wallet.fail at 35C3: Ledger Nano S MCU firmware and Ledger Blue PIN side channel

On 27 December 2018 Thomas Roth, Dmitry Nedospasov and Josh Datko presented “wallet.fail” at the 35th Chaos Communication Congress (35C3) in Leipzig, covering attacks on several hardware wallets, including the Ledger Nano S and the Ledger Blue.

On the Nano S, the researchers flashed custom firmware onto the non-secure STM32 microcontroller (MCU) through its programming interface, bypassing a protection that blocked writes to a memory region, and showed it running a game of Snake. According to Bitcoin Magazine, the attack scenario combined physical access to the device with malware on the victim’s computer, waiting for the victim to enter the PIN and open the Bitcoin app, after which transactions could be signed. On the Ledger Blue, Roth used an antenna and software-defined radio to capture emanations produced during PIN entry and a machine-learning model to classify key presses; Threatpost reports he recovered the PIN about 90 percent of the time, at close range.

Ledger’s bulletin LSB-005 credits Juliano Rizzo (Coinspect) and, independently, Nedospasov, Datko and Roth with an MCU bootloader signature-verification bypass on the Nano S, and concludes it has no security consequence: it allows nothing beyond what JTAG already permits, the Secure Element checks that the MCU firmware is genuine, and the MCU has no access to the PIN or seed. In its blog response of 28 December 2018, Ledger states that the bug is fixed in the next firmware version, calls the Blue side channel impractical because it requires measurement at very close range with device, receiver and USB cable kept in the same position, and says the researchers did not extract any seed or PIN from a stolen device. Ledger states that a randomized PIN keyboard was already on the Nano S and was scheduled for the next Ledger Blue firmware update.

Ledger also states that the researchers did not follow responsible disclosure through its bug bounty programme. Neither Ledger’s bulletin nor its blog post names firmware version numbers for the fixes.