Bitcoin Forum
November 15, 2024, 05:11:37 AM *
News: Latest Bitcoin Core release: 28.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: « 1 2 [3]  All
  Print  
Author Topic: Be careful what you plug your hardware wallet into your PC with  (Read 508 times)
DaveF (OP)
Legendary
*
Offline Offline

Activity: 3654
Merit: 6671


Crypto Swap Exchange


View Profile WWW
July 04, 2022, 01:40:15 AM
 #41

So was talking about this while burgers & beers earlier.
The fix they sent him barely works and causes errors and when it does work it's still not right. But as he put it "was more of a proof of concept then finished coding"
However, they are working on it so I'll give them that.

And yes it's a What's App burgers and beers meeting since he is several time zones away....

-Dave
Interesting; so the bug / exploit you guys found is going to be fixed by the manufacturer now?
I was under the impression that due to its nature it was not vendor-specific to just one brand and that it was going to be hard to fix.

The attack I imagined from your rough description, wouldn't be easy to fix outside the OS level.

The editing of the webpage with an address in a fixed known position is not going to be a fixable, that just is what it is.

The other thing that can be fixed that I have been evasive about discussing is more along the lines of changing the way the apps on the computer talk to the device.
Without getting to into it because:

1) I promised not to
and
2) I don't understand it fully...

The desktop app says to the hw wallet lets send funds to this address 1234 the cable sends to the device lets send funds to 5678 at that point the user should stop. But the issue is a lot of people get complacent and don't check. The other issue is at certain times and certain conditions he can FORCE 1234 to be displayed on the device. Don't ask how I got as far as "you plug in the cable and then......it's all gibberish" I am not ashamed to admit it's over my head. I can fake PHP work, really know linux and like to think I am fairly good at routing. And in general tend to be the go-to person for dealing with many system issues.
But this, nope, I get the basic concept of how it works. But don't get it past there.

-Dave

█▀▀▀











█▄▄▄
▀▀▀▀▀▀▀▀▀▀▀
e
▄▄▄▄▄▄▄▄▄▄▄
█████████████
████████████▄███
██▐███████▄█████▀
█████████▄████▀
███▐████▄███▀
████▐██████▀
█████▀█████
███████████▄
████████████▄
██▄█████▀█████▄
▄█████████▀█████▀
███████████▀██▀
████▀█████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
c.h.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀█











▄▄▄█
▄██████▄▄▄
█████████████▄▄
███████████████
███████████████
███████████████
███████████████
███░░█████████
███▌▐█████████
█████████████
███████████▀
██████████▀
████████▀
▀██▀▀
n0nce
Hero Member
*****
Offline Offline

Activity: 896
Merit: 5918


not your keys, not your coins!


View Profile WWW
July 05, 2022, 12:07:38 AM
 #42

[...]
Alright, so those are 2 different things at play then, right. Bug #1 is about replacing Bitcoin address A on screen and clipboard simultaneously with address B, so when the user copies it into the wallet software (which cannot know where that address comes from, so no way to verify it hasn't been tampered with), the address on the device's screen (B) will match with what's on the computer screen (B) and what was pasted into the wallet software (address B), so no suspicion will be raised. This can't be fixed by wallet applications.

Bug #2 is about a user copying address A from a webpapge (unmodified / untampered) into the software, address A being displayed on the device's screen, but getting the device to sign transaction that spends to address B?

Don't worry if you don't know / can't tell / aren't allowed to tell more details; I'm just very intrigued.. Grin

█▀▀▀











█▄▄▄
▀▀▀▀▀▀▀▀▀▀▀
e
▄▄▄▄▄▄▄▄▄▄▄
█████████████
████████████▄███
██▐███████▄█████▀
█████████▄████▀
███▐████▄███▀
████▐██████▀
█████▀█████
███████████▄
████████████▄
██▄█████▀█████▄
▄█████████▀█████▀
███████████▀██▀
████▀█████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
c.h.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀█











▄▄▄█
▄██████▄▄▄
█████████████▄▄
███████████████
███████████████
███████████████
███████████████
███░░█████████
███▌▐█████████
█████████████
███████████▀
██████████▀
████████▀
▀██▀▀
NotATether
Legendary
*
Offline Offline

Activity: 1792
Merit: 7382


Top Crypto Casino


View Profile WWW
July 05, 2022, 05:33:52 AM
 #43

This whole "use cables to connect your legacy devices" nonsense is not going to cause most people to go out and buy cables to connect their peripherals to netiher macbooks or their cheap ultrabook competitors, particularly since there is no go-to vendor for buying plugs (like how there is Best Buy for electronics).

