Topic: Be careful what you plug your hardware wallet into your PC with (Read 475 times)

I'm not a big fan of USB-C either, but honestly the whole point of it is to have a single (or a few) USB-C <> USB-C cables, which work for everything, from charging your phone, tablet, headphones, connecting your keyboard, connecting your display; anything, really. It should result in less cables being bought, carried around and replaced.
Of course, there is a transition period as always.

I'm certainly glad USB was introduced as opposed to having parallel port, serial port, PS/2, even Ethernet can run fairly well on a modern USB-A port - while we needed so many different ports in the past. So stuff moving towards less different connectors and cables in my opinion is a good thing in general.

I have no idea how we got to this topic though; this is so off-topic..

This whole "use cables to connect your legacy devices" nonsense is not going to cause most people to go out and buy cables to connect their peripherals to netiher macbooks or their cheap ultrabook competitors, particularly since there is no go-to vendor for buying plugs (like how there is Best Buy for electronics).

That philosophy might have worked with DisplayPort but I don't see people going out and buying cables or new USB-C devides anytime soon.

It's not too difficult to put two USB-A ports, one on each side of ultrabooks, and without increasing the thickness.

It's just due to lemmings copying Apple's fanatical minimalism really that the industry is threatening to go into a situation where we must buy cables for everything. [As you can see, this design philosophy doesn't work every well when transferred to Windows, hence the manufacturer resistance to going all-USB-C.]

Alright, so those are 2 different things at play then, right. Bug #1 is about replacing Bitcoin address A on screen and clipboard simultaneously with address B, so when the user copies it into the wallet software (which cannot know where that address comes from, so no way to verify it hasn't been tampered with), the address on the device's screen (B) will match with what's on the computer screen (B) and what was pasted into the wallet software (address B), so no suspicion will be raised. This can't be fixed by wallet applications.

Bug #2 is about a user copying address A from a webpapge (unmodified / untampered) into the software, address A being displayed on the device's screen, but getting the device to sign transaction that spends to address B?

Don't worry if you don't know / can't tell / aren't allowed to tell more details; I'm just very intrigued..

The editing of the webpage with an address in a fixed known position is not going to be a fixable, that just is what it is.

The other thing that can be fixed that I have been evasive about discussing is more along the lines of changing the way the apps on the computer talk to the device.
Without getting to into it because:

1) I promised not to
and
2) I don't understand it fully...

The desktop app says to the hw wallet lets send funds to this address 1234 the cable sends to the device lets send funds to 5678 at that point the user should stop. But the issue is a lot of people get complacent and don't check. The other issue is at certain times and certain conditions he can FORCE 1234 to be displayed on the device. Don't ask how I got as far as "you plug in the cable and then......it's all gibberish" I am not ashamed to admit it's over my head. I can fake PHP work, really know linux and like to think I am fairly good at routing. And in general tend to be the go-to person for dealing with many system issues.
But this, nope, I get the basic concept of how it works. But don't get it past there.

-Dave

Interesting; so the bug / exploit you guys found is going to be fixed by the manufacturer now?
I was under the impression that due to its nature it was not vendor-specific to just one brand and that it was going to be hard to fix.

The attack I imagined from your rough description, wouldn't be easy to fix outside the OS level.

So was talking about this while burgers & beers earlier.
The fix they sent him barely works and causes errors and when it does work it's still not right. But as he put it "was more of a proof of concept then finished coding"
However, they are working on it so I'll give them that.

And yes it's a What's App burgers and beers meeting since he is several time zones away....

-Dave

At least you're keeping the cable manufacturers in business! But I encourage you to try such a DIY kit; I'll do too when I find the time, maybe those are more sturdy indeed. I saw people put paracord and other materials around the wires to make them more durable and get a custom look. That way it will also be easy to spot if someone replaced your cable. Opposed to a standard all white or black cable which might be replaced without notice in an evil maid attack [1] scenario.

