OneKey Hardware Wallet HACKED!

[dkbit98]

Another day and another hardware wallet hacked, this time it was open source device OneKey, biggest manufacturer of hardware wallets in China.
OneKey was forked from original Trezor code and they added secure element ATECC608A, but they obviously didn't do a good job with that, as it was explained in this short video clip.

This vulnerability was discovered by company called Unciphered, known for helping people unlock their crypto wallets, and for this job they received $10,000 bug bounty reward from OneKey.
Seed phrase was easily extracted by doing man in the middle attack, and inserting chip between processor and secure element, after that it took only one second to extract all seed words.
It's important to say that this bug is now fixed with firmware update, but problem is that many hardware wallets available today share the same code (based on Trezor) so they could also be affected.


Video by Unciphered: https://www.youtube.com/watch?v=b8OrakRJmHE

Eric Michaud, the founder of Unciphered said that hardware wallets can often times give people a false sense of security, thinking that wallet can't be hacked.
He also said that there could be a problem with many other hardware wallets because manufacturers recycle the same code base for their products.
Article about this was first released on Fortune Crypto website:
https://archive.is/S1Nwo

OneKey released official reply on their blog page, and they said how these attacks cannot be exploited remotely, and attackers need to have physical access to device.
It's interesting to see them claiming how other ''world-renowned hardware vendors'' had similar problem but they didn't say anything about it, because they are not open source (Ledger comes to my mind first).
They plan to improve security for future devices by introducing EAL6+ higher level of security, but I would be careful with their devices in future.
https://archive.ph/1qg0h

Good thing about this bug was that nobody lost any coins, because evil hackers didn't found out first about it, but it's a good reminder to everyone, don't blindly trust any device just because it is open source and it has secure element.
Don't trust, verify.

[Charles-Tim]

Good thing about this bug was that nobody lost any coins, because evil hackers didn't found out first about it, but it's a good reminder to everyone, don't blindly trust any device just because it is open source and it has secure element.
Don't trust, verify.

If possible passphrase is not stored on the wallet it is a good thing to go for while using a hardware wallet. That will give me the feeling of thinking that even if my seed phrase is known, I have different keys that the seed phrase can not generate without the passhrase.

[dkbit98]

If possible passphrase is not stored on the wallet it is a good thing to go for while using a hardware wallet. That will give me the feeling of thinking that even if my seed phrase is known, I have different keys that the seed phrase can not generate without the passhrase.

It's true that passphrase is not stored anywhere on device but there are still methods to crack them especially if they are weak, so this is not a perfect protection.
Good thing about this bug is that it could be fixed with software patch, but it shows that it's not enough just to put one or two secure elements and consider device secure enough.
I am more interested to find what other closed source wallets had the same issue like this, Unciphered certainly knows about this but they can't release it in public because of NDA from manufacturer.
 

[SFR10]

and for this job they received $10,000 bug bounty reward from OneKey.

Based on what I'm seeing under the "Bug Severity and Bounties" part of OneKey's program, I believe it means they were dealing with more than a single bug ^{[perhaps we're not seeing the whole picture]}!

but it's a good reminder to everyone, don't blindly trust any device just because it is open source and it has secure element.
Don't trust, verify.

You have a point, but the main issue is the fact that an average joe like me, doesn't have the necessary skills & knowledge to deal with such cases ^{[unfortunately]}.

[Hispo]

I would have not expected these news to come from China, to be honest. In my eyes, China is kinda a black hole if we talk about Bitcoin technology, gadgets, wallets and other tools. Still, I am glad the good guys this time received a bounty for responsibly disclosing this failure. We need to see more of it in this space.

Also, If I recall correctly Trezor wallets have a similar problem with physical attacks, back in the day after the Kraken video about that vulnerability, Satoshilabs suggested the use of a passphrase to mitigate the risk. Cannot all the Trezor based wallets do the same?

[Charles-Tim]

Also, If I recall correctly Trezor wallets have a similar problem with physical attacks, back in the day after the Kraken video about that vulnerability, Satoshilabs suggested the use of a passphrase to mitigate the risk. Cannot all the Trezor based wallets do the same?

