Research Team Demonstrates Hard Wallets Vulnerabilities, Trezor Promises Firmware Update

guest · Dec 28, 2018

Research Team Demonstrates Hard Wallets Vulnerabilities, Trezor Promises Firmware Update
December 27, 2018
https://cointelegraph.com/news/rese...lnerabilities-trezor-promises-firmware-update

The research team behind the dubbed “Wallet.fail” hacking project is made up of hardware designer and security researcher Dmitry Nedospasov, software developer Thomas Roth and security researcher and former submarine officer Josh Datko.

During the conference, the researchers announced that they have been able to extract the private key out of a Trezor One hardware wallet after flashing — overwriting existing data — a custom firmware. However, they pointed out that this exploit only works if the user didn’t set a passphrase

Pavol Rusnak, CTO of SatoshiLabs (the company behind Trezor), commented on Twitter that they were not notified through their Responsible Disclosure program prior to the demonstration, and that they will address the reported vulnerabilities through a firmware update at the end of January.
Click to expand...

guest · Dec 28, 2018

Still Got Your Crypto: In Response to wallet.fail’s Presentation
December 28, 2018
https://medium.com/ledger-on-securi...nse-to-wallet-fails-presentation-17bcd166a052

Concerning Ledger, they presented 3 attack paths which could give the impression that critical vulnerabilities were uncovered on Ledger devices. This is not the case.

In particular they did not succeed to extract any seed nor PIN on a stolen device. Every sensitive assets stored on the Secure Element remain secure.
Don’t worry, your crypto assets are still secure on your Ledger device.

We regret that the researchers did not follow the standard security principles outlined in Ledger’s Bounty program. We equally feel that the findings did not provide practical vulnerabilities, as we will discuss underneath. [...]
Click to expand...

guest · Feb 1, 2020

Kraken Labs Reveals How To Hack Trezor Wallet
...which allows hackers to extract seeds in under 15 minutes
February 1, 2020
https://atozmarkets.com/news/kraken-labs-reveals-how-to-hack-trezor-wallet/

Kraken Security Labs announced that they had performed an attack against Trezor’s cryptocurrency hardware wallets. The researchers found that the flaw is inhere

In a Friday blog post, Kraken claimed that they were able to access Trezor One and T wallet keys by manipulating the voltage in the micro-controller. These hardware components hold vital information, such as seeds, yet are not designed for such purposes.
To exploit this bug, an attacker needs access to the physical device, which limits the seriousness of this threat.

However, it is also worth noting that there are no known cases of crypto theft due to exploiting hardware wallet flaws. Also, the vast majority of cryptocurrency theft is due to user error.
Click to expand...

Trezor’s Response
Trezor has responded confirming that it is true that attackers can tamper with users’ devices. They further note that this would be visible as the attacker would have to physically open the case to access the device’s STM32 microchips. Like Kraken, they advise that you keep your device away from strangers.
Click to expand...

Trezor: Our Response to the Read Protection Downgrade Attack

The RDP Downgrade attack is a precise attack that targets the hardware vulnerability of STM32 microchips used in the Trezor One and Trezor Model T hardware wallets and their derivatives such as KeepKey.
[...] This way, the attacker can obtain the encrypted recovery seed from the device.
Click to expand...

Full technical details of the attack:
Kraken: Kraken Identifies Critical Flaw in Trezor Hardware Wallets

Log in or Sign up

Research Team Demonstrates Hard Wallets Vulnerabilities, Trezor Promises Firmware Update

guest Guest

guest Guest

guest Guest

Log in or Sign up

Research Team Demonstrates Hard Wallets Vulnerabilities, Trezor Promises Firmware Update

guest Guest

guest Guest

guest Guest

Useful Searches