Topic: Is the Nano Ledger safe? (Read 1069 times)

SECURITY

Ledger Receive Address Attack

https://www.docdroid.net/Jug5LX3/ledger-receive-address-attack.pdf


Overview
Crypto wallets consist of a private key for spending funds, and a public key for receiving funds.
Modern Crypto clients usually create a new receive address after every transaction.
This is done to better protect the privacy of the user, by spreading his funds across multiple addresses,
rather than one.
Receive addresses are normally generated automatically and are transparent to the wallet owner.
The Attack
Ledger wallets generates the displayed receive address using JavaScript code running on the host
machine.
This means that a malware can simply replace the code responsible for generating the receive address
with its own address, causing all future deposits to be sent to the attacker.
Because receive addresses are consistently changing as part of the usual activity of the wallet, the user
has no trivial way (like recognizing his address) to verify the integrity of the receive address.
As far as he knows, the displayed receive address is his actual receive address.
What Makes This Even Worse
-  All the ledger wallet software is located in the AppData folder, meaning that even an
unprivileged malware can modify them (no need to gain administrative rights).
-  The ledger wallet doesn’t implement any integrity-check/anti-tampering to its source files,
meaning they can be modified by anyone.
-  All the malware needs to do is replace one line of code in the ledger software, this can be
achieved with less than 10 lines of python code.
-  New ledger users would typically send all their funds to the wallet once initialized.
If the machine was pre-infected, this first transaction may be compromised causing the user to
lose all of his funds.
-  The attack changes the receive address during its generation, causing even the automatically
generated QR to be updated to the attacker’s address. Meaning that both the string and QR
representations of the address are compromised.
Proof of Concept
Open the file:
C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User
Data\Default\Extensions\%EXTENSION_ID%\%EXTENSION_VERSION%\src\wallet\wallet.js
Replace the line:
return (_ref = this.wallet.cache) != null ? _ref.get(this.getCurrentPublicAddressPath()) : void 0;
With:
return “MY_MALICIOUS_ADDRESS”;
The next time you receive funds, all the funds will be sent to MY_MALICIOUS_ADDRESS.
Mitigation
Un undocumented feature, that isn’t even part of the official “Receiving BTC to your Ledger” article, can
in some cases help verify the integrity of the receive address.
On the bottom right part of the receive screen, a small monitor button exists. Pressing this button will
cause the receive address to show up on the hardware wallet’s screen.
This can be used to verify that the address is valid and has not been tampered.
Note that this process is not part of the default receive process, and is not enforced by the wallet.
A proper solution would be to enforce the user to validate the receive address before every receive
transaction, just like the wallet enforces the user to approve every send transaction.
Also, this undocumented feature only exists in the Bitcoin App.
The Ethereum App (and possibly other apps as well) has no mitigation, the user has no way to validate if
the receive address has been tampered.
Advice for Existing Ledger Customers
If you’re using the Bitcoin App – Before every receive transaction validate the integrity of the address
using the monitor button.
If you’re using the Ethereum App – Treat the ledger hardware wallet the same as any other software-
based wallet, and use it only on a Live CD operating system that is guaranteed to be malware-free. At
least until this issue receives some kind of fix.
Responsible Disclosure
Unfortunately, Ledger doesn’t have an organized vulnerability disclosure program.
Nonetheless we contacted the CEO and CTO of Ledger directly in order to privately disclose and fix the
issue. We’ve received a single reply, asking to hand over the attack details. Since then all our mails have
been ignored for 3 weeks, finally receiving an answer that they won’t issue any fix/change.
Timeline:
4, January, 2018 – First contact with general information.
4, January, 2018 – CTO of Ledger requested the full details of the vulnerability.
4, January, 2018 – Full Details were sent.
10, January, 2018 – We’ve requested an update, no response.
13, January, 2018 – Again, we’ve requested an update, not response.
27, January, 2018 – CTO of Ledger replies that no fix/change would be done (our recommendation to
enforce the user to validate the receive address has been rejected), but they will work on raising public
awareness so that users can protect themselves from such attacks.


http://cryptorus.info/ledger-addresses-man-in-the-middle-attack-that-threatens-millions-of-hardware-wallets/

That's why ebay is not safe and not recommended store in buying any item/s related to Bitcoin/Crypto wallets. They might be cheaper than the actual price but the consequence is the box might have tampered like the image posted above etc. People should buy ledger HW to its main site or it's retailers stores which can be seen here https://www.ledgerwallet.com/retailers, I bought one from COINZIN.COM and I received it after a month.

