Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Case study: fake hardware cryptowallet

kaspersky.com

Post reply on HN
Print view View original

61–70 of 160 posts

Re: Case study: fake hardware cryptowallet

#61

Post by yrral »

themagician wrote: post #5

Incredible. This is so sophisticated and takes so much effort it makes you wonder just how many other wallets are compromised from before you even use them. There are so many other low effort attacks you can run that the fact that people are doing THIS really makes me wonder just how many wallets out there are 100% compromised. It would be trivial for any iOS-based software wallet to compromise your seed before your…

This recently happened to the trust wallet browser extension due to using mersenne twister to generate their private keys. Issue is that this PRNG is not cryptographically secure. I think trust wallet is more popular than coinbase wallet as well.

https://community.trustwallet.com/t/wasm-vulnerability-incid...

Re: Case study: fake hardware cryptowallet

#62

Post by mrb »

I would be immune to this attack because I always generate my own seeds, on a trusted computer. So I set up hardware wallets to import my seed, instead of trusting their seed generation algo. Of course this procedure doesn't protect against other hardware attacks, for example the wallet exfiltrating the private key somehow (R/F signal), but it certainly raises the bar for hackers.

Re: Case study: fake hardware cryptowallet

#63

Post by netsharc »

gnatman wrote: post #14

I’m far from an expert and don’t own any cryptocurrency but I can’t imagine buying a hardware wallet from a “popular classifieds website”, i.e. ebay.

Yeah, it's basically a good market for scammers: you're almost guaranteed whoever looking to buy this is is looking to store some large amount of money, so as a scammer your chances of big success is very large.

Re: Case study: fake hardware cryptowallet

#64

Post by Forbo »

derefr wrote: post #56
Forbo wrote: post #55

Earlier quoted context omitted.

Why complicate things? Just smash the device. This is only effective if the user doesn't have their seed phrase. Edit: Looks like I was beaten to this down thread.

I think in this case the idea is that the attacker isn't physically in possession of the device, but rather has tricked the user into running a malicious firmware updater for the device.

Ah, yeah,that makes sense. Hadn't considered that angle. Would track with the user behavior exposed here, namely getting their stuff from an unofficial source (be it the device itself or the firmware).

Re: Case study: fake hardware cryptowallet

#66

Post by saganus »

lisper wrote: post #22

I foresaw this years ago, which prompted me to build this: https://sc4.us/hsm/ It's an HSM which you can flash yourself. Unfortunately, it never generated much interest and so I had to fold up the tent. But maybe it was just ahead of its time.

I remember when this came out, and was interested in getting one!

Unfortunately I was aiming to use it to generate TOTP codes (and replace my authenticator app), but IIRC it needed a RT clock and thus a battery, which was not part of the design.

Great project though.

Re: Case study: fake hardware cryptowallet

#69

Post by polygamous_bat »

Scoundreller wrote: post #31
bibaheu wrote: post #25

Earlier quoted context omitted.

You can generate the coin movement operation in the air gapped machine, write it down on paper, and then use a normal, connected computer to transmit it to the network. The private key never left the air gapped machine, with this method.

The method I’ve read about is to print “the request” onto a QR code, have the air-gapped machine scan it, sign it and print off the signed transaction QR to be scanned into the networked computer to propagate to the network. A bit more to trust but a lot less to type.

And then you get hacked anyway because the QR code generator was compromised and switched around a few bytes before creating the QR code.

Re: Case study: fake hardware cryptowallet

#70

Post by Scoundreller »

Alupis wrote: post #32
Scoundreller wrote: post #27

Earlier quoted context omitted.

Lifehack: a post office will weigh whatever you want for free . Also many grocery stores have accessible scales. Best part is they pay for the certifications! Then there are friends that ahem buy/sell materials in gram quantities. A counted handful of newish coins are a reasonable way of verifying accuracy in those cases. Be sure to weigh different quantities lest the absolute and relative error cancel out.

The Post Office's scale likely only has ounce resolution, or at best, 0.01 LBS (0.16oz) resolution. ie, you won't notice a couple grams of glue...

Ah, they’re all grams here, but that still might not be enough precision on a small device.
Post reply on HN