Crypto News

Teenager hacks cryptocurrency wallet

Teenager hacks cryptocurrency wallet

A hardware wallet designed to store crypto-currencies, and touted by its manufacturer as tamper-proof, has been hacked by a British 15-year-old.

Writing on his blog, Saleem Rashid said he had written code that gave him a back door into the Ledger Nano S, a $100 (£70) device that has sold millions around the world. It would allow a malicious attacker to drain the wallet of funds, he said. The firm behind the wallet said that it had issued a security fix. It is believed the flaw also affects another model – the Nano Blue – and a fix for that will not be available “for several weeks”, the firm’s chief security officer, Charles Guillemet told Quartz magazine. Crypto-currencies such as Bitcoin use an encryption method known as public key cryptography to protect funds. Users can spend the money stored only if they have access to the private key.

‘No bounty’

Hardware wallets store these private keys and can be connected to a PC via a USB port. The attack targets the device’s micro-controllers, one of which stores the private key, while the other acts as its proxy to support display functions and the USB interface. The latter is less secure and is not able to differentiate between genuine firmware – software programmed into a device – and code written by an outsider. One big caveat for the method discovered by the teenager is that the attacker would need physical access to a wallet before it got into the hands of the victim – so, for instance, by buying one, altering it and then selling it on eBay or a similar online site. In his blog, Rashid said that he had sent the code he had developed to Ledger “a few months ago”, adding that he had not been paid a bounty. He said that he chose to publish after Ledger’s chief executive Eric Larcheveque made comments on Reddit which, according to the teenager, “were fraught with technical inaccuracy”.

Danger ‘exaggerated’

“As a result of this, I became concerned that this vulnerability would not be properly explained to customers,” he wrote. In his Reddit comments, Mr Larcheveque said that the security issue had “been greatly exaggerated”. “While possible, this proof of concept ranks by no means as a critical severity level and has never been demonstrated,” he wrote. He accused the teenager of becoming “visibly upset” when the firm did not share the fix as a “critical security update” and said his decision to go public had “generated a lot of panic”. Craig Young, a researcher at security firm Tripwire commented: “It is very difficult to thoroughly secure any device from attackers with physical access. This is why it is so critical to have trusted component makers, merchants, and repair facilities. “In this particular case, it was discovered that anyone with physical access could modify the Ledger hardware wallet to gain access to funds. In effect, this would mean that someone selling this hardware wallet would be able to steal funds from their customers. “Fortunately for Ledger owners, the problem was responsibly reported to the vendor and a co-ordinated disclosure minimised risk to end users.” A few weeks ago, Ledger confirmed that a separate flaw made its wallets susceptible to another attack in which malware could trick users into unknowingly sending their crypto-currency to hackers. “Notification” bell clicked in the bottom right corner to be notified with updates!
Tags

2 thoughts on “Teenager hacks cryptocurrency wallet”

  1. I precisely wished to appreciate you once again. I do not know the things that I would’ve tried without those aspects provided by you relating to such area of interest. It was a real challenging problem in my circumstances, nevertheless finding out the specialized way you solved that took me to weep over delight. Extremely grateful for this help as well as sincerely hope you are aware of a powerful job you are always undertaking training some other people all through your site. More than likely you haven’t encountered any of us.

  2. I wish to express some thanks to this writer just for bailing me out of this predicament. Just after exploring through the world-wide-web and finding tricks which are not powerful, I assumed my life was done. Being alive without the approaches to the difficulties you have fixed as a result of the short article is a crucial case, as well as the kind that could have in a negative way damaged my career if I had not come across your web blog. Your understanding and kindness in taking care of everything was precious. I’m not sure what I would’ve done if I hadn’t encountered such a subject like this. I’m able to at this moment look forward to my future. Thanks for your time very much for this skilled and result oriented guide. I will not hesitate to refer your web page to anyone who should receive care on this topic.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Articles

Close