Unless you're buying straight from Ledger there is always the risk of getting a tampered Ledger wallet, even if it's from the Ledger amazon store. If you set up the Ledger as it should be set up you should be fine, always initialize a new seed once receiving your device and if you see a card like this somewhere in the Ledger box immediately get the product refunded. This is an obvious sign of a tampered box at  the minimum.

Yes, but do not buy used wallets. I heard stories about bad experience with wallets from ebay.

Yes, it is very safe for storing your bitcoins there. As it is a hardware wallet, you will be in charge of your private keys, and it's like you own them. As every hardware wallet have their problem, be careful not misplacing it, not breaking it, as it looks really like an USB drive.

Well, currently it is safe.

But there is always a small chance that the manufacturer has bugged the device, have a backdoor to the private key etc. So really, in my opinion at least a cold storage wallet is only going to be as trustworthy as the manufacturer. But this does not apply only to hardware wallets, some people think that NSA has backdoors to your laptop that cannot be removed and if this was the case then your coins wouldn't be safe either.

Thing is that there is no absolute "safe" method of storing your bitcoins. There are infinite amounts of possibilities as to how your coins can be stolen. You can only compare the safety of two methods, and decide which one is safer.

Nano Ledger is safer than i'd say 99% of other ways of storing your coin. But is it worth the money? Up to you to decide.

ledger is safe, but much people want it
you can buy now and item shipped (now) at 15 september

if you buy trezor, company shipped now

I've read so many positive reviews about that wallet and its type from the other sites and mostly here in bitcointalk in terms of security, reliability, its functions etc . Probably most people here know Nano Ledger and they'll say it is safe including me based on my knowledge about that kind of wallet .

People looking to buy hardware wallets obviously do that for the security of the coins they plan to hodl for long periods. In this case the convenience that other wallets may offer don't matter.

Best thing of the Ledger Nano is that when you are going through a recovery process, you are doing everything on the device itself, where other hardware wallets require you to use a computer.

I just wonder why you at first mentions that the Ledger Nano is one of the safest hardware wallets, but then ask OP if he is really needs it. Why does one choose a hardware wallet in the first place, oh yes, security!

Yep. Ledger Nano is one of the safest hardware wallet I ever know.
Still you need to ask yourself do you really need it? For example for small transaction is much more practical to have a mobile wallet, loaded with just small amount.

Wow that's great! ... I hope I can get one.

Yes, The Ledger Nano is a hardware wallet and it is safe to use for storing your bitcoins on it, you can basically bring it everywhere with you too whenever you go travelling for holidays, I have purchased one for myself too and I have never had any issue using it.

Wow nice.. I have plan to buy this thing.

Passphrase support is additional security for your recovery phrase which can make your wallet more secure. This feature will be added in Ledger Nano S soon and you can read the entire review of this wallet here: https://www.buybitcoinworldwide.com/wallets/ledger-nano-s/


Also, take note of the shipping charges. Better to buy from Amazon rather than the website as if you don't reside near the warehouse from where they ship the product, the shipping would be double the amount of the wallet. Amazon sells it at a cheaper rate.

Thanks for the recommendations Sir.

What does it mean that it lack of support for passphrases?

Thanks for the ans

Yes it is very safe, all hardware wallets like Trezor and Nano Ledger are all safe and you feel safe because you are the ones who's keeping the private keys. In fact everyone should be required to use this if they can afford to buy one for the safety of your bitcoins and altcoins.

nano ledger hardware wallet is the best wallet you can buy with high security feature but there is a word of caution buy directly from the manufacturer not from a third party reseller or something that made in china, for safety purposes, we don't know if there's a logger or something spying malware embedded on that chip that can steal your private key the moment you re-plugged it on an online pc and transmit that data on their server and collect some private keys. that sounds theoretical but can be possible IMHO. so buy only to original manufacturer.

I recommend you to buy it only in the official website.

https://www.ledgerwallet.com/products/ledger-nano-s

If you buy from somewhere else there are always risks involved as the seller may have done some bad tricks. If you buy directly from the producer, nothing bad can happen as the producer will not make his reputation at stake.

Don't forget to download the latest app for this wallet which can be found here.

https://www.ledgerwallet.com/apps/ripple

Where can you recommend to buy this?
Thanks!