Entendi e não entendi..
Entendi que a seed é igual para todas moedas porém não entendi como o atacante pode enganar a vítima para assinar a transação de uma moeda diferente da que estiver "logado"..
a ledger explica aqui. Mas sinceramente nao entendi muito bem, e pelo q eu entendi a vulnerabilidade nao permite roubar moedas.
https://donjon.ledger.com/lsb/014/Summary
The Ledger Nano S and Nano X are Hierarchical Deterministic (HD) wallets, meaning that they can derive different cryptographic secrets from a single seed. As written in the Threat Model, apps can derive keys on their own HD path only, which ensures that cryptocurrency apps cannot use keys from each other. For instance, the Zcoin app cannot derive keys on the Dogecoin derivation path (m/44'/3'/), since its own derivation path is m/44'/128'/.
This path restriction was not enforced for the Bitcoin app and most of its derivatives, allowing a Bitcoin derivative (eg. Litecoin) to derive public keys or sign Bitcoin transactions.
O atacante teria que ter a chaves privadas da litecoin, pelo q eu entendi.
O maior problema em "consertar" seria isso:
Enforcing the restriction to one or multiple paths for each coin type is actually a tough topic because:
Some third party software wallets use incorrect derivation paths. This is a specific concern for older coins using third party wallets based on Electrum (Dogecoin, Litecoin, Dash, etc.)
Some BTC forks use the same derivation path as BTC. If we prevent these forks from using the BTC derivation path, this would simply prevent users from using the Ledger Nano S/X with these forks.
Mas, no final eles optaram por bloquear derivation paths incomuns, mesmo com o risco de quebrar funcionalidades em outras moedas:
In order to allow users to continue to use their Ledger Nano S/X seamlessly with any third party software wallet, this fix doesn’t enforce this verification from the OS though, which means that the --path parameter is still empty. We might add an exhaustive path list in the future if we are sure it doesn’t break any other wallets.
