7 ms·

Case study: fake hardware cryptowallet

206 points by freerk 3y ago

deleted 3y ago
[deleted]
garyfirestorm 3y ago
Would the firmware update fail? if the user had decided to update it? Wouldn't that raise a suspicion?
- WrtCdEvrydy 3y ago
  Probably. It seems it was designed to run with the crypto after one month. Trezor's security on the physical realm is pretty good, but this is just a good attack.
- lxgr 3y ago
  How can a successful firmware update possibly be validated if you can't trust the device in the first place? An attacker can just implement whatever "install firmware version xyz" command by returning "ok, did it!" and remembering that version number if it ever needs to be displayed. A more complex attacker could emulate the entire firmware in more powerful hardware of the same physical profile and selectively intercept any input and output.
dboreham 3y ago
Title seems misleading (and isn't the article title). It implies that Trezor is a fake wallet. The article is actually about a wallet that purports to be made by Trezor but is in fact not (hardware supply chain attack).
- acaloiar 3y ago
  Agreed -- the title should say (Trezor Impostor) to make it clear that Trezor is not the fake.
  - 40four 3y ago
    Or even better, it should just say “Case study: fake hardware cryptowallet”, which is the exact title, and in accordance with the guidelines. No need to append “Kaspersky” On the front, or mention Trezor at all, let the reader click through and form their own opinion.
    - corn13read2 3y ago
      Or... even better! "Case study: fake"
- renonce 3y ago
  It does uncover a vulnerability about Trezor that allows attackers to fake a Trezor without the user knowing it. It should have been defended via attestation, and software downloaded from the official website should have checked the attestation signature so they know the firmware hasn’t been tampered with.
themagician 3y ago
Incredible. This is so sophisticated and takes so much effort it makes you wonder just how many other wallets are compromised from before you even use them. There are so many other low effort attacks you can run that the fact that people are doing THIS really makes me wonder just how many wallets out there are 100% compromised. It would be trivial for any iOS-based software wallet to compromise your seed before your private key before is even created. You don't even need fancy spyware that calls home. If the seed is generated from a method that isn't random you'd never know. It will appear random to you, but the author of the software could simply increment on a known value and be able to recreate every private key ever created with that app. No one would ever know. The attacker could sit silent for years or even decades, and if they DID drain a wallet there would be no way to prove it and no one would believe the victim. It would just be a case of, "Well, you must have leaked your seed, it's your fault." I can even see something like Coinbase Wallet being 100% compromised. The apology post is probably already written in a draft somewhere.
- 1ark 3y ago
  There was a recent drainage of many wallets, even old untouched ones on Ethereum. I don't think it was resolved. Your scenario is likely imo, and the fictional quote was what I saw.
  - latchkey 3y ago
    It isn't resolved, but there is a clue... a lot of the users had keys stored in LastPass.
- yrral 3y ago
  This recently happened to the trust wallet browser extension due to using mersenne twister to generate their private keys. Issue is that this PRNG is not cryptographically secure. I think trust wallet is more popular than coinbase wallet as well. https://community.trustwallet.com/t/wasm-vulnerability-incident-update-and-recommended-actions/750786 https://community.trustwallet.com/t/wasm-vulnerability-incid...
- whimsicalism 3y ago
monero-xmr 3y ago
If you want a hardware wallet, I recommend software in an air-gapped machine. Unless you can buy the hardware directly from the manufacturer, and ideally you walked into the factory and bought it at the source, the risk of compromise is too great.
- flangola7 3y ago
  How do you feel about Yubikeys and HSM systems that corporations heavily rely on?
  - monero-xmr 3y ago
    It’s like apples and bowling balls IMO. If the Yubikey directly stored hundreds of thousands of dollars of bearer assets that could be stolen remotely from an attacker anywhere on earth, then it would be a lot more risky. But that’s not typically what the Yubikey is for, unlike a crypto hardware wallet.
    - lxgr 3y ago
      Installing a general-purpose hardware or software backdoor on OEM hardware enables general-purpose attacks, and in my view isn't necessarily less lucrative than attacking a cryptocurrency wallet's supply chain specifically.
- hn_throwaway_99 3y ago
  I don't understand this. If you ever want to do anything with the funds in that wallet (e.g. sign transactions using the private key), you're going to need to connect it to a machine that can connect to the Internet. Otherwise, how is this any better than a cold storage paper wallet?
  - drexlspivey 3y ago
    You don’t need to connect it to a networked machine to sign a transaction though? You sign the transaction in the airgapped machine, a signed transaction is just a hex string. Move it to the networked machine and broadcast it.
Scoundreller 3y ago
> The housing was difficult to open: its two halves were held together with liberal quantities of glue and double-sided adhesive tape instead of the ultrasonic bonding used on factory-made Trezors. Other than having x-ray vision, one easy (but by no means perfect) verification to thwart these types of attacks is to weigh your devices. Manufacturing should be consistent enough that resealing a device like this would be adding some grams that shouldn’t be there. And unlike something like a cisco router, nothing to cut out to make up for the added weight.
- alden5 3y ago
  the problem is the sorta person to buy a wallet from a classifieds website isn't willing to spend $30 on a scale to weigh it, because if they had that money they'd just buy it from the official store instead
  - Scoundreller 3y ago
    Lifehack: a post office will weigh whatever you want for free. Also many grocery stores have accessible scales. Best part is they pay for the certifications! Then there are friends that ahem buy/sell materials in gram quantities. A counted handful of newish coins are a reasonable way of verifying accuracy in those cases. Be sure to weigh different quantities lest the absolute and relative error cancel out.
    - Alupis 3y ago
      The Post Office's scale likely only has ounce resolution, or at best, 0.01 LBS (0.16oz) resolution. ie, you won't notice a couple grams of glue...
      - ibz 3y ago
        Indeed, you need a drug dealer's scale!
        Scoundreller 3y ago
KryDos 3y ago
Does it mean that at the moment of releasing 2.0.4 the Trezor team already knew there is a fake firmware circling around? I wonder if Trezor team communicated that in some maybe different way than that line in the CHANGELOG. Not blaming them of course, just wondering.
- londons_explore 3y ago
  If I were Trezor and became aware of a fake firmware, I would: * Offer rewards to anyone able to send me the fake devices or clues who is making them. * Tell my clients to upgrade the firmware on devices before use. Make sure every new firmware is distinctive in some way - for example the boot screen, and tell the users to check for that to ensure they are actually running the firmware they thought they just flashed.
  - radicaldreamer 3y ago
