How to verify the security integrity of the Ledger Nano S?

[omali]

If you buy a ledger Nano from a reseller, You would have to make sure  101% that the device is not tampered with.

So I found an article on the Ledger website that explains it https://ledger.zendesk.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-

A really great article it is, but this guide is hard to follow entirely. There are four steps in the article. The first step which is to open the device up to verify that no additional chip has been added was simple to follow. But then the other steps got me completely confused with all the info, commands, codes...

Someone please help with guidelines on how to follow these steps.

[1714167990]

1714167990

[1714167990]

1714167990

[TryNinja]

1. Install Python on your computer.
2. Open your terminal/cmd and run:

Code:

pip install --no-cache-dir ledgerblue

3. Then, run:

On firmware 1.3.1 or below

Code:

python -m ledgerblue.checkGenuine --targetId 0x31100002

On firmware 1.4.1 and above

Code:

python -m ledgerblue.checkGenuine --targetId 0x31100003

It will output either your device is genuine or not.

[mk4]

I don't think checking the hardware isn't necessary. But yea, I understand if you want to be very very sure.

Correct me if I'm wrong, but wouldn't the Ledger chrome plugin know if you're using a genuine product or not? Quote from https://blog.ledger.co/2015/03/27/how-to-protect-hardware-wallets-against-tampering/

How does it work?

The Ledger Wallet Chrome application sends a random value to the Nano as a challenge. The Nano then signs this random value + the firmware version, using an embedded private key shared by some batches.

The Chrome app knows the public key and can verify the signature.

If an attacker switched the Nano with a replica running a rogue firmware, it wouldn’t pass the attestation test and would immediatly be rejected as non genuine.

There is absolutely no way that an attacker could replace the firmware and make it pass attestation, without knowing the Ledger private key.

[omali]

1. Install Python on your computer.
2. Open your terminal/cmd and run:

Code:

pip install --no-cache-dir ledgerblue

3. Then, run:

On firmware 1.3.1 or below

Code:

python -m ledgerblue.checkGenuine --targetId 0x31100002

On firmware 1.4.1 and above

Code:

python -m ledgerblue.checkGenuine --targetId 0x31100003

It will output either your device is genuine or not.

Ok ... I will try this

[omali]

I don't think checking the hardware isn't necessary. But yea, I understand if you want to be very very sure.

Correct me if I'm wrong, but wouldn't the Ledger chrome plugin know if you're using a genuine product or not? Quote from https://blog.ledger.co/2015/03/27/how-to-protect-hardware-wallets-against-tampering/

How does it work?

The Ledger Wallet Chrome application sends a random value to the Nano as a challenge. The Nano then signs this random value + the firmware version, using an embedded private key shared by some batches.

The Chrome app knows the public key and can verify the signature.

If an attacker switched the Nano with a replica running a rogue firmware, it wouldn’t pass the attestation test and would immediatly be rejected as non genuine.

There is absolutely no way that an attacker could replace the firmware and make it pass attestation, without knowing the Ledger private key.

You mean that the Chrome apps can verify the device integrity when I plug it in? Wow I didnt know that.  I am really learning a lot from this great community...Thanks

[TryNinja]

~

Yes. When I open the Chrome app, conect and unlock my Nano, the screen briefly shows "Checking if the device is genuine" or something like this. The methods in the article are just a way of checking it directly.