Friday , April 20 2018
Home / Tech / Teenager hacks crypto-currency wallet

Teenager hacks crypto-currency wallet

A Ledger Nano deviceImage copyright Getty Images
Image caption Ledger Nano devices are meant to keep people's crypto-currency safe

A hardware wallet designed to store crypto-currencies, and touted by its manufacturer as tamper-proof, has been hacked by a British 15-year-old.

Writing on his blog, Saleem Rashid said he had written code that gave him a back door into the Ledger Nano S, a $100 (£70) device that has sold millions around the world.

It would allow a malicious attacker to drain the wallet of funds, he said.

The firm behind the wallet said that it had issued a security fix.

It is believed the flaw also affects another model – the Nano Blue – and a fix for that will not be available "for several weeks", the firm's chief security officer, Charles Guillemet told Quartz magazine.

Crypto-currencies such as Bitcoin use an encryption method known as public key cryptography to protect funds. Users can spend the money stored only if they have access to the private key.

'No bounty'

Hardware wallets store these private keys and can be connected to a PC via a USB port.

The attack targets the device's micro-controllers, one of which stores the private key, while the other acts as its proxy to support display functions and the USB interface.

The latter is less secure and is not able to differentiate between genuine firmware – software programmed into a device – and code written by an outsider.

One big caveat for the method discovered by the teenager is that the attacker would need physical access to a wallet before it got into the hands of the victim – so, for instance, by buying one, altering it and then selling it on eBay or a similar online site.

In his blog, Rashid said that he had sent the code he had developed to Ledger "a few months ago", adding that he had not been paid a bounty.

He said that he chose to publish after Ledger's chief executive Eric Larcheveque made comments on Reddit which, according to the teenager, "were fraught with technical inaccuracy".

Danger 'exaggerated'

"As a result of this, I became concerned that this vulnerability would not be properly explained to customers," he wrote.

In his Reddit comments, Mr Larcheveque said that the security issue had "been greatly exaggerated".

"While possible, this proof of concept ranks by no means as a critical severity level and has never been demonstrated," he wrote.

He accused the teenager of becoming "visibly upset" when the firm did not share the fix as a "critical security update" and said his decision to go public had "generated a lot of panic".

Craig Young, a researcher at security firm Tripwire commented: "It is very difficult to thoroughly secure any device from attackers with physical access. This is why it is so critical to have trusted component makers, merchants, and repair facilities.

"In this particular case, it was discovered that anyone with physical access could modify the Ledger hardware wallet to gain access to funds. In effect, this would mean that someone selling this hardware wallet would be able to steal funds from their customers.

"Fortunately for Ledger owners, the problem was responsibly reported to the vendor and a co-ordinated disclosure minimised risk to end users."

A few weeks ago, Ledger confirmed that a separate flaw made its wallets susceptible to another attack in which malware could trick users into unknowingly sending their crypto-currency to hackers.

About admin

Our goal is to help you improve your life and improve your standard of living and gain more knowledge about what to do in all cases whether Business and Investing or Arts and Entertainment or

Check Also

Are AI fairytales the future?

Image copyright Getty Images Image caption AI programs have been designed to write stories in the style of human authorsIt was recently reported that the meditation app Calm had published a "new" fairytale by the Brothers Grimm. However, The Princess and the Fox was written not by the brothers, who died over 150 years ago, but by humans using an artificial intelligence (AI) tool. It's the first fairy tale written by an AI, claims Calm, and is the result of a collaboration with Botnik Studios - a community of writers, artists and developers. Calm says the technique could be referred to as "literary cloning". Botnik employees used a predictive-text program to generate words and phrases that might be found in the original Grimm fairytales. Human writers then pieced together sentences to form "the rough shape of a story", according to Jamie Brew, chief executive of Botnik. The full version is available to paying customers of Calm, but here's a short extract: "Once upon a tim..

Leave a Reply

Your email address will not be published. Required fields are marked *