Article
SlowMist analyzes suspected hardware implantation attack targeting Ledger: malicious module may steal recovery phrases through screen data lines
BlockBeats reports that October 10, Chief Information Security Officer of SlowMist, 23pds stated that if the Ledger device PCB was modified exactly as described by former Mt. Gox CEO Mark Karpelès, the attacker would possess a fairly high level of technical expertise.
The attack process may be as follows: the wallet generates the recovery phrase inside the secure element (SE), then displays the recovery phrase on the screen for the user to copy down; the malicious module obtains the displayed content through screen data lines such as SPI, records the complete recovery phrase, and then sends the data to the attacker via LTE/eSIM, ultimately resulting in the theft of the user's assets.
The secure element is intended to prevent private keys from being directly read or exported, but it cannot prevent an external module from obtaining information currently displayed on the screen. However, the above analysis is based on the premise that PCB was indeed modified in the manner described; the relevant attack path and hardware implantation still require independent verification.
BlockBeats reported yesterday that former Mt. Gox CEO Mark Karpelès disclosed that he had received a Ledger hardware wallet suspected of containing an implanted spy module. The device came from Malaysia; its outer shrink wrap was intact, and even after opening the package, the anomaly was difficult to detect immediately. The implant was hidden in the position where the screen's original cushioning pad should have been.
Karpelès further explained that the module contained LTE communication components, an antenna, an eSIM, and a microcontroller connected to the Ledger SPI bus, which could analyze the characters displayed by the device to the user and send the relevant data after the recovery phrase setup was completed.
Original link https://m.theblockbeats.info/flash/371089