OneKey Team Breaks Ledger in Lab test

[cryptomaniac_xxx]

https://x.com/ohyishi/status/2092953186193801599

OneKey founder Yishi Wang @Yishi has announced on August 27 that their internal Anzen security team had reproduced the exploit targeting Ledger Ethereum app v1.22.1 during controlled lab tests.

Although Ledger has cleared this:



https://x.com/Ledger/status/2093007184779006334

But it's good though that the hardware industry is now at a fence and reviewing everything, software, hardware, firmware and everything related for flaws that hacker can found before them and exploited it like the Coldcard incident.

[DubemIfedigbo001]

But it's good though that the hardware industry is now at a fence and reviewing everything, software, hardware, firmware and everything related for flaws that hacker can found before them and exploited it like the Coldcard incident.

Ledger is actually taking security seriously through their internal security audits and security bounty programs, I give them credit for that, and for the vulnerability, they've fixed it in the app updates and that is a very good one.

Every system has vulnerabilities, but remaining committed to identifying and fixing those vulnerabilities early enough before a scammer exploits it is key.  Every wallet provider should be intensifying efforts with AI-driven bug identification approach, it seems AI deployment can catch these bugs faster.

Note: This topic isn't about Bitcoin, you can move it to the Hardware wallets board.

[Charles-Tim]

@cryptomaniac_xxx
There is an existing thread created some hours ago about this which was created on the right board that it is supposed to be created. It is better you lock this thread instead, to avoid people repetitive posts.

This is the thread:
Ledger hacked or vulnerable

The vulnerability was fixed in the in the 1.22.2 before OneKey saw the vulnerability.

[AVE5]

But it's good though that the hardware industry is now at a fence and reviewing everything, software, hardware, firmware and everything related for flaws that hacker can found before them and exploited it like the Coldcard incident.

Kudos to the external research team who were able to identify the vulnerability of the brand in advance before hacker's finds its weakness and uses the medium of the outdated ledger software to invade targets.
It was also quite a quick reaction for the team being regenerated an updated software to curb the security threat.
For those using the ledger wallet, don't forget to also update the fireware after updated the wallet with the latest version as instructed.
Perhaps the ledger brand and teams has proven how effortlessly they're awake in their lab troubleshooting to avoid flaws before user's falls victim over their ignorant.
With numerous of hardware wallets being attacked and vulnerable to be hacked always reminds us that no technological security devices or software is risk free.

[m2017]

I believe that cross-testing of hardware wallets by third-party laboratories (often those of competitors) has a beneficial effect on the reliability of these devices. It is far better for bugs and vulnerabilities to be discovered by ethical hackers than by unethical ones. Furthermore, this keeps the industry on its toes, as competition for market share drives improvements in HW device security. This "battle" between manufacturers ultimately works to the benefit of device owners.

It is better for device reliability to improve this way than for the Coldcard situation to repeat itself. If in-house engineers cannot detect and fix a bug within five years... Let the competitors' engineers do it, at least.

Ledger certainly talks a good game here. But how can you update devices they’ve stopped supporting? Take Ledger Nano, for example. No way.

[SamReomo]

I believe that cross-testing of hardware wallets by third-party laboratories (often those of competitors) has a beneficial effect on the reliability of these devices. It is far better for bugs and vulnerabilities to be discovered by ethical hackers than by unethical ones. Furthermore, this keeps the industry on its toes, as competition for market share drives improvements in HW device security. This "battle" between manufacturers ultimately works to the benefit of device owners.

Yes, whatever you said is true but the ethical hackers don't get paid to find those bugs, they hardly get paid if there's bug bounty program but the unethical ones often make more money by doing shady things. They find the bugs, exploit those bugs, and empty wallets of the users and such hackers make a lot from their shady practices. A good hardware wallet should have the best security possible and they should pay ethical hackers to find bugs before the unethical ones find and exploit those bugs. I think every device manufacturer should consider paying ethical hackers to find bugs in their devices at hardware level and then at software level to have maximum security for the end users.

[Pmalek]

Ledger certainly talks a good game here. But how can you update devices they’ve stopped supporting? Take Ledger Nano, for example. No way.

While it's true that there hasn't been a new firmware release for the old Ledger Nano S device since 2021, it's a different picture when it comes to the individual coin apps. The coin applications still get (regular) updates and those can be installed by Nano S users in the same way that owners of newer Ledger hardware wallets install their updates. It's managed through the Ledger Wallet. Updating the Electrum coin app is the recommended step to take for those still using Ledgers.

[dkbit98]

It is good to see Chinese developers are actually doing something useful, not just using trezor wallet code for everything.
I am not surprised to see ledger wallet can be broken or exploited, in addition to leaking customer private information.
Strangely enough this news didn't get much media attention, especially compare to similar Donjon team news releases  

[X-ray]

I believe that cross-testing of hardware wallets by third-party laboratories (often those of competitors) has a beneficial effect on the reliability of these devices. It is far better for bugs and vulnerabilities to be discovered by ethical hackers than by unethical ones. Furthermore, this keeps the industry on its toes, as competition for market share drives improvements in HW device security. This "battle" between manufacturers ultimately works to the benefit of device owners.

It is better for device reliability to improve this way than for the Coldcard situation to repeat itself. If in-house engineers cannot detect and fix a bug within five years... Let the competitors' engineers do it, at least.

Agreed, but when the ethical hacker or 3rd party lab is reproducing exploit on outdated firmware and talking as if they've successfully breached the device, it's kind of pointless to me. It proves nothing, bug already patched.

Ledger certainly talks a good game here. But how can you update devices they’ve stopped supporting? Take Ledger Nano, for example. No way.

Phasing out is part of strategy . There is money to make and they won't be pushing update for deprecated devices because it will hinder people from upgrading. I kind of wish they pushed security update once in a while but all things considered Ledger Nano is a weak hardware, small storage, ram, and all.

Ledger certainly talks a good game here. But how can you update devices they’ve stopped supporting? Take Ledger Nano, for example. No way.

While it's true that there hasn't been a new firmware release for the old Ledger Nano S device since 2021, it's a different picture when it comes to the individual coin apps. The coin applications still get (regular) updates and those can be installed by Nano S users in the same way that owners of newer Ledger hardware wallets install their updates. It's managed through the Ledger Wallet. Updating the Electrum coin app is the recommended step to take for those still using Ledgers.

Is that really true? as far as I know Nano S and Nano stuck with old app version because lack of memory for newer version, Ethereum app is stuck at 1.16.0 according to their FAQ on "Why can't I update my Ethereum (ETH) app to the latest version on my Nano S?" section, expected the same for other app inside the hardware wallet because the constraint is the memory.