Like for Trezor to release an update to eliminate the risk? Trezor is not having a secure element which makes it impossible to eliminate the risk of a physical attack to not be able to reveal Trezor wallet seed phrase.

[m2017]

Oh, this eternal struggle of the sword and shield - one creates protection, the other breaks it.

There is no perfect protection or safe way to store crypto. Everywhere has its own nuances and peculiarities. Hardware wallet have them as well. It is an ideal device in terms of online security due to the need to physically confirm the transaction by pressing a button, but has the disadvantages of physically accessing the device. The video confirms this, as well as many other cases when various HW were hacked.

And so, one vulnerability was patched, but how many more will be found over time? Who will use them first, a bounty hunter or an evil hacker? How many devices will hackers gain access to when a new hack is discovered?

It seems to me that the consequences of such hacks are overestimated. Hardware wallet continue to protect the security of crypto assets million users (online). For this it are needed. And if the attackers have gained physical access to HW, then it will no longer matter whether they use the help of a hacker or a $5 wrench attack.

[DaveF]

HW wallet manufactures are also kind of stuck in a loop. NOT picking on any one here, even OneKey, more in general.

If I create the BEST and MOST SECURE hardware wallet on the planet. BUT I make it all closed source and remove all marking from all the chips so you can't see what they are. And then figure out a way for them to all self destruct when tampered with I am going to sell just about none. Because there could never be any proof since it would all be a black hole and nobody could trust it. So, we have open source products with off the shelf parts and have to deal with the fact that the bad guys have now have a perfect knowledge of what we are doing and how we are doing it and can work from there to figure it out.

Not saying there is a better or worse way, but this is what it is and we as a group have to accept it and be able to help others understand the risks and how to mitigate them and possible fixes.

-Dave

[dkbit98]

Based on what I'm seeing under the "Bug Severity and Bounties" part of OneKey's program, I believe it means they were dealing with more than a single bug ^{[perhaps we're not seeing the whole picture]}!

Or their bug founding was so big and important that OneKey decided to pay them extra reward to make them happy and (more silent) not so critical
I want to see researchers like this testing all other hardware wallets, because I am sure they could earn more money.

You have a point, but the main issue is the fact that an average joe like me, doesn't have the necessary skills & knowledge to deal with such cases ^{[unfortunately]}.

Average Joe probably can't do that for firmware, but luckily it's easier for developers to do it when wallet is open source.

I would have not expected these news to come from China, to be honest. In my eyes, China is kinda a black hole if we talk about Bitcoin technology, gadgets, wallets and other tools.

Believe it or not, most of the hardware devices and chips are coming from China, so they are far from being a black hole.
We already know that Ledger is made in China (and assembled in France village), Keystone is made in China, Safepal is made in China, and others that are less known.
OneKey is most popular hardware wallets in China, some repots say they sold over 100,000 devices.

Also, If I recall correctly Trezor wallets have a similar problem with physical attacks, back in the day after the Kraken video about that vulnerability, Satoshilabs suggested the use of a passphrase to mitigate the risk. Cannot all the Trezor based wallets do the same?

This is totally different from Trezor devices because they still don't have any secure elements, so it's logical that there is no communication between chips.

It seems to me that the consequences of such hacks are overestimated. Hardware wallet continue to protect the security of crypto assets million users (online). For this it are needed. And if the attackers have gained physical access to HW, then it will no longer matter whether they use the help of a hacker or a $5 wrench attack.

It doesn't have to be hackers, it can be any regular lowlife thief or government parasite agents that finds or confiscates hardware wallet.
Knowing they could hack it in one second would be nice surprise for them, especially in China.

If I create the BEST and MOST SECURE hardware wallet on the planet. BUT I make it all closed source and remove all marking from all the chips so you can't see what they are.

Yeah, especially if you sign NDA with your partners, and create black box operating system for secure element, like some manufacturers are already doing