Re:Kaspersky: Case study: fake hardware cryptowallet (Trezor)
by radicaldreamer on Monday May 15, 2023 @06:36PM
(#35955445)
Seems like this could also be an insider threat where someone at Trezor knew all the BOM details and could pull this off
Re:Kaspersky: Case study: fake hardware cryptowallet (Trezor)
by wmf on Monday May 15, 2023 @06:46PM
(#35955543)
Trezor is mostly open hardware and open source firmware to begin with.
Re:Kaspersky: Case study: fake hardware cryptowallet (Trezor)
by StingyJelly on Monday May 15, 2023 @07:02PM
(#35955683)
More sophisticated version of the malicious firmware could try to patch the new ota firmware image on the fly. Once compromised - always compromised.
Re:Kaspersky: Case study: fake hardware cryptowallet (Trezor)
by londons_explore on Tuesday May 16, 2023 @04:18AM
(#35958963)
It's hard to reliably binary patch something unknown ahead of time.
All Trezor would need to do is change the compilation options on a fairly regular basis, and any patching will fail.
Combine with the fact there is a reward to send in devices means they can analyze any evil devices and make sure their instructions to users will reliably detect all evil devices they're aware of.
Still doesn't stop supply chain attacks, but makes them far harder.
* Offer rewards to anyone able to send me the fake devices or clues who is making them.
* Tell my clients to upgrade the firmware on devices before use. Make sure every new firmware is distinctive in some way - for example the boot screen, and tell the users to check for that to ensure they are actually running the firmware they thought they just flashed.