Even air-gapped wallets aren't safe... - page 2.

NeuroticFish

legendary

Activity: 3668

Merit: 6382

Looking for campaign manager? Contact icopress!

Quote from: HCP on April 24, 2018, 07:45:31 AM

NOTE: before you get tooooo paranoid, these attacks all require that the cold storage device is compromised.

This is more like a proof of concept than something we can see too often in the wild.
OK, a bad linux distro can do that. Or a compromised clone of the wallet. And I expect that people that start to setup a PI has that much common sense to check this.
So I don't really see how this infection could happen, really.

However, I see it as a fun-to-watch experiment. Thanks for sharing.

bitmover

legendary

Activity: 2352

Merit: 6089

bitcoindata.science

Quote from: HCP on April 24, 2018, 07:45:31 AM

NOTE: before you get tooooo paranoid, these attacks all require that the cold storage device is compromised.

I think this is the most important thing about cold storage, hardwallets, etc.
People buy hardwallets a little cheaper from third party seller, compromising security.

Anti-Cen

member

Activity: 210

Merit: 26

High fees = low BTC price

Quote from: Spendulus on April 24, 2018, 12:31:20 PM

If the goal is to move funds every day, more careful study of the problem would be called for.

Lead mate, you need lead because I have picked up stories (might not be true yet) that they can
re-flash some chips from a distance which from my understanding of electronics seems quite possible.

OK Mr Moderator, I am safe for the next ten seconds and like to keep you on your toes in them nazi boots
you are wearing.

cellard

legendary

Activity: 1372

Merit: 1252

It's a really unrealistic scenario. You shouldn't be taking off your raspberry pi/airgapped laptop out of your house ever, you should only open it when there are no cameras around. If there are phones are around, there are cameras around too... and you can assume someone has recorded you entering your wallet password and so on, so why would you go out with your cold storage device.

Just keep it at home safe, use QR codes to move your pre-signed transactions into the hot node to broadcast it safely and you should be ok. If you want to go insane mode, you can buy a faraday cage tent and only turn on the computer inside.

Spendulus

legendary

Activity: 2926

Merit: 1386

Quote from: Anti-Cen on April 24, 2018, 10:47:00 AM

Before I reply I would like to say that the ministry of Bitcoin propaganda runs this forum and keeps removing posts.

I looked into these air-gap bridges and you can download apps from play store that produce spectra graphs and you can
even send and receive cartoon like images using nothing more than sound.

Turns out that some TV adverts are using sound to communicate with apps ruining on "Smart Phone" so this is not science
fiction and is fact.

Developers should keep away from using any microsoft blackbox code and the same goes for google android code that's
all over our phones because "They" are years ahead of where we think they are when it comes to steeling our data.

The whole concept of "air gapped" is that the machine is usually, typically, 99% of the time turned off. If the design goal is to move coins only at the 5th year and the 10th year for one day each, I think it's reasonably safe.

If the goal is to move funds every day, more careful study of the problem would be called for.

Anti-Cen

member

Activity: 210

Merit: 26

High fees = low BTC price

Before I reply I would like to say that the ministry of Bitcoin propaganda runs this forum and keeps removing posts.

I looked into these air-gap bridges and you can download apps from play store that produce spectra graphs and you can
even send and receive cartoon like images using nothing more than sound.

Turns out that some TV adverts are using sound to communicate with apps ruining on "Smart Phone" so this is not science
fiction and is fact.

Developers should keep away from using any microsoft blackbox code and the same goes for google android code that's
all over our phones because "They" are years ahead of where we think they are when it comes to steeling our data.

hatshepsut93

legendary

Activity: 3024

Merit: 2148

Quote from: HCP on April 24, 2018, 07:45:31 AM

An interesting article on ArsTechnica today: https://arstechnica.com/information-technology/2018/04/new-hacks-siphon-private-cryptocurrency-keys-from-airgapped-wallets/

Seems the "hackers" have found a number of methods for exfiltrating information from air-gapped machines... Shocked

I especially like the usage of GPIO pins on a RaspberryPi to generate radio waves! Cool

The recommendation for protecting from these attacks? Essentially it involves putting your cold storage device in a faraday cage! Shocked

NOTE: before you get tooooo paranoid, these attacks all require that the cold storage device is compromised.

These concepts are not new, spy agencies and expert hackers have a lot of methods for stealing data from air-gapped machines, but they are very complicated and require some complex setup, so it's very unlikely that someone with this level of expertise would target private users. Big targets like exchanges should be the ones who must be worried about such attacks, especially with the risks of rogue employees helping those hackers by installing some devices or software.

HeRetiK

legendary

Activity: 3122

Merit: 2178

Playgram - The Telegram Casino

Quote from: HCP on April 24, 2018, 07:45:31 AM

NOTE: before you get tooooo paranoid, these attacks all require that the cold storage device is compromised.

That's the important bit

Not getting your system compromised is one of the reason you air gap them in the first place. The other thing is that this also means that hardware wallets are not affected by this attack, so hooray for hardware wallets!

Quote from: Kprawn on April 24, 2018, 10:14:48 AM

Physical access to a device will always be a problem. Some guys even found ways to extract private keys from a Trezor a

while ago, albeit with special tools.

Trezor bugs are usually fixed swiftly, but some guys even found ways to extract private keys from Bitcoiners a while ago, albeit with special tools:

https://cointelegraph.com/news/man-robbed-at-gunpoint-for-1100-worth-of-bitcoins-in-brooklyn
https://cointelegraph.com/news/russia-blogger-who-boasted-about-crypto-wealth-beaten-and-robbed-for-425k
https://www.express.co.uk/finance/city/910958/Bitcoin-ripple-ethereum-UK-robbery-cryptocurrency-armed-thugs-oxfordshire-news-latest

Physical access is not just a technological problem, unfortunately.

Quote from: Kprawn on April 24, 2018, 10:14:48 AM

[...] and after I printed them, I physically destroyed the hardware. {crushed & melted it} [...]

I like your style Grin

Kprawn

legendary

Activity: 1904

Merit: 1074

Physical access to a device will always be a problem. Some guys even found ways to extract private keys from a Trezor a

while ago, albeit with special tools. I created 1000s of Paper wallets on a cheap old notebook and printer and after I printed

them, I physically destroyed the hardware. {crushed & melted it} A cheap setup like that, will not cost you more than $200.

ranochigo

legendary

Activity: 3038

Merit: 4418

Crypto Swap Exchange

Nice concept. It seems like the main point is that cold storage isn't safe when someone else has access to it. It seems like that would be the same with every wallet (ahem Ledger), hardware wallet or not. The whole attack hinges on the designing of the malware and I'm not sure how easy it would be.

The best precaution when using fully air gapped method is to just secure it in a safe, since malware attacks won't really be viable.

HCP

legendary

Activity: 2086

Merit: 4361

An interesting article on ArsTechnica today: https://arstechnica.com/information-technology/2018/04/new-hacks-siphon-private-cryptocurrency-keys-from-airgapped-wallets/

Seems the "hackers" have found a number of methods for exfiltrating information from air-gapped machines... Shocked

I especially like the usage of GPIO pins on a RaspberryPi to generate radio waves! Cool

The recommendation for protecting from these attacks? Essentially it involves putting your cold storage device in a faraday cage! Shocked

NOTE: before you get tooooo paranoid, these attacks all require that the cold storage device is compromised.

Topic: Even air-gapped wallets aren't safe... - page 2. (Read 654 times)