Researcher shows physical attack on hardware wallet to apply backdoor

A researcher has found a vulnerability in Ledger’s Nano S hardware wallet, and possibly also the Blue variant, that allows for various attacks, such as applying a backdoor that pre-records the seeds for generating private keys.

The researcher, who is called Saleem Rashid and says he is 15 years old, has summarized his findings in a blog post. In it, he writes that it is possible via an exploit to adjust the so-called seed that is normally used to create a private key, with which users can manage their cryptocurrencies. Rashid has posted poc code on GitHub, which is not really usable for security reasons. The idea, according to Rashid, is that control over the seed, which consists of 24 different words, underlies the generation of the private key. By making changes to the firmware in advance, it would be possible to get private keys, according to the researcher. His scenario is based on a rogue seller of the hardware wallets.

Rashid describes that the vulnerability has to do with the design of the Nano S and Blue hardware wallets, where the latter would have the same function as the Nano S studied. For example, there is an architecture based on two chips: one secured ST31H320 chip as a Secure Element and another unsecured STM32F042K6 mcu that interfaces with the secure chip, controls the screen and buttons, and allows for USB connection.

In this case, the secure chip stores the private keys. According to Rashid, this makes it possible to adjust the firmware on the mcu, which must then be verified again by the secure chip. The problem is that even an mcu with modified firmware can pretend that no modifications have been made in order to mislead the Secure Element. Cryptographer Matthew Green responded to Rashid’s blog post by stating that this is a more common problem in embedded devices.

Ledger design according to Rashid

To protect against modifications, French company Ledger has equipped the MCU with limited storage to make it more difficult to launch an attack. For example, an attacker would have to store the malicious firmware next to the legitimate variant to fool the Secure Element. However, the researcher found a solution here through code caving, by placing his malicious code in redundant compiler intrinsics.

Since it is not possible to directly attack the Secure Element, Rashid focused on modifying the user interface on the device itself, which shows the words that form the seed for the private key and serve as a backup for the user. He demonstrates how to set these in advance in a video. For demonstration purposes it can be seen that the word ‘abandon’ is shown 23 times and finally the word ‘art’.

Ledger has dedicated its own blog post to the discovery, saying an update has been released to protect against the attack. In it, the company also says that the attack does not reveal any seed or private keys, because “fooling the MCU has no consequences for the Secure Element.” In addition, such an attack would be detected the moment the device connects to the company’s servers via Ledger Manager. As a countermeasure, Ledger optimized and rearranged the mcu firmware so that this particular attack is no longer possible. In addition, the Secure Element tracks the timing of the mcu to counteract the use of compression. Rashid questions this solution and Green also tells Ars Technica that it may not completely solve the problem.

According to the site, the attack is striking, because Ledger claims that his devices are protected against modifications. For example, it adds a flyer to its devices stating that there are no security stickers on the box, precisely because of this protection. It also believes its devices are safe enough to allow them to be sold through third parties. Rashid reported his findings to Ledger in November, but declined to participate in the bug bounty program so he could make his work public. Currently, an update would only have been released for the Nano S and not for the Blue variant. The Ledger Nano S supports various cryptocurrencies, such as bitcoin and ether, and allows users to manually approve transactions.