Slashdot Mirror
A 15-Year-Old Hacked the Secure Ledger Crypto Wallet (techcrunch.com)
An anonymous reader quotes a report from TechCrunch: A 15-year-old programmer named Saleem Rashid discovered a flaw in the popular Ledger hardware wallet that allowed hackers to grab secret PINs before or after the device was shipped. The holes, which Rashid described on his blog, allowed for both a "supply chain attack" -- meaning a hack that could compromise the device before it was shipped to the customer -- and another attack that could allow a hacker to steal private keys after the device was initialized. The Ledger team described the vulnerabilities dangerous but avoidable. For the "supply chain attack," they wrote: "by having physical access to the device before generation of the seed, an attacker could fool the device by injecting his seed instead of generating a new one. The most likely scenario would be a scam operation from a shady reseller." "If you bought your device from a different channel, if this is a second hand device, or if you are unsure, then you could be victim of an elaborate scam. However, as no demonstration of the attack in the real has been shown, it is very unlikely. In both cases, a successful firmware update is the proof that your device has never been compromised," wrote the team.
Further, the post-purchase hack "can be achieved only by having physical access to the device, knowing your PIN code and installing a rogue unsigned application. This rogue app could break isolation between apps and access sensitive data managed by specific apps such as GPG, U2F or Neo." Ledger CEO Eric Larcheveque claimed that there were no reports of the vulnerability effecting any active devices. "No one was compromised that we know of," he said. "We have no knowledge that any device was affected." Rashid, for his part, was disappointed with the speed Ledger responded to his claims.
Further, the post-purchase hack "can be achieved only by having physical access to the device, knowing your PIN code and installing a rogue unsigned application. This rogue app could break isolation between apps and access sensitive data managed by specific apps such as GPG, U2F or Neo." Ledger CEO Eric Larcheveque claimed that there were no reports of the vulnerability effecting any active devices. "No one was compromised that we know of," he said. "We have no knowledge that any device was affected." Rashid, for his part, was disappointed with the speed Ledger responded to his claims.
I've been reading his Twitter for a while. Smart kid :)
That is actually the most eloquently informing feedback I've ever read.
so if the guy at my local home depot makes 2 copies of my house key..... i'm screwed?
Trump's going to serve her with a bunch of indictments. Just you wait. She'll be WISHING she was the KKK president after she drops the soap the first time in that prison shower room.
Unless you mined the sand yourself, built the lithography machine and pretty much did every other step in building the device you can't be secure against an attack where someone physically substitutes part of the product on you. If the Pseudo Random Number Generator has a seed the attacker knows, or the program in the device is completely rewritten by the attacker or the entire device is counter fit, the bad guy will win and there is nothing that the makers of the Crypto Ledger Wallet can do.
These aren't the attacks I need to worry about. Crypto Ledger Wallet was polite in even responding to this kid. John Biggs (writer for Tech Crunch) is an idiot for even writing the story.
hint to article writers and submitters. If something requires fucking physical access and or admin and pin access like this then it isn't worth an article about. this same vulnerability exists in just about every device and every computer ever sold
Before he gets a chance to comit more crimes.
That's actually one and the same guy replying to himself. Please mod this idiot troll down!
It comes across as a clever and insightful bit of an analysis from a very talented young man.
The lack of any tamper evident packaging I would consider worrying since it does appear you can compromise these in the supply chain and you would have zero idea it's been done.
Why is the fact that the guy is 15 of any importance?
Alkapgo markanızın kurumsal kimlik ve logo tasarım yüzünüzü geliÅYtirir. Sizi markalaÅYtırır. Ã-zgün ve profesyonel logo tasarım www.alkapgo.com
This is similar to the ATM scam where people got access to ATMs during shipping and modified them to send them PINs via text messages. Supply chain attacks are real.
But I always prefer to inject my own seed into the device.
Applying similar reasoning, a given Linux machine is vulnerable to attack because someone with physical access can install Windows in place of it and then install their favorite malware.
If you trust the network to put you in touch with the real hardware wallet vendor (or another trusted agent), then you can verify integrity of the wallet anytime you connect. Banks show personalized: only we know that you know these photos, photos prior to login.
Now, if the network is compromised too...
Somebody is semi-literate here.
No, he is a sand n1gger, a stupid piece of shit that got hyped by the intolerant and racist libturd media.
This has to be a false flag posting. No real racist would make themselves look this idiotic, would they? would they...?
Ledger CEO Eric Larcheveque claimed that there were no reports of the vulnerability effecting any active devices.
Too bad; I'd be impressed if a vulnerability could create an active device out of thin air!
Well I never thought I'd see that phrase in a technical report :-)
A 15-year-old programmer named Saleem Rashid discovered a flaw in the popular Ledger hardware wallet that allowed hackers to grab secret PINs....
The discoverer's age is irrelevent to the story. If he were 30, would we call him a "30-year-old programmer" I think not. Is the author trying to imply, that because the programmer was 15, the vulnerability was more obvious, or easily discovered by even a naive person?
That would be an invalid presumption. There are a whole lot of technically skilled 15 year olds in the world, so how about not trying to discredit them or use their age to imply they shouldn't have been able to do this? Ahem!
"Expert programmer Saleem Rashid discovered a flaw...."
Life has taught me that you can’t control someone’s loyalty. No matter how good you are to them it doesn’t mean that they will treat you the same way. I have been married to my husband for two years with no idea he was cheating. Suddenly i started noticing changes in behavior, i suspected something was wrong. So i confided in a friend who convinced and introduced me to a hacker. He was able to hack into my husband mobile phone, Text messages, Call logs, IG, browser history, deleted messages, Emails and WhatsApp . It seemed as though my life was spinning out of control getting to find out he has someone else. I filed for a divorce just could not continue with lies. If you feel you are been exploited in your marriage and you need proof. I suggest you give enriquehackdemon11@gmail. com what’s app +162 8203 7005 a try. He has been of great help to me and i believe he can be to you.