    Seems like this could also be an insider threat where someone at Trezor knew all the BOM details and could pull this off
    - wmf 3y ago
      Trezor is mostly open hardware and open source firmware to begin with.
  - StingyJelly 3y ago
    More sophisticated version of the malicious firmware could try to patch the new ota firmware image on the fly. Once compromised - always compromised.
    - londons_explore 3y ago
      It's hard to reliably binary patch something unknown ahead of time. All Trezor would need to do is change the compilation options on a fairly regular basis, and any patching will fail. Combine with the fact there is a reward to send in devices means they can analyze any evil devices and make sure their instructions to users will reliably detect all evil devices they're aware of. Still doesn't stop supply chain attacks, but makes them far harder.
LarsDu88 3y ago
Nice article, but are we sure we want to elevate the status of FSB founded and funded Kapersky labs on the front page of HN?
- PKop 3y ago
  If they're good at what they do, and provide value sharing their knowledge, yes.
gnatman 3y ago
I’m far from an expert and don’t own any cryptocurrency but I can’t imagine buying a hardware wallet from a “popular classifieds website”, i.e. ebay.
- netsharc 3y ago
  Yeah, it's basically a good market for scammers: you're almost guaranteed whoever looking to buy this is is looking to store some large amount of money, so as a scammer your chances of big success is very large.
- tetromino_ 3y ago
  It is possible that the buyer of this wallet had no better option. For example, the official place to buy these devices might refuse to ship them to his country.
barbazoo 3y ago
Somewhat related, I was recently pointed to a cool video about someone hacking a Trezor One. Very enjoyable watch. https://www.youtube.com/watch?v=dT9y-KQbqi4&pp=ygULdHJlem9yIGhhY2s%3D https://www.youtube.com/watch?v=dT9y-KQbqi4&pp=ygULdHJlem9yI... > I was contacted to hack a Trezor One hardware wallet and recover $2 million worth of cryptocurrency (in the form of THETA).
lisper 3y ago
I foresaw this years ago, which prompted me to build this: https://sc4.us/hsm/ https://sc4.us/hsm/ It's an HSM which you can flash yourself. Unfortunately, it never generated much interest and so I had to fold up the tent. But maybe it was just ahead of its time.
- lxgr 3y ago
  Neat! But is the microcontroller used tamper-proof? If not, your customers are still vulnerable to supply chain attacks such as the one in the article.
  - lisper 3y ago
    The core hardware is actually very similar. Both use more or less the same STM32 SoC. The difference is that the Trezor comes pre-flashed in a sealed package designed not to be opened, while the SC4-HSM is designed to be flashed by the user, and the case is not sealed so it can easily be opened to inspect the hardware. So while I can't say it would be impossible, launching a supply chain attack against the SC4-HSM would be a lot harder to execute and conceal.
    - lxgr 3y ago
      Hm, but as a regular user, how would I make sure that what I received in the mail is actually an SC4-HSM and not an identical device that looks the part, but is running some pre-flashed firmware emulating all responses expected by a blank SC4-HSM (i.e. "I'm empty", "writing firmware with hash xyz succeeded" etc.) with high fidelity?
      - lisper 3y ago
        Anything is possible, but this would be extremely difficult. You can't program an off-the-shelf unit to emulate itself. The flashing sequence is a hardware function. There is an actual button that determines whether the system is coming up in flash mode or run mode after a reset. To fake the flashing sequence you would need to have a custom chip, or a custom PCB, or you would need to rewire the stock PCB so that wire went to a different pin. Not impossible, but very hard.
TacticalCoder 3y ago
Another nasty supply chain attack exists, way simpler (unlikely to work on knowledgeable users though)... A legit hardware wallet is shipped, but with fake documentation accompanying it. Some evil people working for delivery companies would swap legit hardware wallet for the exact same model, but with documentation using the official company's logo and font and saying, basically: "Here's your hardware wallet, initialize it with the seed written on this piece of paper, it's the only one that's going to work for this hardware wallet. Do not lose this seed or you'll lose access to your funds!". Several unsuspecting users, not aware that a random seed is supposed to be generated by the hardware wallet (or by throwing dice, or whatever) have been pwned this way.
- Gigachad 3y ago
  There have also been cases of software using malicious seed generators which have semi predictable outputs. People assume it’s safe because they see what looks like random seeds, combined with no network activity. But the attacker can then just scan over the whole possible key space and check for funds.
  - sneak 3y ago
    A classic from 2008. Probably not malicious, but no way to prove a negative. https://en.m.wikinews.org/wiki/Predictable_random_number_generator_discovered_in_the_Debian_version_of_OpenSSL https://en.m.wikinews.org/wiki/Predictable_random_number_gen...
    - alwayslikethis 3y ago
      For a better known, actually malicious one: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
  - lxgr 3y ago
    Even more concerning than predictable wallet seeds are covert channels in the form of nondeterministic signature outputs. Most wallets let you provide your own seed words, which users can derive using diceware themselves, but DSA (and its elliptic-curve variants) need a secure random input, and I'm not sure if all wallets commonly use a deterministic (i.e. provably free of covert channels) construction (like in RFC 6979) for that.
munificent 3y ago
> The bootloader checks the digital signature of the firmware and, if an anomaly is detected, displays an unoriginal firmware message and deletes all the data in the wallet. This seems like a horrendous design, like a safe that burns the money inside if you try to tamper with it. Sure, it might protect a malicious thief from absconding with the funds, but it is also an attack vector for any bad actor that simply wishes to cause you harm.
- derefr 3y ago
  If the attacker's goal was to erase the user's data, and the firmware _didn't_ erase data on invalidation, then the attacker could simply write a firmware that erases the user's data.
  - Forbo 3y ago
    Why complicate things? Just smash the device. This is only effective if the user doesn't have their seed phrase. Edit: Looks like I was beaten to this down thread.
    - derefr 3y ago
      I think in this case the idea is that the attacker isn't physically in possession of the device, but rather has tricked the user into running a malicious firmware updater for the device.
      - Forbo 3y ago
        Ah, yeah,that makes sense. Hadn't considered that angle. Would track with the user behavior exposed here, namely getting their stuff from an unofficial source (be it the device itself or the firmware).
- phire 3y ago
  The user is meant to keep a backup copy of the seed written down somewhere safe. If the firmware had been tampered with, there is no safe way to extract the key. Better that the user uses the recovery seed on a fresh device. Which means the weakest link of your fancy hardware wallet is how well you hide that bit of paper with your seed phrase.
BobTheDestroyer 3y ago
