Ledger Nano and Blue hacked by ethical hackers

[XRP-JAG 2,033]

Ledgers reply:

https://www.ledger.fr/2018/12/28/chaos-communication-congress-in-response-to-wallet-fails-presentation/

[King34Maine 1,656]

3 hours ago, zenkert said:

Everything can be hacked.

I agree, just give it time!!

[NightJanitor 1,658]

9 hours ago, Dario_o said:

They managed to successfully flash a custom firmware on the Ledger Nano S, in order to boot it without a PIN thus getting any kind of malicious transaction signed by the device.

[Paradigm 1,303]

Ledger is scaring me lately. The link for the TRX wallet app on their site contained a virus/malware. I just got a response back from them today saying they took the link with the virus off of their website. Thankfully I did not proceed with the installation but others in the TRX community may not have been so fortunate. 

[7strings 1,185]

1 hour ago, Paulo said:

Ledger is scaring me lately. The link for the TRX wallet app on their site contained a virus/malware. I just got a response back from them today saying they took the link with the virus off of their website. Thankfully I did not proceed with the installation but others in the TRX community may not have been so fortunate. 

After watching the whole demonstration and reading Ledger's answer @XRP-JAG posted above I think these vulnerabilities are luckily a non-issue in real-life situations. 

However your case also shows that Ledger's security standards could be much lower in reality than they claim.

Edited December 29, 2018 by 7strings

[Paradigm 1,303]

3 minutes ago, 7strings said:

After watching the whole demonstration and reading Ledger's answer @XRP-JAG posted above I think these vulnerabilities are luckily a non-issue in real-live situations.

However your case also shows that Ledger's security standards could be much lower than they claim

Hopefully these are non-issues, yes you are right. Now they are doing damage control. Here's a link to a reddit thread on the subject. I am surprised more people aren't talking about this.

 

[fiik 1,321]

so

safu

or

fubar

[retryW 3,332]

On 12/29/2018 at 6:54 AM, LordVetinari said:

These are not script kiddes. If something can be hacked, it will be. I'm very glad to see these guys are shedding light on vulnerabilities. This was inevitable and is necessary. Not comforting but necessary. 

The thing is, it's never a case of "if", but "when" it will be hacked.

I haven't watched the videos yet, but I'm gonna assume your funds on the Nano S are still currently "unhakable" provided it's sitting in your safe at home.

Most hacks of well encrypted devices require direct and unrestricted access to said device.

These people aren't going to be able to remotely break into your Nano and steal your funds.

[XRPto50dollars 11,774]

its still the wild west in cryptoland. someday these Nano S's and Trezor's will be obsolete paperweights sold on ebay for 50 cents.

until then, investors can only chose what they believe is the safest option currently available. 

[fluxw42 5]

So what I read between the lines from all this fuss:

If you're using a hardware wallet such as the Nano S, don't become careless because your secret is reasonably safe:

• Only use your ledger on a trusted machine
• Don't leave your hardware unsupervised in someones hands
• Know what the hardware ledger can protect you against, but more important, know against which attacks it CANT protect.
• Consider if you really need a hardware wallet, if you want to use it as cold storage, there are better solutions IMHO

An attacker doesn't need your secret to steal your stash, he needs a valid signature on a malicious transaction.

[XRP-JAG 2,033]

6 hours ago, fluxw42 said:

 

• Consider if you really need a hardware wallet, if you want to use it as cold storage, there are better solutions IMHO

What would you say is better?

[fluxw42 5]

50 minutes ago, XRP-JAG said:

What would you say is better?

If you're not trading? One or more offline generated paper wallets, put them in a secure locker in a bank. That's way better than having a Ledger S recovery phrase laying around  somewhere in your home (which is almost the equivalent of having your secret, even if you don't have access to the hardware ledger).

[XRP-JAG 2,033]

1 hour ago, fluxw42 said:

If you're not trading? One or more offline generated paper wallets, put them in a secure locker in a bank. That's way better than having a Ledger S recovery phrase laying around  somewhere in your home (which is almost the equivalent of having your secret, even if you don't have access to the hardware ledger).

Suppose you need to weight up the risks and costs. Looking maybe £250 per year for a bank locker. There still remains the risk of physical theft or destruction.

Paper wallet does also mean you need to have your seed shown on the computer atleast twice.

Nano and or seed words are vulnerable to physical theft at home... but currently your average house robber is not going to know what your list means. I’d be more concerned about house fire etc.

Current best option really is most likely a hardware wallet, with seed words stored in multiple secure locations - preferably disguised too. But, then your assets disappear with your memory / demise... unless you then entrust other(s).

You’ll know when we mainstream when your high street bank offers insured custody for crypto assists.

[fluxw42 5]

5 minutes ago, XRP-JAG said:

Looking maybe £250 per year for a bank locker.

Wow that's expensive  Definitely cheaper over here: I use a locker in a bank and it costs me 35€ a year, that's peanuts compared to what you could lose.

[XRP-JAG 2,033]

19 minutes ago, fluxw42 said:

Wow that's expensive  Definitely cheaper over here: I use a locker in a bank and it costs me 35€ a year, that's peanuts compared to what you could lose.

Maybe better price if shop around, but that was first price I found:

https://www.metrobankonline.co.uk/safe-deposit-boxes/

Not quite sure what kind of level security that gets you, my local ‘Metro’ was just a shop on the high street... fairly confident that they’ll not have a huge movie style bank vault in there!