It looks plausible to buy a device, compromise it, and return it to the shop for a refund.
That’s because they knew the store will restock it back.. but why restock what’s been returned as a defective product, that’s probably the only convincing complaint that can be attached to get a refund .
Many shops allow customers to return products if they changed their mind after buying. It doesn't need to be defective.
If you ordered it online, you're even allowed to return it if you ordered from Ledger directly. That makes me wonder how thoroughly they check their return shipments before selling them again. Would it be possible to compromise their own supplies this way?
Ledger told authorized resellers never to restock returned products, and urged buyers to avoid unauthorized sellers.
I highly doubt they'd do that. If a large electronics chain receives a seemingly unopened box returned by a customer, I'd be surprised if they don't just put it back in the store. But even if they do take them out, it wouldn't be too far fetched to just walk into the store, and put a compromised box on their shelf. Or it could be an inside job by bribing an employee.
I don't think that anti tamper stickers prevent this kind of thing. It makes it just harder, as we have seen the anti tamper checks on the hardware in this case have failed too.
You said it already: it makes it harder. Security doesn't come from just one thing, it's the sum of all things combined.
I am looking for a measure or method that would make this completely impossible
There is no 100% security.
That, right there? That's game over.
If that would be true, it would have been game over many years ago. Marketing is powerful enough to sell people bad products.
Ledger falsely stated in writing that their devices offered a level of security capability which the devices were not capable of delivering.
You're talking about the company that also falsely stated in writing that your keys can never leave the device. They lie. It's documented. People still fall for it.
I wonder if there is a globalist (i.e. world central bank) conspiracy to make self custody as scary as possible.
My country is planning to do exactly that:
This is the latest plan for 2028:
Wie crypto’s in zijn eigen wallet heeft staan, gaat belasting moeten betalen op winst hierop, óók als die winst nog niet is verzilverd. Dat geld moet je dus wel hebben liggen. Wie crypto’s heeft via een bank of een reguliere beleggingsrekening, betaalt vanaf 2028 alleen als de winst wordt verzilverd.
In short: if you own your Bitcoin keys, you'll be taxed 36% on the annual unrealized gains, even if you don't sell them. But if you give your coins to Blackrock, you're only taxed when you sell them!
Didn't Europe recently enact regulations that require users to prove they own the address before moving funds from CEXs to private addresses?
The "travel rule" implementation varies per exchange: some ask just to confirm "yes that address is mine", others ask to "connect your wallet" or "upload an image". The registration hunger combined with increasing data leaks are just a disaster waiting to happen.
I'm wondering why the implants aren't the same. The materials aren't the same. The arrangements aren't the same. The differences are significant. One has 8 soldering points, for example. The other has only 4. In other words, there are most likely more than 1 or 1 group of attackers.
Or, the attack has been an ongoing experiment; meaning, changes or improvements were made along the way. Attempts were pretty much trials and errors. Some worked, some didn't.
That makes perfect sense. It's probably both: different groups of attackers working on their own hardware hacks.
Considering the number of devices involved, I would have expected many alarm bells if the software could detect the tampered hardware. So my guess it it couldn't find it.
according to :
https://www.tibane.net/research/ledger-nano-x-implant#timelineAn “implant” doesnt trigger Ledger’s “Genuine Device” check because the implant never touched the Secure Element(the chip). …
So basically, the "secure element" is simply bypassed because the words have to be printed on the screen:
A hardware wallet keeps your secret inside a hardened chip, the secure element, which is built to resist an attacker with a lab. It still has to show you the 24 words once, when you set it up, and to show them it has to send them to the screen.
The implant waits on that path. It is a second, tiny computer soldered onto a genuine Ledger Nano X, wired to the screen’s data lines. It doesn’t try to break the secure element. It only watches the pixels go past, picks out the letters of each word, and stores them. A cellular modem with its own SIM card and antenna then sends them to the attacker. The wallet has no idea it is there, and Ledger’s “genuine device” check passes, because the secure element really is genuine.
I think the people at Ledger talked about the missing anti-tamper stickers years ago and said that they see no point in adding them because they add a false sense of security. The stickers can be be removed, the residue can be cleaned, and new anti-tamper stickers can be placed at the same place after opening and inserting hardware implants. The result would be a manipulated device with a sticker on that makes it look like it wasn't.
By that same logic, they can just as well remove all other security measures. Everything can be tampered by someone resourceful and patient enough to do so. Let me use a very Dutch example: it's kinda like a bicycle lock: everyone knows it won't stop a thief, but the goal is to delay him a bit. If another bicycle is easier to steal, he'll take that one. In this case, Ledger was the easy one to tamper with.
