15 years old Saleem Rashid Bitcoin enthusiast fascinated by cryptography and trustless systems and security researcher has found vulnerabilities in hardware wallets Trezor and Ledger Nano.
A hardware wallet has significant security features compared to other storage options. However, the devices also have vulnerabilities, allowing several types of attacks that are discovered by security researchers.
The attacks and vulnerabilities of a Ledger hardware wallet were recently detailed by Saleem Rashid, a 15-year old tech wiz, considered a “rock star” in the crypto community. He has been known for the Trezor SRAM exploit, and for participating in the story of unlocking about 7 BTC from a hardware wallet. Later, the knowledge on how to remove the seed from a Trezor served to increase the wallet’s security.
Teenager Saleem Rashid is becoming one of the influential voices in the crypto space he has more than 11k followers on Twitter, and his tweets are a source of information on hardware wallet safety.
Saleem Rashid exposed a vulnerability in his blog, by demonstrating proof-of-concept code that had allowed him to backdoor the Ledger Nano S, a $100 hardware wallet that has been sold by the millions. The stealth backdoor Rashid developed is a minuscule 300-bytes long and causes the device to generate pre-determined wallet addresses and recovery passwords known to the attacker. The attacker could then enter those passwords into a new Ledger hardware wallet to recover the private keys the old backdoored device stores for those addresses.
By using this vulnerability, attackers could perform a variety of other nefarious actions, including changing wallet destinations and amounts for payments.
Using the same approach works on the $200 Ledger Blue, which is billed as a higher-end device. Variations on the exploit might also allow so-called “evil maid attacks,” in which people with brief access to the device could compromise it.
Two weeks ago, Ledger officials updated the Nano S to mitigate the vulnerability Rashid privately reported to them in November. In the release notes for firmware version 1.4.1, however, Ledger Chief Security Officer Charles Guillemet stressed the vulnerability was “NOT critical.”
Rashid said he has yet to verify that this month’s Nano S update fully neutralizes his proof-of-concept backdoor exploit as claimed by Ledger. But even if it does, he said he believes a key design weakness in Ledger hardware makes it likely his approach can be modified so that it will once again work.
Matt Green, a Johns Hopkins University professor specializing in encryption security, has reviewed Rashid’s research. Green told Ars the dual-chip design makes him skeptical that this month’s update permanently fixes the weakness Rashid exploited.
Explanation of the Hack made on Ledger Nano
Ledger engineers took steps to prevent the MCU from being capable of misrepresenting to the Secure Element the code that’s running on the device. The Secure Element requires the MCU to pass along the entire contents of its flash memory. At the same time, the MCU has a relatively limited amount of flash memory. To sneak malicious code onto a hardware wallet, the MCU must, in theory, store the official Ledger firmware and the malicious code. Generally speaking, the storage capacity of the MCU should prevent this kind of hack from working.
Rashid got around this challenge after noticing that the MCU stores both a bootloader and firmware and that the certain types of software functions called “compiler intrinsics” in these separate programs were identical. He then removed the intrinsics in the firmware and replaced them with his ultra-small malicious payload. When the Secure Element asked the MCU for its flash contents—which, of course, included the unauthorized firmware—Rashid’s hack pieced together a legitimate image by removing the malicious code and replacing it with the legitimate intrinsics from the bootloader. As a result, the Secure Element mistakenly verified the backdoored firmware as genuine.
The result was a device that generated wallet addresses and recovery passwords that weren’t random but, rather, were entirely under the control of the backdoor developer. The 24 passwords, which technically are known as recovery seed, are used in the event a hardware wallet is lost or broken. By entering the seed into a new device, the wallet addresses’ private keys stored in the old device are automatically restored.
A video posted on Rashid’s blog shows a device displaying the word “abandon” for the first 23 recovery passwords and “art” for the remaining one. A malicious backdoor could provide a recovery seed that appeared random to the end user but was entirely known to the developer.
“He’s carving up the firmware in a really efficient way to fit it into a tiny amount of space to pull off the attack here,” said Kenn White, an independent researcher who reviewed Rashid’s research before it was published. “It’s well done, it’s clever, it’s creative, and it’s devastating.”
Rashid told Ars that it might have been possible for his backdoor to do a variety of other nefarious things. He also said the weaknesses could be exploited in evil-maid scenarios in which someone has brief access to the device and possibly by malware that infects the computer the device is plugged into. Researchers are usually quick to point out that physical access and malware-infected computers are, by definition, compromises on their own and hence shouldn’t be considered a valid means for compromising the hardware wallets. The chief selling point of hardware wallets, however, is that they protect users against these fatal events.
Rashid declined to provide much personal information to Ars other than to say he’s 15, lives in the south part of the UK, and is a self-taught programmer. Neither White nor Green said they verified Rashid’s age, but they also said they had no reason to doubt it.
Hardware wallets are continuously updating themselves whenever a bug is found. The most recent update is for Trezor, releasing a new security version:
Meanwhile, competitor Ledger, the producer of the Nano series hardware wallets, has taken the approach of a bounty program.
Buying from unreliable sources may lead to losses if an attacker has had a chance to make the device divulge its private seed.
“What is important from a user perspective is to able to prove the genuineness of your device and the authenticity of the firmware you load. Those two security claims remain intact.”
You should buy your hardware wallet from a trusted source and make sure that device wasn’t tempered with, always check for updates of your device and follow the latest news updates about potential hacks. But other than that hardware wallets are still one of the safest ways to store your crypto assets.