That philosophy might have worked with DisplayPort but I don't see people going out and buying cables or new USB-C devides anytime soon.

It's not too difficult to put two USB-A ports, one on each side of ultrabooks, and without increasing the thickness.

It's just due to lemmings copying Apple's fanatical minimalism really that the industry is threatening to go into a situation where we must buy cables for everything. [As you can see, this design philosophy doesn't work every well when transferred to Windows, hence the manufacturer resistance to going all-USB-C.]

███████████████████████
████▐██▄█████████████████
████▐██████▄▄▄███████████
████▐████▄█████▄▄████████
████▐█████▀▀▀▀▀███▄██████
████▐███▀████████████████
████▐█████████▄█████▌████
████▐██▌█████▀██████▌████
████▐██████████▀████▌████
█████▀███▄█████▄███▀█████
███████▀█████████▀███████
██████████▀███▀██████████

███████████████████████
.
BC.GAME
▄▄▀▀▀▀▀▀▀▄▄
▄▀▀░▄██▀░▀██▄░▀▀▄
▄▀░▐▀▄░▀░░▀░░▀░▄▀▌░▀▄
▄▀▄█▐░▀▄▀▀▀▀▀▄▀░▌█▄▀▄
▄▀░▀░░█░▄███████▄░█░░▀░▀▄
█░█░▀░█████████████░▀░█░█
█░██░▀█▀▀█▄▄█▀▀█▀░██░█
█░█▀██░█▀▀██▀▀█░██▀█░█
▀▄▀██░░░▀▀▄▌▐▄▀▀░░░██▀▄▀
▀▄▀██░░▄░▀▄█▄▀░▄░░██▀▄▀
▀▄░▀█░▄▄▄░▀░▄▄▄░█▀░▄▀
▀▄▄▀▀███▄███▀▀▄▄▀
██████▄▄▄▄▄▄▄██████
.
..CASINO....SPORTS....RACING..


▄▄████▄▄
▄███▀▀███▄
██████████
▀███▄░▄██▀
▄▄████▄▄░▀█▀▄██▀▄▄████▄▄
▄███▀▀▀████▄▄██▀▄███▀▀███▄
███████▄▄▀▀████▄▄▀▀███████
▀███▄▄███▀░░░▀▀████▄▄▄███▀
▀▀████▀▀████████▀▀████▀▀
n0nce
Hero Member
*****
Offline Offline

Activity: 896
Merit: 5918


not your keys, not your coins!


View Profile WWW
July 05, 2022, 11:58:05 PM
 #44

[...]
It's just due to lemmings copying Apple's fanatical minimalism really that the industry is threatening to go into a situation where we must buy cables for everything. [As you can see, this design philosophy doesn't work every well when transferred to Windows, hence the manufacturer resistance to going all-USB-C.]
I'm not a big fan of USB-C either, but honestly the whole point of it is to have a single (or a few) USB-C <> USB-C cables, which work for everything, from charging your phone, tablet, headphones, connecting your keyboard, connecting your display; anything, really. It should result in less cables being bought, carried around and replaced.
Of course, there is a transition period as always.

I'm certainly glad USB was introduced as opposed to having parallel port, serial port, PS/2, even Ethernet can run fairly well on a modern USB-A port - while we needed so many different ports in the past. So stuff moving towards less different connectors and cables in my opinion is a good thing in general.

I have no idea how we got to this topic though; this is so off-topic.. Cheesy

█▀▀▀











█▄▄▄
▀▀▀▀▀▀▀▀▀▀▀
e
▄▄▄▄▄▄▄▄▄▄▄
█████████████
████████████▄███
██▐███████▄█████▀
█████████▄████▀
███▐████▄███▀
████▐██████▀
█████▀█████
███████████▄
████████████▄
██▄█████▀█████▄
▄█████████▀█████▀
███████████▀██▀
████▀█████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
c.h.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀█











▄▄▄█
▄██████▄▄▄
█████████████▄▄
███████████████
███████████████
███████████████
███████████████
███░░█████████
███▌▐█████████
█████████████
███████████▀
██████████▀
████████▀
▀██▀▀
Pages: « 1 2 [3]  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!