Wallet Vulnerabilities Revealed on Stage at 35C3

Wallet Vulnerabilities Revealed on Stage at 35C3

A team of security researchers hacked into the Trezor One, Ledger Blue and Ledger Nano S - but for a staged demonstration called Wallet.fail. Initially, their findings were first put on display at the 35th Chaos Communication Congress (35C3) in Leipzig, Germany. If they had done it via Responsible Disclosure practices, which would have allowed the manufacturers to patch the vulnerabilities and protect their customers from any potential attack. But, the vulnerabilities appear to be very difficult for attackers to actually exploit.

Some of the vulnerabilities revealed in the presentation were several that could have been fixed with a firmware upgrade on the hardware wallets in question.

The Chief Technology Officer Pavol Rusnak stated that their company was not notified about the vulnerabilities and insisted that if the demonstration is done through "Responsible Disclosure program" they could have had a heads up. "With regards to #35C3 findings of @Trezor: we were not informed via our Responsible Disclosure program beforehand, so we learned about them from the stage. We need to take some time to fix these, and we'll be addressing them via a firmware update at the end of January."

The Vulnerabilities identified

The vulnerabilities identified by the researchers appear to be immune to remote exploitation as most of them require that the intruder have physical access to the devices in question — and sometimes access to the owner’s computer as well

At the presentation, the security experts claimed to have flashed a Trezor One hardware wallet, which allowed them to extract the mnemonic seed (and PIN) from the RAM, going on to add that the vulnerability can only be exploited against users who don't set a passphrase.