Ledger hardware wallet implants have renewed scrutiny of the middlemen handling devices before they reach buyers, even through authorized sellers.
Ordinary cryptocurrency owners cannot realistically be expected to detect sophisticated tampering with hardware wallets, security researcher Joe Grand told Cointelegraph on Tuesday.
Grand specializes in hardware security and has helped recover cryptocurrency from locked wallets. His work includes developing techniques to bypass security protections and extract data from memory chips used in wallets made by Trezor and KeepKey.
“It’s really hard to explain to people how they’re supposed to look at their devices, because even technical people like me are not looking at every single device to see if it’s been tampered with,” Grand said.
The concerns surfaced Friday after crypto losses were reported involving Ledger devices sold through CryptoBilis, a reseller listed as authorized in Indonesia, Malaysia and the Philippines. Ledger confirmed Saturday that one affected device contained an unauthorized implant.
Malicious implants in Ledger wallets sold by CryptoBilis captured users’ recovery phrases and transmitted them over cellular networks, the French hardware wallet maker said.
More control doesn’t mean less trust
Hardware wallets are designed to keep private keys offline, reducing exposure to online attacks that can target software wallets.
Some hardware wallets have achieved global popularity, and their distribution networks have created opportunities for supply-chain tampering.
Crypto analyst Mati Greenspan told Cointelegraph that he has never used a hardware wallet despite being involved in the industry since 2013, seeing little value in adding another chain of trust.
Related: MediaMarktSaturn pulls Ledger products amid tampering reports
“When you buy a hardware wallet, you’re introducing a whole new chain of trust, from the manufacturer to the supplier to whoever handled the device before it reached you,” Greenspan said.
Nick Neuman, CEO of Bitcoin security company Casa, said avoiding third-party trust entirely is impossible. “There is always an intermediary you will need to trust,” he said, adding that users should spread their risk across multiple providers rather than rely on just one.
Security checks cannot catch everything
Trezor, among Ledger’s main rivals, said its devices undergo authenticity checks and accept only signed firmware, but acknowledged that these protections cannot rule out physical tampering.
“You can also check that the packaging and holographic seal are intact and look for unusual marks on the device, but these checks alone cannot guarantee that it has not been modified,” a Trezor spokesperson told Cointelegraph.
Related: Ledger asks resellers to halt sales in Southeast Asia and Hong Kong
The company said the implants found in Ledger devices pose a different challenge because they capture information from the screen without modifying the firmware. Trezor said that it has not observed this type of attack on its own devices.
On Tuesday, Trezor announced that it would reduce the number of resellers as a “preventive” step.
Hardware wallet designs can reduce tampering risks
Grand suggested several physical design changes, from transparent casings that expose internal components to tamper-resistant enclosures that would force attackers to recreate the housing to conceal modifications.
“It’s going to be a lot harder for an adversary to inject additional hardware into the device, because they would have to recreate the entire housing,” he said.
The security researcher also pointed to anti-tamper design recommendations from electronics engineer Dave Jones, while cautioning that such measures should not be relied on alone. They could make supply-chain attacks more difficult, but would not eliminate the risk.
Magazine: Ledger attack spreads to EU, AI finds ’18 trillion XRP’ bug: Hodler’s Digest