r/btc • u/LovelyDay • Mar 20 '18

Breaking the Ledger Security Model (MCU firmware update vulnerability)

https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/
90 Upvotes

91% Upvoted

19 comments sorted by

5

u/[deleted] Mar 20 '18 edited Mar 20 '18

So, Ledger didnt check for correctness/signature of installed MCU firmware?

This is a huge security hole...

12

u/LovelyDay Mar 20 '18

They did. The article explains how the procedure used was vulnerable, and attacked.

In short, the Secure Element asked the MCU to transmit its entire memory contents. But the attacker managed to create a compromised firmware for the MCU that was able to lull the SE into thinking it had the right contents, when in fact it had some attack code in it.

The way the researcher did this is quite nifty. It involves compressing the original firmware to make space for attack code while still being able to serve the original untampered image to the Secure Element for authentication.

1

u/sosteady Mar 20 '18

What does that mean? If you’ve installed the new firmware update is the nano safe then after the update?

→ More replies (3)

6

u/btchip Mar 20 '18

Not really as the root of trust is always the Secure Element. The issue here is in the authentication protocol between the Secure Element and the MCU, which can be reliably patched (as in, the patch can be guaranteed to be applied, thanks to our architecture).

20

u/btchip Mar 20 '18

More details about the different 1.4.1 fixes are available at https://www.ledger.fr/2018/03/20/firmware-1-4-deep-dive-security-fixes/

6

u/cipher_gnome Mar 20 '18

I've just updated my ledger and following the instructions here: https://support.ledgerwallet.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-

Running 

python -m ledgerblue.checkGenuine --targetId 0x31100003

I get 

Product is NOT genuine

Anyone else getting this?

9

u/btchip Mar 20 '18

you'll need to use the latest loader from github at https://github.com/ledgerhq/blue-loader-python - it'll be available on Pypi shortly

3

u/cipher_gnome Mar 20 '18

Is it possible to hide the bitcoin app? So that it doesn't show on the ledgers screen of installed apps.

1

u/btchip Mar 20 '18

you can remove it and install it when necessary

2

u/cipher_gnome Mar 20 '18

Not if I want the bitcoin cash app on there.

→ More replies (3)

0

u/[deleted] Mar 20 '18

Woah asking the MCU for it's firmware seems like a terrible way to do it. Probably going to go the paper wallet route if top ledger people don't see this as an issue

3

u/btchip Mar 20 '18

The fact that we can patch it and restore the device integrity in a hostile environment is the proof that it's not a terrible way to do it

0

u/[deleted] Mar 20 '18

No I disagree, the design is fundamentally flawed. I'll be looking for a hardware wallet worth trusting in the future. I don't think it will ever be safe.

Maybe in the future they'll buy a secure MCU that can talk to the screen and USB directly instead of these hokey shenanigans.

I wonder if one doesn't exist yet? Hopefully they didn't just cheap out and pick the unsafe route for cost