Trezor has additional checks that aren't covered here. I'd really like to know how those were defeated. Especially: > All Trezor devices are distributed without firmware installed - you will need to install it during setup. This setup process will check if firmware is already installed on the device. If firmware is detected then the device should not be used. >The bootloader verifies the firmware signature each time you connect your Trezor to a computer. Trezor Suite will only accept the device if the installed firmware is correctly signed by SatoshiLabs. If unofficial firmware has been installed, your device will flash a warning sign on its screen upon being connected to a computer. https://trezor.io/learn/a/authenticate-model-one https://trezor.io/learn/a/authenticate-model-one There seems to be an element of user carelessness and naivety here. Anyone who follows Trevor's hardware verification checks surely needn't worry about these attacks.
- LordShredda 3y ago
  How does the setup process check for firmware, anyways? If there's a malicious firmware preinstalled I'm guessing it could just lie to the host computer and pretend to be not there until setup is complete. Once an attacker has hardware control, no software can save you.
- lxgr 3y ago
  > All Trezor devices are distributed without firmware installed - you will need to install it during setup. This setup process will check if firmware is already installed on the device. If firmware is detected then the device should not be used. [...] The bootloader verifies the firmware signature each time you connect your Trezor to a computer. Trezor Suite will only accept the device if the installed firmware is correctly signed by SatoshiLabs. This is an absurd security model. Where's the root of trust here? How do I know I am initially talking to an authentic "blank" device, and not a malicious one pretending to be one? > If unofficial firmware has been installed, your device will flash a warning sign on its screen upon being connected to a computer. Hopefully, malicious firmware won't meddle with this feature in any way... The vendor here is either completely clueless, or is trying to paint a better picture for prospective customers despite knowing better.
lxgr 3y ago
For physically hardened devices, this attack vector can be mitigated quite efficiently by including an attestation key with each device and validating that after taking possession (or ideally before any interaction). At least one competitor does that. To my knowledge, current Trezor devices are unfortunately not (sufficiently) key extraction proof, though; in that scenario, attackers might be able to extract the private attestation key of a legitimate device and then go on to impersonate it in their own version. This again could be mitigated by e.g. making the attestation key device-unique and offering an online validation service (which could keep track of unusual verification patterns and alert users), but it's not an easy problem to solve.
- quickthrower2 3y ago
  How secure is the attestation key against the wallet CEO's kids being held hostage?
  - rippercushions 3y ago
    Obligatory $5 wrench xkcd: https://xkcd.com/538/ https://xkcd.com/538/ Still, physically threatening/kidnapping somebody is an entirely different threat model, although it's very common in the Bitcoin world: https://github.com/jlopp/physical-bitcoin-attacks https://github.com/jlopp/physical-bitcoin-attacks
    - CTDOCodebases 3y ago
      This is not specific to Bitcoin though. In Latin America there are “Flash/lightening kidnappings” where they take a person hostage and drain their bank account over a period of time.
      - quickthrower2 3y ago
        They can’t take a bank hostage and drain all of it’s customers funds though.
dools 3y ago
> The main safeguard is to buy your wallet directly from the official vendor and choose models with special versions of protected microcontrollers (even original Trezors aren’t ideal in this sense: there are other brands’ wallets with better protected chips and extra protection mechanisms). Yet another hilarious example of where a the solution to security in an alledgedly trustless system designed to subvert authority comes down to ... trust and authority.
- lxgr 3y ago
  You have to trust somebody when it comes to hardware devices. If you don't do anything, that includes the OEM, their supply chain, your delivery courier, an evil maid etc. If you have the choice of reducing that list to only the OEM, isn't that a win? That's what attestation does.
  - dools 3y ago
    > You have to trust somebody I know, all the time, and thus the entire premise of crypto is flawed, as are the libertarian ideals that birthed it.
    - PretzelPirate 3y ago
      > trustless system Crypto let's you choose who to trust. You can build your own wallet, you can buy one, or you can choose to let someone hold your assets for you. Many people will choose to trust large centralized parties, and some will choose to generate their own keys offline with code they've verified. Do they have to trust that any cryptographic libraries they use generate seeds properly? Yes, but there are plenty to choose from that are well known, well tested, and the developers are funded. It's not as simple as saying "the entire premise of crypto currency is flawed because you have to have some trust." The people that much of the crypto community don't trust are large bankers and governments.
      - lottin 3y ago
        Nobody can build their own wallet directly from raw materials. Even in the very unlikely event that they had the know-how, they would still require highly specialised equipment manufactured by third parties. Therefore users of "crypto" have no option but to rely on goods and services provided by third parties just like everybody else. And the extent to which consumers can choose which parties to rely on (or "trust") depends entirely on the degree of competition in the market. Crypto isn't special with regards to trust. Calling it "trustless" is false advertising.
dyeje 3y ago
It seems kinda foolish to buy a second hand crypto wallet.
mrb 3y ago
I would be immune to this attack because I always generate my own seeds, on a trusted computer. So I set up hardware wallets to import my seed, instead of trusting their seed generation algo. Of course this procedure doesn't protect against other hardware attacks, for example the wallet exfiltrating the private key somehow (R/F signal), but it certainly raises the bar for hackers.
- drdrey 3y ago
  you still trust that the hardware will use the seed you provided and not one of the pre-generated ones
  - PretzelPirate 3y ago
    You don't have to trust that at all. You can verify that the wallet signs a message with the correct private key that was generated offline. When you send funds to the wallet, you don't need to send them to the address that the wallet presents, you can send them to the address you calculated during offline key generation. As long as you use the Trezor derivation path on your offline machine, it's predictable what the first address will be.
  - mrb 3y ago
    No because I feed my wallet public key (xpub) to scripts that derives the wallet addresses, and I verify that the derived addresses match what my wallet generates. I'm paranoid like this :) Granted that would be really inconvenient to do if one used the wallet on a daily basis. In my case I use it rarely enough (large transactions only) that it doesn't bother me that much.
- tromp 3y ago
  What software do you use to generate your 256-bit seed, and to convert that into the 24 words that the hardware keys require as input?
  - mrb 3y ago
    A custom script that essentially reads /dev/urandom and feeds the hex seed to bip39tool from pybitcointools.
