Teenager Hacks Crypto-currency Wallet

A Ledger Nano deviceImage copyright Getty Images
Image caption Ledger Nano devices are meant to keep people's crypto-currency safe

A hardware wallet designed to store crypto-currencies, and touted by its manufacturer as tamper-proof, has been hacked by a British 15-year-old.

Writing on his blog, Saleem Rashid said he had written code that gave him a back door into the Ledger Nano S, a $100 (£70) device that has sold millions around the world.

It would allow a malicious attacker to drain the wallet of funds, he said.

The firm behind the wallet said that it had issued a security fix.

It is believed the flaw also affects another model - the Nano Blue - and a fix for that will not be available "for several weeks", the firm's chief security officer, Charles Guillemet told Quartz magazine.

Crypto-currencies such as Bitcoin use an encryption method known as public key cryptography to protect funds. Users can spend the money stored only if they have access to the private key.

'No bounty'

Hardware wallets store these private keys and can be connected to a PC via a USB port.

The attack targets the device's micro-controllers, one of which stores the private key, while the other acts as its proxy to support display functions and the USB interface.

The latter is less secure and is not able to differentiate between genuine firmware - software programmed into a device - and code written by an outsider.

One big caveat for the method discovered by the teenager is that the attacker would need physical access to a wallet before it got into the hands of the victim - so, for instance, by buying one, altering it and then selling it on eBay or a similar online site.

In his blog, Rashid said that he had sent the code he had developed to Ledger "a few months ago", adding that he had not been paid a bounty.

He said that he chose to publish after Ledger's chief executive Eric Larcheveque made comments on Reddit which, according to the teenager, "were fraught with technical inaccuracy".

Danger 'exaggerated'

"As a result of this, I became concerned that this vulnerability would not be properly explained to customers," he wrote.

In his Reddit comments, Mr Larcheveque said that the security issue had "been greatly exaggerated".

"While possible, this proof of concept ranks by no means as a critical severity level and has never been demonstrated," he wrote.

He accused the teenager of becoming "visibly upset" when the firm did not share the fix as a "critical security update" and said his decision to go public had "generated a lot of panic".

Craig Young, a researcher at security firm Tripwire commented: "It is very difficult to thoroughly secure any device from attackers with physical access. This is why it is so critical to have trusted component makers, merchants, and repair facilities.

"In this particular case, it was discovered that anyone with physical access could modify the Ledger hardware wallet to gain access to funds. In effect, this would mean that someone selling this hardware wallet would be able to steal funds from their customers.

"Fortunately for Ledger owners, the problem was responsibly reported to the vendor and a co-ordinated disclosure minimised risk to end users."

A few weeks ago, Ledger confirmed that a separate flaw made its wallets susceptible to another attack in which malware could trick users into unknowingly sending their crypto-currency to hackers.

RECENT NEWS

The Meteoric Rise Of Anthropic: Valuation And The Future Of AI

In an era where artificial intelligence (AI) is not just a buzzword but a cornerstone of technological advancement, Amaz... Read more

The Future Of Sports Strategy: Navigating The AI Revolution

In the fast-evolving world of competitive sports, the introduction of Artificial Intelligence (AI) has been nothing shor... Read more

The Future Of Sports Strategy: Navigating The AI Revolution

In the fast-evolving world of competitive sports, the introduction of Artificial Intelligence (AI) has been nothing shor... Read more

Beyond The Hype: The Harmonious Fusion Of AI And Music Genres

In the evolving symphony of the music industry, artificial intelligence (AI) is no longer just a futuristic concept but ... Read more

Collaboration Or Competition? Big Tech And Public Archives

In the rapidly evolving digital landscape, the intersection of public broadcasting archives and Big Tech's AI ambitions ... Read more

The Fallout Of Antitrust Actions: Apple's Stock Dips And Investor Sentiment Shaken

In a landmark move, the Biden administration has taken a significant step in tightening the reins on Big Tech’s market... Read more