that is already set up by the user. Also, it would be ultra difficult and expensive.
What you’re saying is possible. But:
It would probably be cheaper to build a total fake Ledger Wallet, then just replace the new real wallet and deliver a fake with a weak entropy generator. Any case, that’s not what has happened this time.
I'd assume it's not a coincidence and fraudsters made sure there's no easy way to trace anything back from the SIMs.
https://www.masterbond.com/techtips/tamper-resistant-potting...
The devices we made were put in places where there was a significant risk of tampering and to the best of my knowledge nobody ever managed to break the epoxy bond to the point that the circuit was still functional. But as I wrote above: not cheap.
...frankly, selling one as DIY kit have highest chance for tamper resistance. Tho pretty untenable with small SMD components sadly
Apparently the hacker did remove the battery and replace it with a smaller one, leaving enough room for the tiny eSIM/LTE modem / OCR chip that did recognition of the secret on screen.
They're here. It's wild.
These people are being suckered into a false sense of security with hardware cryptowallets. I mean, it would be very tempting to sell a hardware wallet with a backdoor inside of it to steal everyone's cryptocurrency, wouldn't it?
When enough resources / money is involved, these things are to be expected.
> This article was originally published in German. It was translated with technical assistance and editorially reviewed before publication.
Presumably "technical assistance" covers just about everything.
I don't care about cryptocurrencies but I've always been fascinated by the cryptography behind it. I've also dabbled with hardware wallets for non-cryptocurrencies stuff: like U2F auth.
The idea of a master secret that is behind a secure element which I control and which I can duplicate is amazing to me (as opposed to, say, "your" passkeys which Google/Microsoft/Apple can basically backup and transfer to other devices for you).
But really to me in the cryptocurrencies world people have been sold the lie that a hardware wallet was secure: it's not. It could be tampered with (as happened in this hack, where an additional rogue chip reading the screen and then sending it using an eSIM steals the secret) but it can also contain a bug (like the recent Coldcard exploit where Coldcard hardware wallets fell back on a RNG with only 32 bits of entropy and some dark-hat hacker cracked those and stole Bitcoins) and, most of all, the vendor of the hardware wallet itself can do nasty attacks (like "kleptography").
From the very start everybody in the ecosystem should have pushed of "n-of-n" schemes (say even just 2-of-2), where one secret goes on a hardware wallet from one vendor and the other secret goes on a hardware wallet from another vendor.
For years and years the tune has been: "PCs cannot be trusted, use a hardware wallet" but it mislead people.
PCs indeed cannot be trusted but unsuspecting users should have learned how to use 2-of-2 or 3-of-3 schemes, to become immune from hacks affecting one hardware wallet vendor.
The typical, non-sensical, response to this is the idiotic: "but if you have two secrets, if you lose one of them you lose everything". It's totally idiotic for people basically save a list of 24 words (the "seed", which is the master secret). Well, guess what: instead of saving a list of 24 words, you save a list of 48 words. Exact same thing, just twice longer.
That's my take: the entire "your coins will be safe if you use a hardware wallet" was misguided.
2-of-3 allows loss of one key, 3-of-5 allows loss of two keys, etc
The cost is increased complexity, but the alternative is potentially losing everything due to a single mistake. So far people seem to overweigh the complexity of multisig, and to overestimate their understanding of using a single signing device.
Dogs = cryptocurrencies. Fleas = scammed.
(My hardware wallet is made of pleather and holds paper bills.)
> Data processing by advertising providers including personalised advertising with profiling
> Consent [required for free use]
None of these prevent thieves or anybody from knowing you have one worth stealing. The actual solution is to not use fundamentally broken transparent crypto like BTC that broadcasts to the whole world your exact funds and ties them to your identity on every transaction. With monero your funds could be 0,10 or 10 billion and that is nobody's business.