roland35 3y ago
This just is another example to me how absurd it is to use crypto as a practical currency. There is no recourse for compromising your private key, and no way to know for sure that only you have a private key.
RadixDLT 3y ago
does Kaspersky still work for the Russian government?
lisbon44 3y ago
> Intentionally skipped this version due to fake devices uh oh! does this imply something is up that the trezor developers know of?
- lalopalota 3y ago
  Yes, this implies that trezor developers know of fake devices claiming to run that version so they skipped that version number to ensure that no one who sees that version number would confuse it with an actual version.
  - lxgr 3y ago
    What does that achieve? Surely the fraudsters wouldn't dare to use one of the "actually secure" version numbers in their attempts to deceive Trezor users...?
somat 3y ago
"choose models with special versions of protected microcontrollers" I don't see how this is helpful advice. The whole point of the article was how the look and feel of a legitimate hardware wallet was cloned. Under these circumstances there is no way to tell what is in the device(clear housing perhaps?). all it has to do is act like the real device. It does not matter how good your security chip actually is if all I have to do is copy the correct interface. Unrelated: the use of that particular version is a strangely shoddy mistake. It should have been very easy to use a version string that exists. In which case that version would never have been skipped??? perhaps at one point that was a real version and trezor pulled it due to it's use in a batch of clone units.
- lxgr 3y ago
  > It does not matter how good your security chip actually is if all I have to do is copy the correct interface. A security chip actually deserving the name (i.e. a tamper-proof one) can protect a private key even against physical attacks, with the corresponding public key marked as authentic by the manufacturer. If the interface contains a challenge-response interaction with that private key (and ideally ties that to any further communication with the trusted applications on it), you can't copy/emulate that.
- magnat 3y ago
  > the use of that particular version is a strangely shoddy mistake. It should have been very easy to use a version string that exists Perhaps attackers wanted to discourage user from trying to upgrade firmware/bootloader before first use by using version one step higher than officially released. If they used older version number, savvy user might try to flash newest firmware and discover something isn't quite right. Using nonexistent, but plausible looking version number, can also be used to explain minor discrepancies in behavior between fake and original unit, if some are introduced by mistake.
stevage 3y ago
Would someone be able to spell out how this attack works after initialisation? I don't really understand hardware wallets. How does the information about the user and their key make its way back to the people who created the device?
- valleyer 3y ago
  The attackers know the key to begin with, before the user even gets their hands on the device. The compromised device pretends to generate a random key but instead generate one of twenty keys provided by the attackers.
- lxgr 3y ago
  Other than generating a small set of known seeds, some signature formats (including ECDSA, which is used for many cryptocurrencies) also allow exfiltrating data through some of the values they consist of and which are required to validate them. If the wallet uses deterministic ECDSA, or the algorithm used is deterministic by definition (such as EdDSA), this can be detected, but doing so requires validating some generated signatures on a second, trusted device.
drexlspivey 3y ago
What would have prevented this attack is the following: Use a little bit of python (there are libraries for this or you can do it yourself) to make sure that the addresses generated in the HW wallet by the 12 word mnemonic are indeed the correct addresses. For example the first segwit address using your private key and the derivation path 49h/0h/0h/0/0 should be deterministic. This way you know your 12 words are the ones used and the wallet is using known standards and not some homebrew crypto. In fact you should always do that anyway in case the HW stops working and/or the company goes under. This way you can be sure that you can recreate your private keys from your mnemonic and access your funds no matter what.
- friend_and_foe 3y ago
  That would not have stopped this attack. I think youre misunderstanding the attack, the seed is pregenerated. The only thing that would have stopped this attack would be to generate your seed off the device. And then, since the device is counterfeit and there may very well be a way to exfiltrate seeds from it, to use a genuine device, but that's a different attack. What youre saying though is a good idea, provided the device youre running this on (and therefore entering your seed into) is secure. Since this cannot really be guaranteed it is often advised to never enter your seed into a computer, for good reason.
  - drexlspivey 3y ago
    > That would not have stopped this attack. I think youre misunderstanding the attack, the seed is pregenerated. HW support entering any mnemonic, you don’t have to generate it on the device itself. So if you create a mnemonic yourself and check what addresses it should generate with a third party tool and then enter it in the wallet and see different addresses something is fishy.
kosherhurricane 3y ago
My #1 argument against the feasibility of cryptocurrency: Can my parents not their get money stolen?
- PretzelPirate 3y ago
  Can crypto currency be used easily? Yes, through centralized entities like where your parents currently store their money. Some people may forgoe ease and aim for self-custody because they value decentralization over convenience. Others will choose a middle ground where they and a centralized entity both hold part of the key, ensuring that the 3rd party can't move their funds without permission.
  - deleted 3y ago
    [deleted]
- RalfWausE 3y ago
  This is an argument against any form of direct payment... i mean, you can get your cash stolen very easily...
  - Philadelphia 3y ago
    Yes. And so cryptocurrency is a reversion to a model of payment that’s been rejected by most people for its poor security.
    - friend_and_foe 3y ago
      Cash has been rejected by most people due to its poor security? I have to ask for a source on that. Cash is still the most popular form of money, and if you have low trust in your government or institutions/live in a corrupt society, is more secure than other options.
hgsgm 3y ago
With crypto, you get to cut out the middle man and be your own bank. You have fraud team and IT security team on your staff, right?
paulpauper 3y ago
Easy to steal and cash out, сryptocurrency is one of the most attractive digital assets for attackers. Has the author tried cashing out crypto? KYC anyone? It's harder than ever to cash out ,especially large sums. So many restrictions due to fraud. Hardware wallets are never safe. the only safe way is to generate your own entropy, key derivation. Why would you ever trust a 3rd party to generate your keys?
MagicMoonlight 3y ago
And how is this better than just using regular money?
hamzataha 3y ago
Casa
magnat 3y ago
What if each genuine unit would have entire PCB covered in glitter nail polish at factory? Based on a serial number of your device, you could check if a pattern on your device matches the one taken by manufacturer right after assembling the device.

