Ledger Bitcoin app accepted a hidden change output without confirmation

Ledger’s security bulletin LSB-004 describes a flaw in the Bitcoin app for the Ledger Nano S that let an attacker add an unverified change output to a transaction, which, according to Ledger, could lead to sending funds to an arbitrary address without an additional confirmation on the device. Ledger notes that the original transaction still had to be confirmed by the user.

Sergey Lappo, then at Mycelium, writes that he found the problem in November 2018 while adding SegWit support to Mycelium’s Android wallet. According to his write-up, the device did not check whether change went to a change address at all and hid the second output when an empty change path was passed. A compromised wallet application could therefore show the user only a small payment while a hidden second output sent funds to the attacker. The attacker needs to control the wallet software talking to the device; Lappo’s demonstration used a modified Mycelium build that was never published.

Lappo reported the issue through Ledger’s bug bounty programme. He writes that a fix was released in December 2018 and firmware including the new Bitcoin app in January 2019. Ledger announced Nano S firmware 1.5.5 on 16 January 2019 with a critical security fix in the Bitcoin app reported by Mycelium, crediting Lappo. LSB-004 names Bitcoin app 1.3.3 and firmware 1.5.5 as fixed. Lappo published his write-up on 21 February 2019. The bulletin itself is dated 11 November 2018, which is earlier than the fix dates in Lappo’s account.

What Ledger advises:

• Update to Nano S firmware 1.5.5 or Bitcoin app 1.3.3 or later.