Quote
Unfixable Seed Extraction on Trezor - A practical and reliable attack
TL;DR
An attacker with a stolen device can extract the seed from the device. It takes less than 5 minutes and the necessary materials cost around 100$. This vulnerability affects Trezor One, Trezor T, Keepkey and all other Trezor clones. Unfortunately, this vulnerability cannot be patched and, for this reason, we decided not to give technical details about the attack to mitigate a possible exploitation in the field. However SatoshiLabs and Keepkey suggested users to either exclude physical attacks from their threat model, or to use a passphrase.
Context
The Donjon, Ledger’s security team, recently spent some time and resources to analyse the security of hardware wallets. Our goal is to raise the bar for security in the ecosystem. This blogpost is part of a series - cf Extracting seeds.
The Trezor-based hardware wallets were part of our evaluation targets. We found these devices to be especially interesting since the firmware is open source. The chip itself is closed source as well as the low-level functions hidden in the flash.
https://ledger-donjon.github.io/Unfixable-Key-Extraction-Attack-on-Trezor/TL;DR
An attacker with a stolen device can extract the seed from the device. It takes less than 5 minutes and the necessary materials cost around 100$. This vulnerability affects Trezor One, Trezor T, Keepkey and all other Trezor clones. Unfortunately, this vulnerability cannot be patched and, for this reason, we decided not to give technical details about the attack to mitigate a possible exploitation in the field. However SatoshiLabs and Keepkey suggested users to either exclude physical attacks from their threat model, or to use a passphrase.
Context
The Donjon, Ledger’s security team, recently spent some time and resources to analyse the security of hardware wallets. Our goal is to raise the bar for security in the ecosystem. This blogpost is part of a series - cf Extracting seeds.
The Trezor-based hardware wallets were part of our evaluation targets. We found these devices to be especially interesting since the firmware is open source. The chip itself is closed source as well as the low-level functions hidden in the flash.
habe irgendwie keinen anderen passenden Faden gefunden