206 points by freerk 3y ago

deleted 3y ago

[deleted]

garyfirestorm 3y ago

Would the firmware update fail? if the user had decided to update it? Wouldn't that raise a suspicion?

WrtCdEvrydy 3y ago
Probably. It seems it was designed to run with the crypto after one month. Trezor's security on the physical realm is pretty good, but this is just a good attack.
lxgr 3y ago
How can a successful firmware update possibly be validated if you can't trust the device in the first place? An attacker can just implement whatever "install firmware version xyz" command by returning "ok, did it!" and remembering that version number if it ever needs to be displayed. A more complex attacker could emulate the entire firmware in more powerful hardware of the same physical profile and selectively intercept any input and output.

dboreham 3y ago

Title seems misleading (and isn't the article title). It implies that Trezor is a fake wallet. The article is actually about a wallet that purports to be made by Trezor but is in fact not (hardware supply chain attack).

acaloiar 3y ago
Agreed -- the title should say (Trezor Impostor) to make it clear that Trezor is not the fake.
- 40four 3y ago
  Or even better, it should just say “Case study: fake hardware cryptowallet”, which is the exact title, and in accordance with the guidelines. No need to append “Kaspersky” On the front, or mention Trezor at all, let the reader click through and form their own opinion.
  - corn13read2 3y ago
    Or... even better! "Case study: fake"
renonce 3y ago
It does uncover a vulnerability about Trezor that allows attackers to fake a Trezor without the user knowing it. It should have been defended via attestation, and software downloaded from the official website should have checked the attestation signature so they know the firmware hasn’t been tampered with.

themagician 3y ago

Incredible. This is so sophisticated and takes so much effort it makes you wonder just how many other wallets are compromised from before you even use them. There are so many other low effort attacks you can run that the fact that people are doing THIS really makes me wonder just how many wallets out there are 100% compromised. It would be trivial for any iOS-based software wallet to compromise your seed before your private key before is even created. You don't even need fancy spyware that calls home. If the seed is generated from a method that isn't random you'd never know. It will appear random to you, but the author of the software could simply increment on a known value and be able to recreate every private key ever created with that app. No one would ever know. The attacker could sit silent for years or even decades, and if they DID drain a wallet there would be no way to prove it and no one would believe the victim. It would just be a case of, "Well, you must have leaked your seed, it's your fault." I can even see something like Coinbase Wallet being 100% compromised. The apology post is probably already written in a draft somewhere.

1ark 3y ago
There was a recent drainage of many wallets, even old untouched ones on Ethereum. I don't think it was resolved. Your scenario is likely imo, and the fictional quote was what I saw.
- latchkey 3y ago
  It isn't resolved, but there is a clue... a lot of the users had keys stored in LastPass.
yrral 3y ago
This recently happened to the trust wallet browser extension due to using mersenne twister to generate their private keys. Issue is that this PRNG is not cryptographically secure. I think trust wallet is more popular than coinbase wallet as well. https://community.trustwallet.com/t/wasm-vulnerability-incident-update-and-recommended-actions/750786 https://community.trustwallet.com/t/wasm-vulnerability-incid...
whimsicalism 3y ago

monero-xmr 3y ago

If you want a hardware wallet, I recommend software in an air-gapped machine. Unless you can buy the hardware directly from the manufacturer, and ideally you walked into the factory and bought it at the source, the risk of compromise is too great.

flangola7 3y ago
How do you feel about Yubikeys and HSM systems that corporations heavily rely on?
- monero-xmr 3y ago
  It’s like apples and bowling balls IMO. If the Yubikey directly stored hundreds of thousands of dollars of bearer assets that could be stolen remotely from an attacker anywhere on earth, then it would be a lot more risky. But that’s not typically what the Yubikey is for, unlike a crypto hardware wallet.
  - lxgr 3y ago
    Installing a general-purpose hardware or software backdoor on OEM hardware enables general-purpose attacks, and in my view isn't necessarily less lucrative than attacking a cryptocurrency wallet's supply chain specifically.
hn_throwaway_99 3y ago
I don't understand this. If you ever want to do anything with the funds in that wallet (e.g. sign transactions using the private key), you're going to need to connect it to a machine that can connect to the Internet. Otherwise, how is this any better than a cold storage paper wallet?
- drexlspivey 3y ago
  You don’t need to connect it to a networked machine to sign a transaction though? You sign the transaction in the airgapped machine, a signed transaction is just a hex string. Move it to the networked machine and broadcast it.

Scoundreller 3y ago

> The housing was difficult to open: its two halves were held together with liberal quantities of glue and double-sided adhesive tape instead of the ultrasonic bonding used on factory-made Trezors. Other than having x-ray vision, one easy (but by no means perfect) verification to thwart these types of attacks is to weigh your devices. Manufacturing should be consistent enough that resealing a device like this would be adding some grams that shouldn’t be there. And unlike something like a cisco router, nothing to cut out to make up for the added weight.

alden5 3y ago
the problem is the sorta person to buy a wallet from a classifieds website isn't willing to spend $30 on a scale to weigh it, because if they had that money they'd just buy it from the official store instead
- Scoundreller 3y ago
  Lifehack: a post office will weigh whatever you want for free. Also many grocery stores have accessible scales. Best part is they pay for the certifications! Then there are friends that ahem buy/sell materials in gram quantities. A counted handful of newish coins are a reasonable way of verifying accuracy in those cases. Be sure to weigh different quantities lest the absolute and relative error cancel out.
  - Alupis 3y ago
    The Post Office's scale likely only has ounce resolution, or at best, 0.01 LBS (0.16oz) resolution. ie, you won't notice a couple grams of glue...
    - ibz 3y ago
      Indeed, you need a drug dealer's scale!
      - Scoundreller 3y ago

KryDos 3y ago

Does it mean that at the moment of releasing 2.0.4 the Trezor team already knew there is a fake firmware circling around? I wonder if Trezor team communicated that in some maybe different way than that line in the CHANGELOG. Not blaming them of course, just wondering.

londons_explore 3y ago
If I were Trezor and became aware of a fake firmware, I would: * Offer rewards to anyone able to send me the fake devices or clues who is making them. * Tell my clients to upgrade the firmware on devices before use. Make sure every new firmware is distinctive in some way - for example the boot screen, and tell the users to check for that to ensure they are actually running the firmware they thought they just flashed.
- radicaldreamer 3y ago
  Seems like this could also be an insider threat where someone at Trezor knew all the BOM details and could pull this off
  - wmf 3y ago
    Trezor is mostly open hardware and open source firmware to begin with.
- StingyJelly 3y ago
  More sophisticated version of the malicious firmware could try to patch the new ota firmware image on the fly. Once compromised - always compromised.
  - londons_explore 3y ago
    It's hard to reliably binary patch something unknown ahead of time. All Trezor would need to do is change the compilation options on a fairly regular basis, and any patching will fail. Combine with the fact there is a reward to send in devices means they can analyze any evil devices and make sure their instructions to users will reliably detect all evil devices they're aware of. Still doesn't stop supply chain attacks, but makes them far harder.

