15-year-old Security Researcher Uncovers Flaw in Ledger’s Cryptocurrency Hardware Wallets
A major security vulnerability has been discovered in Ledger hardware wallets, prompting the company to issue an official statement. The security flaw was first detected by a 15-year-old British security researcher, named Saleem Rashid. He discovered a hardware-based attack vector that affected all variants of wallets offered by the company, including the Ledger Blue, in November 2017.
Ledger, in response, released an updated firmware, 1.4.1, on March 6, 2018. Saleem Rashid disclosed the attack source code to Ledger with a proper explanation of the exploit. He said, “the vulnerability arose due to Ledger’s use of a custom architecture to work around many of the limitations of their secure element.” This shows that even though hardware wallets were said to provide the best security, there is still a possibility that they can be hacked under certain conditions. Open source hardware could be a promising way to mitigate such vulnerabilities in the future.
Ledger hardware wallets have been so popular that the company has failed to meet market demand for its best selling product Ledger Nano S. As a result, people have begun looking up to third-party websites online to buy the Nano S or other cryptocurrency hardware wallet. The catch here, however, is that there is no way to verify that a purchased wallet is secure. There are chances are that a hardware wallet may have been already infected before the vendor sold it.
Thus, hackers could corrupt the hardware wallet before it even reaches the hands of a user. The malware would be stored in the hardware wallet itself, thereby leaking its private keys. Once the user activates the wallet for his use, the hacker could siphon the balance as per his wishes. Such a kind of attack, where the user receives an infected product, is known as a supply chain attack.
The official statement issued by Ledger now warns users of MCU fooling. “If you bought your device from a different channel, if this is a second-hand device, or if you are unsure, then you could be a victim of an elaborate scam. However, as no demonstration of the attack in the real has been shown, it is very unlikely.”
Furthermore, there is also the possibility of an isolation exploit attack taking place. The bug was reported by another researcher, Sergei Volokitin. Since this attack can only be carried out by having physical access to a device, there is a very low chance of such an attack. The exception to this is if a user ever installed an unsigned application, which may also be a way for malware to make its way onto the device.
Yet another security researcher, Timothee Isnard, discovered the Oracle padding attack. Discovered by Serge Vaudenay in 2002, the hacker can use the method to decrypt bytes of the data stream. The company has confirmed that such a flaw exists but has pointed out that the security researcher could only decrypt a few select bytes of the data stream. Ledger said, “Our SCP has been updated to add the MAC part which prevents this kind of attack. Furthermore, additional countermeasures have been implemented server-side mitigating the issue until the 1.4.1 upgrade is available.”
The three security researchers, who highlighted these important security flaws, are eligible to receive bounty payments from Ledger.
