how can the implant send the seed words to an attacker? doesn't a crypto wallet have to talk an application on the host computer? wouldn't the communication between the wallet and the host computer never allow for the seed words to be sent from the wallet to the outside world? in other words how could an "implant" tampering of the wallet make the host computer suddenly start sending seed phrases to third parties?
Though it's not what happened in this case, you could tamper with a crypto wallet to make it emulate a USB keyboard and once connected, send a series of keystrokes to download and run an exploit.
All hw wallets are being breached. Big, easy target. I think a lot of people are interested in this breach and the people behind it. 100 million worth? This might works both ways.. curious about the further investigations. My hunch… after major crackdowns on scam centers in the golden triangle, this is their latest dab to wealth?
Ledger the company was not breached (this time around). The devices here were modified by a middleman in the distribution chain and sold to unsuspecting buyers.
From what I read, an official reseller was breached. It was the decision of Ledger to use that reseller in the first place and to not do a check on their distribution chain. They could have sold straight to the customer instead.
You need to have reseller in most countries otherwise your customers will have to deal with long shipping time, customs, etc. The same for selling in physical stores.
It was the decision of Ledger to use a reseller and to increase their attack vector just so the customer wouldn't be inconvenienced with three more days of shipping. Bad decision in my opinion.
It was also the decision of the customers to still buy a Ledger device despite being breached multiple times.
The crypto lunatic fringe have long frustrated me with their assertions of sovereign this and that.
There is no sovereignty in crypto if YOU ARE NOT BUILDING YOUR OWN HARDWARE.
Any claims of sanctity or reliability in the software stack are rendered null and void until someone with a tunneling electron microscope has completed an audit of your chips.
THIS is why Taiwan matters so much, people: there is NO sovereignty for as long as your chips are being imported. You can trust all you want - but trust is nothing without verification. We are all serf-subjects of the wafer-producing overlords.
Ledger clearly drank the koolaid. Crypto people: invest in hardware. NOT software. Anything less is utter futility.
Not sure what you mean? Taiwan, imported, isnt taiwan the biggest exporter of high end chips? 100% these have not been hacked in Taiwan. You mean setting up your own fab? I am confused
It was also the decision of the customers to still buy a Ledger device despite being breached multiple times.
There is no sovereignty in crypto if YOU ARE NOT BUILDING YOUR OWN HARDWARE.
Any claims of sanctity or reliability in the software stack are rendered null and void until someone with a tunneling electron microscope has completed an audit of your chips.
THIS is why Taiwan matters so much, people: there is NO sovereignty for as long as your chips are being imported. You can trust all you want - but trust is nothing without verification. We are all serf-subjects of the wafer-producing overlords.
Ledger clearly drank the koolaid. Crypto people: invest in hardware. NOT software. Anything less is utter futility.
not your hardware, not your keys
not your chips, not your hardware
not manufactured in house, not your chips
not your designs, not manufactured by you
not designed by you personally, not your designs
ad infinitum. To be truly secure, you must first learn to survive alone in the wilderness and smelt tin
(I agree in general, I'm just exploring the statement).
You will never be completely secure against failure, the only way to protect yourself is to be able to robustly recover from failure.
I'd rather be able to say "every single government is in my hardware and they still can't touch it."
Perhaps possible with multisig, but now you're basically back to trusting banks.
There might be a strict hardware audit process for cryptographic accelerators on IBM Z machines though, I'm not sure, I'm gonna ask though.
These industries are just not sexy enough for the crypto folks to want to learn from, or about.