LarsDu88 3y ago

Nice article, but are we sure we want to elevate the status of FSB founded and funded Kapersky labs on the front page of HN?

PKop 3y ago
If they're good at what they do, and provide value sharing their knowledge, yes.

gnatman 3y ago

I’m far from an expert and don’t own any cryptocurrency but I can’t imagine buying a hardware wallet from a “popular classifieds website”, i.e. ebay.

netsharc 3y ago
Yeah, it's basically a good market for scammers: you're almost guaranteed whoever looking to buy this is is looking to store some large amount of money, so as a scammer your chances of big success is very large.
tetromino_ 3y ago
It is possible that the buyer of this wallet had no better option. For example, the official place to buy these devices might refuse to ship them to his country.

barbazoo 3y ago

Somewhat related, I was recently pointed to a cool video about someone hacking a Trezor One. Very enjoyable watch. https://www.youtube.com/watch?v=dT9y-KQbqi4&pp=ygULdHJlem9yIGhhY2s%3D https://www.youtube.com/watch?v=dT9y-KQbqi4&pp=ygULdHJlem9yI... > I was contacted to hack a Trezor One hardware wallet and recover $2 million worth of cryptocurrency (in the form of THETA).

lisper 3y ago

I foresaw this years ago, which prompted me to build this: https://sc4.us/hsm/ https://sc4.us/hsm/ It's an HSM which you can flash yourself. Unfortunately, it never generated much interest and so I had to fold up the tent. But maybe it was just ahead of its time.

lxgr 3y ago
Neat! But is the microcontroller used tamper-proof? If not, your customers are still vulnerable to supply chain attacks such as the one in the article.
- lisper 3y ago
  The core hardware is actually very similar. Both use more or less the same STM32 SoC. The difference is that the Trezor comes pre-flashed in a sealed package designed not to be opened, while the SC4-HSM is designed to be flashed by the user, and the case is not sealed so it can easily be opened to inspect the hardware. So while I can't say it would be impossible, launching a supply chain attack against the SC4-HSM would be a lot harder to execute and conceal.
  - lxgr 3y ago
    Hm, but as a regular user, how would I make sure that what I received in the mail is actually an SC4-HSM and not an identical device that looks the part, but is running some pre-flashed firmware emulating all responses expected by a blank SC4-HSM (i.e. "I'm empty", "writing firmware with hash xyz succeeded" etc.) with high fidelity?
    - lisper 3y ago
      Anything is possible, but this would be extremely difficult. You can't program an off-the-shelf unit to emulate itself. The flashing sequence is a hardware function. There is an actual button that determines whether the system is coming up in flash mode or run mode after a reset. To fake the flashing sequence you would need to have a custom chip, or a custom PCB, or you would need to rewire the stock PCB so that wire went to a different pin. Not impossible, but very hard.

TacticalCoder 3y ago

Another nasty supply chain attack exists, way simpler (unlikely to work on knowledgeable users though)... A legit hardware wallet is shipped, but with fake documentation accompanying it. Some evil people working for delivery companies would swap legit hardware wallet for the exact same model, but with documentation using the official company's logo and font and saying, basically: "Here's your hardware wallet, initialize it with the seed written on this piece of paper, it's the only one that's going to work for this hardware wallet. Do not lose this seed or you'll lose access to your funds!". Several unsuspecting users, not aware that a random seed is supposed to be generated by the hardware wallet (or by throwing dice, or whatever) have been pwned this way.

Gigachad 3y ago
There have also been cases of software using malicious seed generators which have semi predictable outputs. People assume it’s safe because they see what looks like random seeds, combined with no network activity. But the attacker can then just scan over the whole possible key space and check for funds.
- sneak 3y ago
  A classic from 2008. Probably not malicious, but no way to prove a negative. https://en.m.wikinews.org/wiki/Predictable_random_number_generator_discovered_in_the_Debian_version_of_OpenSSL https://en.m.wikinews.org/wiki/Predictable_random_number_gen...
  - alwayslikethis 3y ago
    For a better known, actually malicious one: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- lxgr 3y ago
  Even more concerning than predictable wallet seeds are covert channels in the form of nondeterministic signature outputs. Most wallets let you provide your own seed words, which users can derive using diceware themselves, but DSA (and its elliptic-curve variants) need a secure random input, and I'm not sure if all wallets commonly use a deterministic (i.e. provably free of covert channels) construction (like in RFC 6979) for that.

munificent 3y ago

> The bootloader checks the digital signature of the firmware and, if an anomaly is detected, displays an unoriginal firmware message and deletes all the data in the wallet. This seems like a horrendous design, like a safe that burns the money inside if you try to tamper with it. Sure, it might protect a malicious thief from absconding with the funds, but it is also an attack vector for any bad actor that simply wishes to cause you harm.

derefr 3y ago
If the attacker's goal was to erase the user's data, and the firmware _didn't_ erase data on invalidation, then the attacker could simply write a firmware that erases the user's data.
- Forbo 3y ago
  Why complicate things? Just smash the device. This is only effective if the user doesn't have their seed phrase. Edit: Looks like I was beaten to this down thread.
  - derefr 3y ago
    I think in this case the idea is that the attacker isn't physically in possession of the device, but rather has tricked the user into running a malicious firmware updater for the device.
    - Forbo 3y ago
      Ah, yeah,that makes sense. Hadn't considered that angle. Would track with the user behavior exposed here, namely getting their stuff from an unofficial source (be it the device itself or the firmware).
phire 3y ago
The user is meant to keep a backup copy of the seed written down somewhere safe. If the firmware had been tampered with, there is no safe way to extract the key. Better that the user uses the recovery seed on a fresh device. Which means the weakest link of your fancy hardware wallet is how well you hide that bit of paper with your seed phrase.

