Hardware Wallets - Key Index Attack

[Lucius]

For a start, I will just emphasize that this is nothing new, but I have been thinking about this type of attack for some time, especially after two cases appeared on the forum in which users reported that after legitimate transaction another illegitimate transaction occurred. What both transactions have in common is that the funds did not move from the address to which they were sent.

A person who has discovered vulnerability (Luke Champine) back in 2018 reported the whole thing to Ledger and Trezor. They released the fix in next firmware, but Luke was not pleased with the way Ledger had done it.

What is it really about?

So the full attack works like this. The user connects their hardware wallet to a compromised computer and opens a desktop app to communicate with the device. Unbeknownst to them, this app has been replaced by a malicious version that looks identical, but behaves differently. When the user clicks the “New Address” button, the malicious app tells the device, “Please give me the address derived from key 2,192,562,109.” When the user receives coins at this address, they’ll get a nasty surprise: the transaction will be confirmed on the blockchain, but the coins won’t show up in their wallet.

Ledger is fix this vulnerability in a way to display warning if key index is not in some normal range, so there is a limit of some 5 million keys - and this should be something that can be done with brute force in case we need to find hidden key index. Ledger is refuse to show key index with every generated address, but Trezor is implemented this feature on a model that was vulnerable (Model T).

In case this happens to someone, which tools are best to try brute force of key index - since user who is lost coins in combination Electrum+Nano S failed to find anything even though it generated millions of addresses?

Regarding Trezor, is it show key index only on device screen when new address is generated, or is possible to see key index of every address in wallet by using their UI?

Sources :

A Ransom Attack on Hardware Wallets
Fraudulent transaction along with the correct one(Ledger Nano S + Electrum)
BTC stolen from Trezor

[HCP]

Theoretically... that attack could be implemented on almost any HD wallet... I don't see how this would be limited to just hardware wallets? You would simply need to create a clone of "OpenSourceHDWallet"™ that generates keys from incredibly large indexes...

Although, if you can trick someone into downloading your malware, it's probably just easier to steal their Bitcoins directly with fake keys/seeds or sending to your own address rather than attempting to go down the ransomware route.



Also, I don't believe that the instance of coin loss in your 3rd reference is related to something like this given the evidence I found...

And in the 2nd reference... it looks like the "missing" coins might have eventually moved in this transaction (some 2 months after the original transaction): https://www.blockchain.com/btc/tx/b89f1fd84eb1c64dd77acbe05625c91438585ecb696cb3debf7033a88995a412

Not sure if that was the original owner or a thief/hacker tho! Or if that was the UTXO from the "bad transaction" as the OP seems to have removed TransactionIDs from and/or deleted posts and hasn't logged in since March... would be interesting to know if it was the OP... and if so, did they figure out where the coins went and how they recovered them??!?

[HCP]

In case this happens to someone, which tools are best to try brute force of key index - since user who is lost coins in combination Electrum+Nano S failed to find anything even though it generated millions of addresses?

Probably just create a Python script that simply starts generating addresses from a specified index... given a seed or xpub. Could probably used parts of btcrecover (or the seedrecovery module in btcrecover) as a starting point.

Then you'd start getting into complicated probability stuff that I don't really understand when it comes to the "generate sequential or random indexes?" argument...

[Lucius]

Although, if you can trick someone into downloading your malware, it's probably just easier to steal their Bitcoins directly with fake keys/seeds or sending to your own address rather than attempting to go down the ransomware route.

Some users are still really easy to cheat in a way to ask them to enter theirs seed in fake Ledger/Trezor site, or in a way to download fake wallet/browser extension. The ransomware attack is a bit more sophisticated though, and could fool even the more experienced users - but such an attack does not have to have the sole purpose of reaching the user's BTC, but can only be carried out to harm someone out of pure malice.

Also, I don't believe that the instance of coin loss in your 3rd reference is related to something like this given the evidence I found...

And in the 2nd reference... it looks like the "missing" coins might have eventually moved in this transaction (some 2 months after the original transaction): https://www.blockchain.com/btc/tx/b89f1fd84eb1c64dd77acbe05625c91438585ecb696cb3debf7033a88995a412

Not sure if that was the original owner or a thief/hacker tho! Or if that was the UTXO from the "bad transaction" as the OP seems to have removed TransactionIDs from and/or deleted posts and hasn't logged in since March... would be interesting to know if it was the OP... and if so, did they figure out where the coins went and how they recovered them??!?

I agree that both cases leave reasonable doubt, each in its own way - and the question is whether we will ever find out what really happened. It is possible that in both cases the seed is actually compromised, or that it is a specific vulnerability that we do not yet know about.

In case this happens to someone, which tools are best to try brute force of key index - since user who is lost coins in combination Electrum+Nano S failed to find anything even though it generated millions of addresses?

Probably just create a Python script that simply starts generating addresses from a specified index... given a seed or xpub. Could probably used parts of btcrecover (or the seedrecovery module in btcrecover) as a starting point.

Then you'd start getting into complicated probability stuff that I don't really understand when it comes to the "generate sequential or random indexes?" argument...

If you have trouble doing this, then imagine other users who should brute force their key index if a hacker is hide their coins. But most importantly, there is a possibility that the situation can be fixed if something like this really happens to someone - and most of us still think that hardware wallet is a device that cannot be manipulated in this way, which is obviously wrong thinking.