Whenever a new coin or token appears, one of the first questions is whether the asset would be supported by the two leading hardware wallets - Trezor and Ledger. Bitcoin's appreciation to nearly $20,000 has made investors expect other assets to achieve a similar feat, while seeking a way to protect the potential fortune from loss.
A hardware wallet has significant security features compared to other storage options. However, the devices also have vulnerabilities, allowing several types of attacks.
The attacks and vulnerabilities of a Ledger hardware wallet were recently detailed by Saleem Rashid, a teenaged tech wiz, considered a "rock star" in the crypto community. He has been known for the Trezor SRAM exploit, and for participating in the story of unlocking about 7 BTC from a hardware wallet. Later, the knowledge on how to remove the seed from a Trezor served to increase the wallet's security.
At the moment, Saleem Rashid is becoming one of the influential voices in the crypto space, and his tweets are a source of information on hardware wallet safety.
Trezor Security Update
Hardware wallets are continuously updating themselves whenever a bug is found. The most recent update is for Trezor, releasing a new security version:
PSA: TREZOR One Security Firmware Update 1.6.1 released.
— TREZOR (@TREZOR) March 21, 2018
Please go to https://t.co/PC3jOdxwXm to update your TREZOR One. For more information, refer to the blog post linked below: https://t.co/aCYKaq8LXi
Meanwhile, Ledger, the producer of the Nano series hardware wallets, has taken the approach of a bounty program.
Saleem Rashid and the Ledger Nano Update
Rashid himself discovered and shared an already disabled vulnerability in the Ledger Nano digital wallet. The release of the exploit coincided with a firmware update announced by the Ledger company.
Full technical write-up, video demonstration and proof-of-concept code for @LedgerHQ hardware wallet vulnerability.https://t.co/kC4409sqxK
— Saleem Rashid (@spudowiar) March 20, 2018
Before the launch of the new firmware, a hacker could exploit the Nano wallet either by intercepting it during delivery and before a user sets it up, or later, by tampering or other ways to make the user install a fake firmware. The new firmware release ensures that a successful installation protects the device.
Because hardware wallets are relatively simple electronic devices, they can be made to divulge the private seed, and sometimes have even physical vulnerabilities allowing that.
This also means that the hardware wallet should remain protected, by only downloading official firmware, and avoiding phishing links. The work of Rashid reveals those dangers, and while the exploits may serve to recover lost seeds, there is always the chance that a hardware wallet may become compromised.
Hardware Wallet Awareness
As hardware wallets ship even more devices, users may want to exercise extreme caution. Buying from dubious sources may lead to losses if an attacker has had a chance to make the device divulge its private seed.
Ledger also advised that:
"What is important from a user perspective is to able to prove the genuineness of your device and the authenticity of the firmware you load. Those two security claims remain intact."
While a hardware wallet may be a good decision for a form of cold storage, the potential for tampering means that extra security may be required at every step, by also following the latest updates on potential hacks.
This article appeared first on Cryptovest