An attack vector has been found last month. Nothing really critical. Users can easily be safe if they double check: Users need to validate the integrity of the address before, as a precaution. (if using ethereum app better to use Live CD O.S.)
More details can be found in this PDF
hereThe Attack
Ledger wallets generates the displayed receive address using JavaScript code running on the host machine.
This means that a malware can simply replace the code responsible for generating the receive address with its own address, causing all future deposits to be sent to the attacker.
Because receive addresses are consistently changing as part of the usual activity of the wallet, the user has no trivial way (like recognizing his address) to verify the integrity of the receive address.
As far as he knows, the displayed receive address is his actual receive address
What Makes This Even Worse- All the ledger wallet software is located in the AppData folder, meaning that even an unprivileged malware can modify them (no need to gain administrative rights).
- The ledger wallet doesn’t implement any integrity-check/anti-tampering to its source files, meaning they can be modified by anyone.
- All the malware needs to do is replace one line of code in the ledger software, this can be achieved with less than 10 lines of python code.
- New ledger users would typically send all their funds to the wallet once initialized. If the machine was pre-infected, this first transaction may be compromised causing the user to lose all of his funds.
- The attack changes the receive address during its generation, causing even the automatically generated QR to be updated to the attacker’s address. Meaning that both the string and QR representations of the address are compromised.
Advice for Existing Ledger CustomersIf you’re using the Bitcoin App – Before every receive transaction validate the integrity of the address using the monitor button.
If you’re using the Ethereum App – Treat the ledger hardware wallet the same as any other software based wallet, and use it only on a Live CD operating system that is guaranteed to be malware-free. At
least until this issue receives some kind of fix.
but the good thing I never ever used their chrome apps.
