Trezor One 1.8.0 fixes glitching attacks that read the seed from memory

At the 35C3 conference on 27 December 2018 the wallet.fail researchers showed they could flash a Trezor One and read its seed and PIN from RAM; Bitcoin Magazine reports the attack only works against users without a passphrase. Trezor’s CTO said the company had not been informed through its responsible disclosure programme beforehand and would address the issues in a firmware update at the end of January.

On 6 March 2019 Colin O’Flynn published a second technique that he says he disclosed to Trezor in January 2019. It uses electromagnetic fault injection, aimed through the closed case at a device in bootloader mode, to defeat a length check in the USB descriptor handler so the device returns far more memory than requested, including the stored seed. O’Flynn states that a password-protected seed cannot be dumped this way and that opening the case is not required.

Trezor’s list of past security issues records both as fixed in Trezor One firmware 1.8.0: an SRAM dump via glitching the firmware update (reported 27 December 2018 by wallet.fail) and a secret information leak via USB descriptors (reported 2 January 2019 by Colin O’Flynn, rated high, also fixed in Model T firmware 2.1.0). Trezor’s disclosure post of 6 March 2019 describes all three issues fixed in Trezor One 1.8.0 (released 27 February) and Model T 2.1.0, including a side-channel analysis of the PIN comparison reported by Charles Guillemet of Ledger Donjon on 31 October 2018. Trezor states that the Model T was not directly affected by any of them and received the same protections as a precaution; that the SRAM dump likely affects ARM Cortex-M3 chips from all vendors; that every attack requires physical access and specialised hardware; that passphrase users are unaffected unless they disclosed the passphrase; and that there was no evidence any of them had been exploited outside the lab.