~
Yes. When I open the Chrome app, conect and unlock my Nano, the screen briefly shows "Checking if the device is genuine" or something like this. The methods in the article are just a way of checking it directly. 
Topic: How to verify the security integrity of the Ledger Nano S? (Read 107 times)
I don't think checking the hardware isn't necessary. But yea, I understand if you want to be very very sure.
Correct me if I'm wrong, but wouldn't the Ledger chrome plugin know if you're using a genuine product or not? Quote from https://blog.ledger.co/2015/03/27/how-to-protect-hardware-wallets-against-tampering/
Correct me if I'm wrong, but wouldn't the Ledger chrome plugin know if you're using a genuine product or not? Quote from https://blog.ledger.co/2015/03/27/how-to-protect-hardware-wallets-against-tampering/
Quote
How does it work?
The Ledger Wallet Chrome application sends a random value to the Nano as a challenge. The Nano then signs this random value + the firmware version, using an embedded private key shared by some batches.
The Chrome app knows the public key and can verify the signature.
If an attacker switched the Nano with a replica running a rogue firmware, it wouldn’t pass the attestation test and would immediatly be rejected as non genuine.
There is absolutely no way that an attacker could replace the firmware and make it pass attestation, without knowing the Ledger private key.
The Ledger Wallet Chrome application sends a random value to the Nano as a challenge. The Nano then signs this random value + the firmware version, using an embedded private key shared by some batches.
The Chrome app knows the public key and can verify the signature.
If an attacker switched the Nano with a replica running a rogue firmware, it wouldn’t pass the attestation test and would immediatly be rejected as non genuine.
There is absolutely no way that an attacker could replace the firmware and make it pass attestation, without knowing the Ledger private key.
You mean that the Chrome apps can verify the device integrity when I plug it in? Wow I didnt know that. I am really learning a lot from this great community...Thanks
1. Install Python on your computer.
2. Open your terminal/cmd and run:
3. Then, run:
On firmware 1.3.1 or below
On firmware 1.4.1 and above
It will output either your device is genuine or not.
2. Open your terminal/cmd and run:
Code:
pip install --no-cache-dir ledgerblue
3. Then, run:
On firmware 1.3.1 or below
Code:
python -m ledgerblue.checkGenuine --targetId 0x31100002
On firmware 1.4.1 and above
Code:
python -m ledgerblue.checkGenuine --targetId 0x31100003
It will output either your device is genuine or not.
Ok ... I will try this
I don't think checking the hardware isn't necessary. But yea, I understand if you want to be very very sure.
Correct me if I'm wrong, but wouldn't the Ledger chrome plugin know if you're using a genuine product or not? Quote from https://blog.ledger.co/2015/03/27/how-to-protect-hardware-wallets-against-tampering/
Correct me if I'm wrong, but wouldn't the Ledger chrome plugin know if you're using a genuine product or not? Quote from https://blog.ledger.co/2015/03/27/how-to-protect-hardware-wallets-against-tampering/
Quote
How does it work?
The Ledger Wallet Chrome application sends a random value to the Nano as a challenge. The Nano then signs this random value + the firmware version, using an embedded private key shared by some batches.
The Chrome app knows the public key and can verify the signature.
If an attacker switched the Nano with a replica running a rogue firmware, it wouldn’t pass the attestation test and would immediatly be rejected as non genuine.
There is absolutely no way that an attacker could replace the firmware and make it pass attestation, without knowing the Ledger private key.
The Ledger Wallet Chrome application sends a random value to the Nano as a challenge. The Nano then signs this random value + the firmware version, using an embedded private key shared by some batches.
The Chrome app knows the public key and can verify the signature.
If an attacker switched the Nano with a replica running a rogue firmware, it wouldn’t pass the attestation test and would immediatly be rejected as non genuine.
There is absolutely no way that an attacker could replace the firmware and make it pass attestation, without knowing the Ledger private key.
1. Install Python on your computer.
2. Open your terminal/cmd and run:
3. Then, run:
On firmware 1.3.1 or below
On firmware 1.4.1 and above
It will output either your device is genuine or not.
2. Open your terminal/cmd and run:
Code:
pip install --no-cache-dir ledgerblue
3. Then, run:
On firmware 1.3.1 or below
Code:
python -m ledgerblue.checkGenuine --targetId 0x31100002
On firmware 1.4.1 and above
Code:
python -m ledgerblue.checkGenuine --targetId 0x31100003
It will output either your device is genuine or not.
If you buy a ledger Nano from a reseller, You would have to make sure 101% that the device is not tampered with.
So I found an article on the Ledger website that explains it https://ledger.zendesk.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-
A really great article it is, but this guide is hard to follow entirely. There are four steps in the article. The first step which is to open the device up to verify that no additional chip has been added was simple to follow. But then the other steps got me completely confused with all the info, commands, codes...
Someone please help with guidelines on how to follow these steps.
So I found an article on the Ledger website that explains it https://ledger.zendesk.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-
A really great article it is, but this guide is hard to follow entirely. There are four steps in the article. The first step which is to open the device up to verify that no additional chip has been added was simple to follow. But then the other steps got me completely confused with all the info, commands, codes...
Someone please help with guidelines on how to follow these steps.
Jump to: