Hacking the most popular cryptocurrency hardware wallets [video]

Re:Hacking the most popular cryptocurrency hardware wallets ... by owaty on Friday December 28, 2018 @06:08AM (#18776126)

To make sure I understand, these attacks only work if someone get hold of your hardware wallet (either before or after it's delivered)? So they are stil safe if you buy it directly from the vendor (and trust your delivery service etc.)?

[ Parent | on HN ]

Re:Hacking the most popular cryptocurrency hardware wallets ... by DennisP on Friday December 28, 2018 @08:20AM (#18776540)

The worst attack was against the Trezor; in that case, after your funds are on the device they could steal it, extract the seed, and steal your funds. Using a strong passphrase prevents this attack.

The Ledger Blue was vulnerable to sniffing the PIN entry by radio, but Ledger claims it's not usable in practice.

All attacks against the Ledger Nano required them to get access to the device then give it back to you.

[ Parent | on HN ]

Re:Hacking the most popular cryptocurrency hardware wallets ... by michaelt on Friday December 28, 2018 @10:55AM (#18777433)

  All attacks against the Ledger Nano required them to
  get access to the device then give it back to you.

Presumably if you were planning to exploit these things, you'd blend in with the 90 third-party Ledger Nano S resellers on Amazon [1], offering a slightly lower price.

Doctor the devices to use predictable private keys, sell at a loss to be the cheapest seller on Amazon, then grab all the bitcoins at a time of your choosing, because you know the private keys.

[1] https://www.amazon.com/gp/offer-listing/B01J66NF46/

[ Parent | on HN ]

Re:Hacking the most popular cryptocurrency hardware wallets ... by DennisP on Friday December 28, 2018 @11:21AM (#18777639)

That'd be devastating but so far none of the attacks have managed to make the Ledger create predictable private keys. You'd have to hack the secure chip to pull that off.

[ Parent | on HN ]