On one hand, it's a pretty cool idea not having to carry a separate cable for almost every device, instead having a single cable that can charge your laptop, your phone, connect your phone to your laptop, connect your hardware wallet to your phone or connect your laptop to a monitor and much more.
But there's already been a few practical issues like some cables not speaking all protocols. So therefore some features don't work with certain cables and certain devices, but do work on others and these sorts of annoyances. I believe it comes down to the chips used in the connectors and the actual number of leads that are actually connected. In the screencap I shared earlier, you can see the USB-C plug only having USB 2.0 (!!) standard connection pads, so from the outside it seems just like a USB-C cable but it will obviously barely charge a laptop (if at all - at 5V, 0.9A).

But this may already be way too off-topic for this thread - sorry about that!

[1] https://en.wikipedia.org/wiki/Evil_Maid_attack

Exactly that, and even when I purchased better quality audio cables, I destroy them as well...
I need some military grade cables, or instructions how to make them, because I am terminator for cables 

I know USB type C have advantages compared to older USB, and good thing about them is they can work on both sides and you can't plug it incorrectly.
Problem I have is there is a push for all devices to use this for everything including power cables, that means all older cables are becoming obsolete, unless you use some adapter.

No it's not safer, and I personally don't like Bluetooth or other wireless type of communication used in hardware wallets.
Better option than cables is using QR codes, and airgapped hardware wallets like Passport, Keystone, Coldcard or DIY SeedSigner.

i had a thread on diy usb cables.. might be of some use

https://bitcointalksearch.org/topic/m.53646922

Imho it's not.
But really, it's not that difficult to buy a proper USB data cable from a proper shop if, by (some rather unlikely) chance, the one from the HW manufacturer got damaged or lost.
So why risk anyway?

And while I do agree that this problem with USB cables is a growing problem, I don't think that if you just buy a new cable there's a real chance for troubles.
So yeah, just stop using cables that aren't yours.

And no, I don't trust at all the wireless connections, no matter it's NFC, Bluetooth or WiFi.

Oh that's a good question. On one hand, technologically cable is better than wireless; assuming you know your cable. Wireless always remains attackable on the physical layer, although good high-level protocols can fix this attack vector. So to really answer it, you would also need to take into account whether the information sent over Bluetooth is encrypted on application-level and which Bluetooth implementation is used.

Fact of the matter though, the [1] whole Bluetooth 5.3 specification has grown into a single, 3,000 (three-thousand) page 27MB PDF document, which should be telling enough. It's really really difficult to be sure about the security of such a single, huge protocol stack that has organically evolved over the years and not been built from the ground up with security in mind. Compared to other wireless technologies, I'd rate Bluetooth as less secure since it's this proprietary single standard that encompasses all layers from physical to application, whereas for instance WiFi has different segregated layers that can be analyzed and replaced independently.

And this is only talking about protocol and possible protocol bugs. Add to this the huge (also single-project) Bluetooth implementations which are riddled of bugs and vulnerabilities; both on the device side ('mini' / 'IoT' type devices are typically less secure due to limited space - so often pure C code with sketchy optimizations) and even the host side. Literally one of the most widely used Bluetooth implementations, BlueZ [2] (besides having an expired TLS certificate) has had numerous attacks; though I'm not sure how many protocol bugs and how many implementation-specific ones.

This is all theory, though. I haven't seen specialized, stealthy Bluetooth attacking devices so far, whereas the aforementioned bad USB cable does exist and is used. So it's hard to say what's more secure in practice, with which device (which BT implementation) and in which security / attack scenario you should use what hardware wallet.

I'd personally go for cable and make sure I use one of my own cables, though. One reason is that when using a cable, you can only be infected when actually plugging the device in, so at the location / time you are trying to use it. However, a Bluetooth device can be infected at any time someone walks nearby as long as it's turned on. An example for this is the BlueBorne attack [3] where you might get infected by simply having a Bluetooth-capable HW wallet in your pocket while walking around town.

So even using Bluetooth-enabled hardware wallets with a cable is less secure than devices that don't have BT at all, due to the larger attack surface.

