alt Hacker NewsCrypto thieves sell hardware wallets with secret eSIM
Comments
The link you want:
https://grandideastudio.com/portfolio/security/ledger-hardwa...
They should have posted the weight with and without the device in it.
Also: never leave empty space in a hardware key, pot the whole thing in epoxy.
Funny enough, EEVBlog posted a teardown video of one of those things today. https://www.youtube.com/watch?v=8JnHdr30v4g
I wonder why they only managed to steal 100M so far. Like with the order of effort needed, why haven't they waited for the really big fish to unlock their ledger?
Not your factory, distributor, warehouses, fulfillment centers and entire supply chain, not your coins.
Reminds me of that time when state actors wanted to spread the Stuxnet worm into an air gapped nucleair facility in Iran, and basically hijacked the whole USB supply chain and put the worm in there.
When enough resources / money is involved, these things are to be expected.
Oh-Kay_Labs have said it for years. Not only hackers and thieves go for them, but also kidnappers and robbers. If anyone knows you have one, and things could be much worse. Use paper-wallets, old phones and encrypted USBs instead.
Here’s a new market for $500 Faraday Cages, if any HN readers are interested in selling that
Makes the claim from BI that Supermicro had malicious hardware implants a little more believable, eh?
Man, I wish there were some pictures. I didn’t even know that there are LTE modems that small.
"Because whoever can read the screen wins." This is a bit surprising from Heise.de?
It's a skimmer?
The technique is so coool. I mean taping the screen output on the way to the display to get around having to hack the secure element. :)
+15 years later and it still doesn't do anything but provide idiots a way to lose their money. It really is impressive.
I already commented the other day on this exploit but really it's fascinating.
I don't care about cryptocurrencies but I've always been fascinated by the cryptography behind it. I've also dabbled with hardware wallets for non-cryptocurrencies stuff: like U2F auth.
The idea of a master secret that is behind a secure element which I control and which I can duplicate is amazing to me (as opposed to, say, "your" passkeys which Google/Microsoft/Apple can basically backup and transfer to other devices for you).
But really to me in the cryptocurrencies world people have been sold the lie that a hardware wallet was secure: it's not. It could be tampered with (as happened in this hack, where an additional rogue chip reading the screen and then sending it using an eSIM steals the secret) but it can also contain a bug (like the recent Coldcard exploit where Coldcard hardware wallets fell back on a RNG with only 32 bits of entropy and some dark-hat hacker cracked those and stole Bitcoins) and, most of all, the vendor of the hardware wallet itself can do nasty attacks (like "kleptography").
From the very start everybody in the ecosystem should have pushed of "n-of-n" schemes (say even just 2-of-2), where one secret goes on a hardware wallet from one vendor and the other secret goes on a hardware wallet from another vendor.
For years and years the tune has been: "PCs cannot be trusted, use a hardware wallet" but it mislead people.
PCs indeed cannot be trusted but unsuspecting users should have learned how to use 2-of-2 or 3-of-3 schemes, to become immune from hacks affecting one hardware wallet vendor.
The typical, non-sensical, response to this is the idiotic: "but if you have two secrets, if you lose one of them you lose everything". It's totally idiotic for people basically save a list of 24 words (the "seed", which is the master secret). Well, guess what: instead of saving a list of 24 words, you save a list of 48 words. Exact same thing, just twice longer.
That's my take: the entire "your coins will be safe if you use a hardware wallet" was misguided.
[dead]
finally, good use for eSIMs /s But damn, it's hard problem to fix. Put it in epoxy and while tampering is harder (not impossible! also can just replace whole module), you can't verify it
If you lie down with dogs, you will get up with fleas.
Dogs = cryptocurrencies. Fleas = scammed.
Garbage website that doesn't allow me to reject tracking cookies without paying.
> Data processing by advertising providers including personalised advertising with profiling
> Consent [required for free use]
Not mentioned in article: MediaMarkt, the German equivalent of Best Buy, was selling these compromised devices on store shelves in every city in Germany.