BobTheDestroyer 3y ago

Trezor has additional checks that aren't covered here. I'd really like to know how those were defeated. Especially: > All Trezor devices are distributed without firmware installed - you will need to install it during setup. This setup process will check if firmware is already installed on the device. If firmware is detected then the device should not be used. >The bootloader verifies the firmware signature each time you connect your Trezor to a computer. Trezor Suite will only accept the device if the installed firmware is correctly signed by SatoshiLabs. If unofficial firmware has been installed, your device will flash a warning sign on its screen upon being connected to a computer. https://trezor.io/learn/a/authenticate-model-one https://trezor.io/learn/a/authenticate-model-one There seems to be an element of user carelessness and naivety here. Anyone who follows Trevor's hardware verification checks surely needn't worry about these attacks.

LordShredda 3y ago
How does the setup process check for firmware, anyways? If there's a malicious firmware preinstalled I'm guessing it could just lie to the host computer and pretend to be not there until setup is complete. Once an attacker has hardware control, no software can save you.
lxgr 3y ago
> All Trezor devices are distributed without firmware installed - you will need to install it during setup. This setup process will check if firmware is already installed on the device. If firmware is detected then the device should not be used. [...] The bootloader verifies the firmware signature each time you connect your Trezor to a computer. Trezor Suite will only accept the device if the installed firmware is correctly signed by SatoshiLabs. This is an absurd security model. Where's the root of trust here? How do I know I am initially talking to an authentic "blank" device, and not a malicious one pretending to be one? > If unofficial firmware has been installed, your device will flash a warning sign on its screen upon being connected to a computer. Hopefully, malicious firmware won't meddle with this feature in any way... The vendor here is either completely clueless, or is trying to paint a better picture for prospective customers despite knowing better.

lxgr 3y ago

For physically hardened devices, this attack vector can be mitigated quite efficiently by including an attestation key with each device and validating that after taking possession (or ideally before any interaction). At least one competitor does that. To my knowledge, current Trezor devices are unfortunately not (sufficiently) key extraction proof, though; in that scenario, attackers might be able to extract the private attestation key of a legitimate device and then go on to impersonate it in their own version. This again could be mitigated by e.g. making the attestation key device-unique and offering an online validation service (which could keep track of unusual verification patterns and alert users), but it's not an easy problem to solve.

quickthrower2 3y ago
How secure is the attestation key against the wallet CEO's kids being held hostage?
- rippercushions 3y ago
  Obligatory $5 wrench xkcd: https://xkcd.com/538/ https://xkcd.com/538/ Still, physically threatening/kidnapping somebody is an entirely different threat model, although it's very common in the Bitcoin world: https://github.com/jlopp/physical-bitcoin-attacks https://github.com/jlopp/physical-bitcoin-attacks
  - CTDOCodebases 3y ago
    This is not specific to Bitcoin though. In Latin America there are “Flash/lightening kidnappings” where they take a person hostage and drain their bank account over a period of time.
    - quickthrower2 3y ago
      They can’t take a bank hostage and drain all of it’s customers funds though.

dools 3y ago

> The main safeguard is to buy your wallet directly from the official vendor and choose models with special versions of protected microcontrollers (even original Trezors aren’t ideal in this sense: there are other brands’ wallets with better protected chips and extra protection mechanisms). Yet another hilarious example of where a the solution to security in an alledgedly trustless system designed to subvert authority comes down to ... trust and authority.

lxgr 3y ago
You have to trust somebody when it comes to hardware devices. If you don't do anything, that includes the OEM, their supply chain, your delivery courier, an evil maid etc. If you have the choice of reducing that list to only the OEM, isn't that a win? That's what attestation does.
- dools 3y ago
  > You have to trust somebody I know, all the time, and thus the entire premise of crypto is flawed, as are the libertarian ideals that birthed it.
  - PretzelPirate 3y ago
    > trustless system Crypto let's you choose who to trust. You can build your own wallet, you can buy one, or you can choose to let someone hold your assets for you. Many people will choose to trust large centralized parties, and some will choose to generate their own keys offline with code they've verified. Do they have to trust that any cryptographic libraries they use generate seeds properly? Yes, but there are plenty to choose from that are well known, well tested, and the developers are funded. It's not as simple as saying "the entire premise of crypto currency is flawed because you have to have some trust." The people that much of the crypto community don't trust are large bankers and governments.
    - lottin 3y ago
      Nobody can build their own wallet directly from raw materials. Even in the very unlikely event that they had the know-how, they would still require highly specialised equipment manufactured by third parties. Therefore users of "crypto" have no option but to rely on goods and services provided by third parties just like everybody else. And the extent to which consumers can choose which parties to rely on (or "trust") depends entirely on the degree of competition in the market. Crypto isn't special with regards to trust. Calling it "trustless" is false advertising.

dyeje 3y ago

It seems kinda foolish to buy a second hand crypto wallet.

mrb 3y ago

I would be immune to this attack because I always generate my own seeds, on a trusted computer. So I set up hardware wallets to import my seed, instead of trusting their seed generation algo. Of course this procedure doesn't protect against other hardware attacks, for example the wallet exfiltrating the private key somehow (R/F signal), but it certainly raises the bar for hackers.

drdrey 3y ago
you still trust that the hardware will use the seed you provided and not one of the pre-generated ones
- PretzelPirate 3y ago
  You don't have to trust that at all. You can verify that the wallet signs a message with the correct private key that was generated offline. When you send funds to the wallet, you don't need to send them to the address that the wallet presents, you can send them to the address you calculated during offline key generation. As long as you use the Trezor derivation path on your offline machine, it's predictable what the first address will be.
- mrb 3y ago
  No because I feed my wallet public key (xpub) to scripts that derives the wallet addresses, and I verify that the derived addresses match what my wallet generates. I'm paranoid like this :) Granted that would be really inconvenient to do if one used the wallet on a daily basis. In my case I use it rarely enough (large transactions only) that it doesn't bother me that much.
tromp 3y ago
What software do you use to generate your 256-bit seed, and to convert that into the 24 words that the hardware keys require as input?
- mrb 3y ago
  A custom script that essentially reads /dev/urandom and feeds the hex seed to bip39tool from pybitcointools.

roland35 3y ago

This just is another example to me how absurd it is to use crypto as a practical currency. There is no recourse for compromising your private key, and no way to know for sure that only you have a private key.

