Recently Discovered Wallet Vulnerabilities Not Critical


Ledger said the newly discovered vulnerabilities in his hardware portfolio were not critical in an official article on Medium, published December 28.



Yesterday, at a conference entitled Refreshing Memories 35C3 in Berlin, the researchers claimed they had managed to hit the cryptocurrencies of Trezor One, Ledger Nano S and Ledger Blue.

In the paper, the company explains that there are "three modes of attack that may give rise to the impression that critical vulnerabilities have been discovered," but to them, "this is not the case."



According to Ledger, this vulnerability is not critical because "they have failed to extract the seed or PIN code on a stolen device" and "sensitive assets stored on a safe item remain" secure. "

 According to the company's allegations, Ledger's Nano S vulnerability has shown that the physical modification of Ledger Nano S and the installation of malicious software on the victim's personal computer enabled the attacker to sign the transaction after entering the PIN and launching the Bitcoin (BTC) application. "

According to Ledger, it is "quite impractical, and a motivated hacker would certainly use more effective tricks." Researchers have claimed that their vulnerability allowed them to "send malware to ST31 [secure chip] and even self-certification," Ledger denied, saying,

"Their firmware launches the snake on the MCU in run mode, which means that when you run, you have to press the left button and the Secure Element does not even start."

Ledger also claims that the demonstration of Ledger Blue's attack is "somewhat unrealistic and impractical," arguing that "the position of the receiver and the devices to be attacked must be the same, the position of the USB cable is also most important (as it acts as an antenna)."

The article states that "if the conditions are not the same, the machine learning classifier will not work properly". That is why Ledger concludes:

"This attack is certainly interesting, but it does not allow a person to hit a PIN in real terms (does not require the device to move)."

Also, due to this vulnerability, Ledger said that the next Ledger Blue firmware upgrade would include a random keyboard pin.



The company also said it "regrets that the researchers did not follow the standard security principles outlined in the Ledger's Bounty program." According to Ledger, "in the security world, the disclosure of information is a common method." This is a model in which vulnerability is detected only after a reasonable period, helping to correct vulnerability and mitigate risk to users. "

In November, Ledger announced expanding into New York to expand its institutional custody offer, the Ledger Vault. Also, the company has recently signed a Crypto.com crypto-payment agreement to allow customers to pay for their Crypto Currency products.

Post a Comment

0 Comments