Malware could swap Ledger receive addresses shown on the computer screen

In early February 2018 a proof of concept showed that malware on a computer could change the receive address that Ledger’s Chrome applications displayed. According to The Next Web, the receive address was generated by JavaScript running on the host computer, and malware without administrator rights could replace that code so that all future deposits went to the attacker. Cointelegraph reported that more than one million Ledger users could be exposed to this attack vector.

The Next Web attributes the findings to a vulnerability report published on DocDroid, whose authors had contacted Ledger about a month earlier. Ledger’s own post says researchers published the demonstration, while Cointelegraph described the disclosure as a report released by Ledger on 3 February 2018. On that day Ledger posted on Twitter advising users to always verify the receive address on the device screen, using the monitor button in the receive dialog.

In a blog post dated 5 February 2018, Ledger states that this is not a Ledger security flaw, that users are not at risk as long as they verify the new receive address on the device, and that it knew of no user who had lost coins this way. Ledger says it released an update to the Ledger Wallet Bitcoin Chrome application that asks users to verify the address on the device, with the ETH and XRP apps to follow. According to The Next Web, Ledger said the issue cannot be solved in the absolute because malware can always change what a computer screen shows, and described it as an issue for all hardware wallets.

What Ledger advises:

• Verify every receive address on the device screen before sharing it.
• Treat the hardware wallet’s screen as the only trusted display.
• Update the apps on the device to the latest version.