RadixDLT 3y ago

does Kaspersky still work for the Russian government?

lisbon44 3y ago

> Intentionally skipped this version due to fake devices uh oh! does this imply something is up that the trezor developers know of?

lalopalota 3y ago
Yes, this implies that trezor developers know of fake devices claiming to run that version so they skipped that version number to ensure that no one who sees that version number would confuse it with an actual version.
- lxgr 3y ago
  What does that achieve? Surely the fraudsters wouldn't dare to use one of the "actually secure" version numbers in their attempts to deceive Trezor users...?

somat 3y ago

"choose models with special versions of protected microcontrollers" I don't see how this is helpful advice. The whole point of the article was how the look and feel of a legitimate hardware wallet was cloned. Under these circumstances there is no way to tell what is in the device(clear housing perhaps?). all it has to do is act like the real device. It does not matter how good your security chip actually is if all I have to do is copy the correct interface. Unrelated: the use of that particular version is a strangely shoddy mistake. It should have been very easy to use a version string that exists. In which case that version would never have been skipped??? perhaps at one point that was a real version and trezor pulled it due to it's use in a batch of clone units.

lxgr 3y ago
> It does not matter how good your security chip actually is if all I have to do is copy the correct interface. A security chip actually deserving the name (i.e. a tamper-proof one) can protect a private key even against physical attacks, with the corresponding public key marked as authentic by the manufacturer. If the interface contains a challenge-response interaction with that private key (and ideally ties that to any further communication with the trusted applications on it), you can't copy/emulate that.
magnat 3y ago
> the use of that particular version is a strangely shoddy mistake. It should have been very easy to use a version string that exists Perhaps attackers wanted to discourage user from trying to upgrade firmware/bootloader before first use by using version one step higher than officially released. If they used older version number, savvy user might try to flash newest firmware and discover something isn't quite right. Using nonexistent, but plausible looking version number, can also be used to explain minor discrepancies in behavior between fake and original unit, if some are introduced by mistake.

stevage 3y ago

Would someone be able to spell out how this attack works after initialisation? I don't really understand hardware wallets. How does the information about the user and their key make its way back to the people who created the device?

valleyer 3y ago
The attackers know the key to begin with, before the user even gets their hands on the device. The compromised device pretends to generate a random key but instead generate one of twenty keys provided by the attackers.
lxgr 3y ago
Other than generating a small set of known seeds, some signature formats (including ECDSA, which is used for many cryptocurrencies) also allow exfiltrating data through some of the values they consist of and which are required to validate them. If the wallet uses deterministic ECDSA, or the algorithm used is deterministic by definition (such as EdDSA), this can be detected, but doing so requires validating some generated signatures on a second, trusted device.

drexlspivey 3y ago

What would have prevented this attack is the following: Use a little bit of python (there are libraries for this or you can do it yourself) to make sure that the addresses generated in the HW wallet by the 12 word mnemonic are indeed the correct addresses. For example the first segwit address using your private key and the derivation path 49h/0h/0h/0/0 should be deterministic. This way you know your 12 words are the ones used and the wallet is using known standards and not some homebrew crypto. In fact you should always do that anyway in case the HW stops working and/or the company goes under. This way you can be sure that you can recreate your private keys from your mnemonic and access your funds no matter what.

friend_and_foe 3y ago
That would not have stopped this attack. I think youre misunderstanding the attack, the seed is pregenerated. The only thing that would have stopped this attack would be to generate your seed off the device. And then, since the device is counterfeit and there may very well be a way to exfiltrate seeds from it, to use a genuine device, but that's a different attack. What youre saying though is a good idea, provided the device youre running this on (and therefore entering your seed into) is secure. Since this cannot really be guaranteed it is often advised to never enter your seed into a computer, for good reason.
- drexlspivey 3y ago
  > That would not have stopped this attack. I think youre misunderstanding the attack, the seed is pregenerated. HW support entering any mnemonic, you don’t have to generate it on the device itself. So if you create a mnemonic yourself and check what addresses it should generate with a third party tool and then enter it in the wallet and see different addresses something is fishy.

kosherhurricane 3y ago

My #1 argument against the feasibility of cryptocurrency: Can my parents not their get money stolen?

PretzelPirate 3y ago
Can crypto currency be used easily? Yes, through centralized entities like where your parents currently store their money. Some people may forgoe ease and aim for self-custody because they value decentralization over convenience. Others will choose a middle ground where they and a centralized entity both hold part of the key, ensuring that the 3rd party can't move their funds without permission.
- deleted 3y ago
  [deleted]
RalfWausE 3y ago
This is an argument against any form of direct payment... i mean, you can get your cash stolen very easily...
- Philadelphia 3y ago
  Yes. And so cryptocurrency is a reversion to a model of payment that’s been rejected by most people for its poor security.
  - friend_and_foe 3y ago
    Cash has been rejected by most people due to its poor security? I have to ask for a source on that. Cash is still the most popular form of money, and if you have low trust in your government or institutions/live in a corrupt society, is more secure than other options.

hgsgm 3y ago

With crypto, you get to cut out the middle man and be your own bank. You have fraud team and IT security team on your staff, right?

paulpauper 3y ago

Easy to steal and cash out, сryptocurrency is one of the most attractive digital assets for attackers. Has the author tried cashing out crypto? KYC anyone? It's harder than ever to cash out ,especially large sums. So many restrictions due to fraud. Hardware wallets are never safe. the only safe way is to generate your own entropy, key derivation. Why would you ever trust a 3rd party to generate your keys?

MagicMoonlight 3y ago

And how is this better than just using regular money?

hamzataha 3y ago

Casa

magnat 3y ago

What if each genuine unit would have entire PCB covered in glitter nail polish at factory? Based on a serial number of your device, you could check if a pattern on your device matches the one taken by manufacturer right after assembling the device.