Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Case study: fake hardware cryptowallet

kaspersky.com

Post reply on HN
Print view View original

11–20 of 160 posts

Re: Case study: fake hardware cryptowallet

#11

Post by monero-xmr »

flangola7 wrote: post #10
monero-xmr wrote: post #7

If you want a hardware wallet, I recommend software in an air-gapped machine. Unless you can buy the hardware directly from the manufacturer, and ideally you walked into the factory and bought it at the source, the risk of compromise is too great.

How do you feel about Yubikeys and HSM systems that corporations heavily rely on?

It’s like apples and bowling balls IMO. If the Yubikey directly stored hundreds of thousands of dollars of bearer assets that could be stolen remotely from an attacker anywhere on earth, then it would be a lot more risky. But that’s not typically what the Yubikey is for, unlike a crypto hardware wallet.

Re: Case study: fake hardware cryptowallet

#12

Post by 1ark »

themagician wrote: post #5

Incredible. This is so sophisticated and takes so much effort it makes you wonder just how many other wallets are compromised from before you even use them. There are so many other low effort attacks you can run that the fact that people are doing THIS really makes me wonder just how many wallets out there are 100% compromised. It would be trivial for any iOS-based software wallet to compromise your seed before your…

There was a recent drainage of many wallets, even old untouched ones on Ethereum. I don't think it was resolved. Your scenario is likely imo, and the fictional quote was what I saw.

Re: Case study: fake hardware cryptowallet

#15

Post by 40four »

acaloiar wrote: post #6
dboreham wrote: post #4

Title seems misleading (and isn't the article title). It implies that Trezor is a fake wallet. The article is actually about a wallet that purports to be made by Trezor but is in fact not (hardware supply chain attack).

Agreed -- the title should say (Trezor Impostor) to make it clear that Trezor is not the fake.

Or even better, it should just say “Case study: fake hardware cryptowallet”, which is the exact title, and in accordance with the guidelines. No need to append “Kaspersky” On the front, or mention Trezor at all, let the reader click through and form their own opinion.

Re: Case study: fake hardware cryptowallet

#16

Post by barbazoo »

Somewhat related, I was recently pointed to a cool video about someone hacking a Trezor One. Very enjoyable watch.

https://www.youtube.com/watch?v=dT9y-KQbqi4&pp=ygULdHJlem9yI...

> I was contacted to hack a Trezor One hardware wallet and recover $2 million worth of cryptocurrency (in the form of THETA).

Re: Case study: fake hardware cryptowallet

#17

Post by londons_explore »

KryDos wrote: post #9

Does it mean that at the moment of releasing 2.0.4 the Trezor team already knew there is a fake firmware circling around? I wonder if Trezor team communicated that in some maybe different way than that line in the CHANGELOG. Not blaming them of course, just wondering.

If I were Trezor and became aware of a fake firmware, I would:

* Offer rewards to anyone able to send me the fake devices or clues who is making them.

* Tell my clients to upgrade the firmware on devices before use. Make sure every new firmware is distinctive in some way - for example the boot screen, and tell the users to check for that to ensure they are actually running the firmware they thought they just flashed.

Re: Case study: fake hardware cryptowallet

#19

Post by radicaldreamer »

londons_explore wrote: post #17
KryDos wrote: post #9

Does it mean that at the moment of releasing 2.0.4 the Trezor team already knew there is a fake firmware circling around? I wonder if Trezor team communicated that in some maybe different way than that line in the CHANGELOG. Not blaming them of course, just wondering.

If I were Trezor and became aware of a fake firmware, I would: * Offer rewards to anyone able to send me the fake devices or clues who is making them. * Tell my clients to upgrade the firmware on devices before use. Make sure every new firmware is distinctive in some way - for example the boot screen, and tell the users to check for that to ensure they are actually running the firmware they thought they just flashed.

Seems like this could also be an insider threat where someone at Trezor knew all the BOM details and could pull this off

Re: Case study: fake hardware cryptowallet

#20

Post by alden5 »

Scoundreller wrote: post #8

> The housing was difficult to open: its two halves were held together with liberal quantities of glue and double-sided adhesive tape instead of the ultrasonic bonding used on factory-made Trezors. Other than having x-ray vision, one easy (but by no means perfect) verification to thwart these types of attacks is to weigh your devices. Manufacturing should be consistent enough that resealing a device like this would b…

the problem is the sorta person to buy a wallet from a classifieds website isn't willing to spend $30 on a scale to weigh it, because if they had that money they'd just buy it from the official store instead
Post reply on HN