[1] https://www.bluetooth.com/specifications/specs/core-specification-5-3/
[2] https://www.bluez.org/
[3] https://www.armis.com/research/blueborne/

I know Bluetooth has some security flaws.  I am interested in your input.  In this case, what do you think?  Would you say it is safer to use a Hardware Wallet over Bluetooth connection rather than an unknown or new USB cable?

-
Regards,
PrivacyG

Of course, how else can it communicate if not using the two inner USB wires?

I believe it's an American shop, but these kinds of kits exist in Europe too. Apparently these high quality DIY cables are popular in use with keyboards.

How's the saying? Buy cheap = buy twice - something like that. Exists in many languages interestingly. And if you make it yourself you're also shielded from 'Bad USB cable' attacks [1] and cable implants (though it's a very targeted attack I must admit, so unlikely for majority of people).

What's good about USB-C is that it's backwards-compatible. I found out you can even make your DIY USB-C cables; just only wire up positive, negative and the two data wires.
Here in this shop they sell a kit with PDF instructions [2] where it's clear they give you a USB-C connector with just the 4 classic USB-2.0 pads.


[1] https://mg.lol/blog/badusb-cables/
[2] https://www.zapcables.com/products/diy-usb-cable-kit

Yeah I know.
I think I once tried experiment connecting Trezor device with usb power-only cable, and it didn't work properly

That is a nice find, I am checking it out now.
God knows how much money I wasted on cables in my life, and most of them were terrible quality especially 3.5mm audio cables used for headphones and speakers.
One friend recently wanted to start cable making business for his personal use and for selling, but I think he is busy with other stuff in his life now.
I am not a big fan of USB-C connection (known to create problems and confusion with some laptops) but I guess it's slowly taking over, liked it or not :/

Well, you do need data in most cases, like when using a hardware wallet or a mouse / keyboard, but you can indeed just make a regular USB cable yourself.

But it's a brilliant idea, I really like it! USB plugs of all sizes and materials are sold online (easy to inspect and solder wires to), cables too and you probably just need some solder and a bit of time.
I just found there are even kits [1] sold online with everything you need.
It will not be possible to make a USB-C fast charging one with 12 (or more?) inside wires though, I guess. But you can just use those store-bought and plug them directly into wall bricks.

[1] https://jujucables.com/product/diy-usb-cable-kit/

I would agree with this, but you should also be aware that warranty for most devices would be voided if device was opened, and you could not replace it if malfunction happens.
Opening cables means that you are cutting and destroying them, and you can't use them anymore... I mean you can sort off, but question is how long this frankenstein cable will survive.
Sad fact is that most people won't even notice anything suspicious, unless someone tells them what to look for.

Recently I saw interesting products and topics related with this subject of USB connection with computers, you can always make your own cables and make them power only.

How (and why) to make your own power-only USB cable:
https://www.cultofmac.com/632796/how-and-why-to-make-your-own-power-only-usb-cable/

USB Data Blocker:
https://portablepowersupplies.co.uk/product/usb-data-blocker

Thanks for the video. Really interesting.

But then the cable is broken. And how to distinguish a suspicious board from a legit one? Sure, plain old USB-to-USB cables were just wires, so a silicon chip would stick out - but nowadays with USB-C, Lightning and whatnot, there are usually little circuit boards in the plugs anyway. I reckon it's pretty hard to tell if they're legit or not, even if inspected at a chip level.

It is explained in great detail for instance in this talk: '36C3 - Open Source is Insufficient to Solve Trust Problems in Hardware'
https://www.youtube.com/watch?v=Hzb37RyagCQ

A screencap about one attack method:

This is a good reminder...
Always be careful.
Dont trust, verify. And a good way to verify a cable is to open it. If you see suspicious board -> trash it.

Just a bit of an update since it's been 2 months:
He contacted the comp any and they responded promptly and have been discussing options of how / if it's possible to fix it.

The biggest issue is that it is working as intended and now they are trying to figure out a way to stop a USB device that from behaving like a USB device should.
All without increasing the chance of user error. That was something we did not think of when talking about it. The more steps / checks you put in that a person has to do, the more possibility of said person making a mistake.

Next update when I know more.

-Dave