Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts (bleepingcomputer.com) 10
Longtime Slashdot reader AmiMoJo shares a report from BleepingComputer: Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia. Some researchers have shown the implant in Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware.
[...] In a report over the weekend, Tibane Labs notes that the threat actor made room for the malicious circuitry by replacing the original battery with a smaller one, which powers both the implant and the Ledger X. "Under the battery and antenna sits an ST STM32G431KBU6 (Arm CortexM4, 128 KB flash, UFQFPN32)," the researchers found inside one of the devices. For connectivity, the actor used "a tiny eSIM, an 8pad package just 2x2 mm, next to the MCU, and a shielded LTE module that sends the words out."
[...] Ledger is advising users to avoid purchasing from unauthorized resellers as they run an increased risk of getting counterfeit or modified devices. The company is also reminding its authorized resellers and distributors to get the products only through authorized channels and to avoid restocking returned products. Ledger provides a 'Genuine Check' mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device's original Secure Element remains intact.
[...] In a report over the weekend, Tibane Labs notes that the threat actor made room for the malicious circuitry by replacing the original battery with a smaller one, which powers both the implant and the Ledger X. "Under the battery and antenna sits an ST STM32G431KBU6 (Arm CortexM4, 128 KB flash, UFQFPN32)," the researchers found inside one of the devices. For connectivity, the actor used "a tiny eSIM, an 8pad package just 2x2 mm, next to the MCU, and a shielded LTE module that sends the words out."
[...] Ledger is advising users to avoid purchasing from unauthorized resellers as they run an increased risk of getting counterfeit or modified devices. The company is also reminding its authorized resellers and distributors to get the products only through authorized channels and to avoid restocking returned products. Ledger provides a 'Genuine Check' mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device's original Secure Element remains intact.
Not much of a surprise (Score:5, Insightful)
Looks like these "hardware wallets" are pretty cheap trash. Actually secure hardware would have come with a possibility to open and visually inspect and reference pictures. Also with an actually secure shipping container.
Well, I guess the crapto-fans are not only clueless about the real nature of crapto.
Re: (Score:3, Interesting)
Re: (Score:2)
The trick is the average person can't keep that basic computer secure either.
"Be your own bank" is good but banks have armored cars and vaults and insurance.
If you write down your seed you better keep it in a place where nobody can ever find it.
There's no great solution that will always work. Some people do a dedicated Graphene phone and bury their seed stamped into titanium using a OTP in a forest an hour from home but for others there's a reason hardware wallets have market appeal.
I wish I had these four
Re: (Score:2)
The trick is the average person can't keep that basic computer secure either.
That's why you have a second specialized computer for financial stuff and nothing else. Could be a dirt cheap chromebook. Could be that old retired lap. So long as it gets a factory reset/wipe and software updates, which might require an old PC having linux installed.
Genuine chip, bonus modem (Score:5, Interesting)
You don't have to crack the secure element if you can just read the recovery words off the display. That's what makes this implant [bleepingcomputer.com] nasty: the legitimate hardware can keep doing its job while the added hardware steals everything needed to empty the wallet. I understand why Genuine Check has that limitation, but a successful check is going to reassure people. "Yes, that's our chip" is a much narrower promise than most buyers will hear. That distinction ought to be obvious when the check passes, instead of something you discover in a support article after your money disappears.
Re: (Score:2)
A hardware wallet sounds like a good home for that design. Recovery words, addresses, amounts, a few menus... primitive graphics would be fine. I'd happily put up with ugly text for a protected path all the way to the panel. From your description, encrypting that link would have made this particular implant's job a lot harder. Keeping the keys inside the secure element only gets you so far when the recovery words have to cross an exposed display connection.
"Nobody bought it" is a depressing ending. Somebod
(1) Snark and (2) Serious (Score:5, Interesting)
(2) It's becoming more apparent that not only are hardware supply-chain attacks becoming more prevalent (that's hardly news) but they're becoming cheaper to execute -- which means that devices which might have escaped previously may be targeted now, because now it's cost-effective to do so. Moreover, the market for fake products is expanding thanks to trade restrictions and tariffs, so anybody who can build a credible forgery and market it appropriately is probably going to be able to do a lot of damage before they're caught....if they're caught.
Cash! (Score:1)
I never trusted hardware wallets (Score:3)
Why would I let someone else generate my secrets? It never made any sense.