[Warning] Ledger Manager chrome app

[hugeblack]

You can manage your Ledger accounts/products using the Chrome app named "Ledger manager".
two days ago, I tried to download it from Chrome market "Web Store" and found one application with that name.
I found the developer is "ovsanzh4" so when I checked it through the site I found the application different.
Be aware of that and only download it from https://www.ledgerwallet.com

[1714921492]

1714921492

[TryNinja]

It's weird that when you search "Ledger Manager" at the Chrome Web Store, the fake version is the only that appears in the results. And not the original.

But it should be easy to spot which one is the real. The fake one is called "LedgerManager.com" and has only 122 downloads.

P.S: You can report it to Google in this link - https://chrome.google.com/webstore/report/lgffknnjknhggnmhhalhkpefmjeifpja

[HCP]

Well spotted!

It's weird that when you search "Ledger Manager" at the Chrome Web Store, the fake version is the only that appears in the results. And not the original.

That is indeed very strange... I have reported this to Google as well and sent a Tweet to LedgerHQ about it... hopefully this fake gets pulled soon!

[bob123]

I have also reported this application. Thats a very strange behaviour of the chrome web store.
I seem to not be able to find ANY application from ledger through the search function.

The faked ledger manager application has 120+ downloads (which is pretty small compared to 600k+). I am not aware of anyone claiming his funds got stolen from a nano s.
So it might be a 'failed' malicious version. But still, this has to be removed as soon as possible.

[Lucius]

This is nothing new,the same thing happened several times on Chrome App Store and according to what can be read on some sites does not pose any danger-it only redirect to Ledger site for now.

3 months ago Ledger comment that :

Hello,

I'm Fred, VP of Engineering @ledger.

This app is neither provided nor endorsed by Ledger.

We've audited the code and it doesn't do anything malicious yet, but asks for the largest possible set of permissions. This means a future update might contain malicious code.

We've reported the application to Google, in the meantime, it MUST NOT be installed.

Only correct way is to download everything from official site,otherwise you expose yourself to unnecessary risk.In the near future Chrome will stop to support apps and Ledger will release desktop app,problem with fake apps will be solved.

[livingfree]

Thanks guys. I guess this is also the right thread that I can open this. I went through here as there's something wrong with my browser and when I found out google chrome disabled my Ledger Wallet Bitcoin

It says "Ledger Wallet Bitcoin is disabled".

Did anyone noticed it? Is it safe to re-enable and accept permission?

[HCP]

Thanks guys. I guess this is also the right thread that I can open this. I went through here as there's something wrong with my browser and when I found out google chrome disabled my Ledger Wallet Bitcoin

It says "Ledger Wallet Bitcoin is disabled".

Did anyone noticed it? Is it safe to re-enable and accept permission?

Yes, I see that my Ledger Wallet Bitcoin has been disabled as well... it is because the new update (Updated: 16 April 2018) is requesting a new permission that involves writing to disk. By default, when an extension requests a new security related permission, Chrome will automatically disable it until you grant the permission.

If you are concerned, your best option is to uninstall whatever Ledger related extensions you have installed in Chrome...

Then go here: https://www.ledgerwallet.com/apps/manager
and here: https://www.ledgerwallet.com/apps/bitcoin

And re-install the extensions from the links on those pages... That way you are guaranteed to have the latest and OFFICIAL extensions


For reference, the Chrome Web Store Links should be: https://chrome.google.com/webstore/detail/ledger-manager/beimhnaefocolcplfimocfiaiefpkgbf
and: https://chrome.google.com/webstore/detail/ledger-wallet-bitcoin/kkdpmhnladdopljabkgpacgpliggeeaf

[o_e_l_e_o]

This is the pop-up you receive from the old version:



It is worth noting that the only new permission is "Write to files and folders that you open in the application". It always had the other three permissions.

You can see a response from the Ledger CTO in the following Reddit thread regarding the same issue:

"It's fine, you can reenable it. The new Bitcoin Chrome app added some permissions to export debug logs at user request which were missing previously"

As HCP said above: if you have any doubt, reinstall directly from the official website.

[livingfree]

-snip-

Thanks mate, it gave me hesitation of trying to re-enable it. But upon reading your suggestion I tried it out and it worked!

-snip-

Thank you too mate, I tried it and glad it worked. That made me feel I'm okay right now.