Tool to check if Hardware wallets are tampered or not

[cryptoaddictchie]

Just typically browsing on X and my timeline is all about Ledger and hardware wallets and see this post. Mentioned that supported some of known hardware wallets if you got a tampered one or not. How can we get the photo of our board photo without dismantling it? Or we need to open it up to check it with this tool?

built this to help you check your hardware wallet for signs of tampering.

upload a board photo. works with onekey, ledger and trezor. free, no signup, no photos saved.

it can flag what looks wrong, but a clean result isn’t an all-clear.

The site to check it:

Code:

tampered.app

[DireWolfM14]

Code:

tampered.app

The URL was literally registered today.  By a company called CryptoBilly. 

Just kidding about that last part, but seriously, how much trust are we going to place in other people.  Buy a Hardware Wallet directly from the manufacturer.  If they don't ship to your country, don't buy one their wallets.

If you're unable to buy any hardware wallets, use an off-line PC.  If you can't afford an old, cheap computer to dedicate for off line usage, use a bootable USB with a secure OS.  There are so many alternatives.

[cryptoaddictchie]

Buy a Hardware Wallet directly from the manufacturer.  If they don't ship to your country, don't buy one their wallets.

If you're unable to buy any hardware wallets, use an off-line PC.  If you can't afford an old, cheap computer to dedicate for off line usage, use a bootable USB with a secure OS.  There are so many alternatives.

Ive had mine few years ago ordered it from the official ledger and I didnt buy one off from resellers. Just sharing this here maybe some who bought from resellers here wanted to check their if their devices are secured and not tampered ofcourse with their discretion if they gonna trust that tool or not.

Since mostly here are OG on bitcoin I bet their gonna do too what you suggest but who knows maybe some did?

[dkbit98]

It's not a bad idea to release tool like this, but I have my doubts when guy who releases it is founder and main guy of Onekey wallet.
Than we see that only three hardware wallet manufacturers are supported, and we also have Keystone, KeycardShell and many other devices.

How can we get the photo of our board photo without dismantling it? Or we need to open it up to check it with this tool?

Only way to get photos is to physically open your device.
I know plenty of people who did that, especially with ledger crap, when they replaced display or batteries.

[cryptoaddictchie]

Only way to get photos is to physically open your device.
I know plenty of people who did that, especially with ledger crap, when they replaced display or batteries.

Personally I wouldnt do this cause if my device got compromised I think theres no other way but to accept the fact that we end up losing due to our irresponsibility to protect whats needed to do so.

But for those nervious guys,- theres no need to panic and do this cause if we are talking time we already too late. Its either you accept it or not for the better.

[X-ray]

As mentioned in the X post, clear doesn't mean all-clear, after some small digging they used Claude model to see the image and the analysis can be wrong though. This is from their FAQ.

Anthropic’s Claude, a vision model called through Cloudflare. It only reads the chip markings and lists what is on the board; fixed rules decide the result: the main chips must be original parts whose part numbers match your model, and nothing may be added. It can still be wrong, which is why a clean result is never called safe.

I can't imagine even if you're the kindest person in the world, you're going to use cutting edge Fable model to analyse people's hardware wallet for free facing public internet without auth or some kind, so take it with grain of salt.

I was about to tinker with mine and after seeing the FAQ, it's the same as saying "your hardware wallet might be safe or it might be not" which is such a huge turn off.

It's still better to reach out the experts and ask if you have the chance.

[m2017]

Just typically browsing on X and my timeline is all about Ledger and hardware wallets and see this post.

This is not surprising, given that HW-devices are the main (and rather painful) topic of discussion within the crypto community this year.

Mentioned that supported some of known hardware wallets if you got a tampered one or not.

Code:

tampered.app

They simply compare a photo of your HW-device with a photo of the circuit board provided by the official manufacturer. This service is aimed at the gifted people so incapable that they can’t even find an official photo of the board themselves and compare it to their own hardware wallet.

Such services will only remain relevant as long as the hype surrounding the hacking of HW-devices persists. In the near future, attackers will begin modifying the circuit boards in ways that make a simple visual inspection and comparison insufficient.

How can we get the photo of our board photo without dismantling it? Or we need to open it up to check it with this tool?

It’s actually much simpler: all have to do is connect HW-device to a website that claims to check whether your wallet has been tampered with (something like "tampered.app") and enter your seed-phrase.

I’m certain that the internet will soon be flooded with "tools" created by scammers - tools that supposedly "let you check" the security of your hardware wallet.

So, be very careful with these "toys".

Still, the definition of “interference” in a HW-device includes a set of measures (analysis), and not just a comparison of the printed circuit board (this doesn't make the verdict 100% accurate).

[ryzaadit]

As mentioned in the X post, clear doesn't mean all-clear, after some small digging they used Claude model to see the image and the analysis can be wrong though. This is from their FAQ.
-snip

As usual, I also know these terms & conditions regarding how AI could share your information or give you an answer with a wrong/missleading/oudated at the time there has some cases where AI shares an answer with a fake or phishing website. I always 2 thought for these tools:

[1] How AI will answer that fake chips has been stamped with the same stamps as the genuine chips.
[2] The FAQ you shared from Claude or other AI terms & conditions.

In the end, manual checks are needed when you are using AI for the check to confirm the suspicious item or report.


Anyway, do someone has some report example from the tools? currious to see how the report looks like.

[cryptoaddictchie]

It’s actually much simpler: all have to do is connect HW-device to a website that claims to check whether your wallet has been tampered with (something like "tampered.app") and enter your seed-phrase.

I’m certain that the internet will soon be flooded with "tools" created by scammers - tools that supposedly "let you check" the security of your hardware wallet.

So, be very careful with these "toys".

Still, the definition of “interference” in a HW-device includes a set of measures (analysis), and not just a comparison of the printed circuit board (this doesn't make the verdict 100% accurate).

Actually Im asking in serious if theres a way cause the app seems require to capture a photo of it. Theres also not mention to connect the device but just a jpeg photo of the board. Much clearly didnt state to enter the seed phrase dude. Just go to the site Im 100% sure it wasnt said it.  I appreciate the reminder about these toys.

But Im guessing they gonna use AI in their process.

[ryzaadit]

Theres also not mention to connect the device but just a jpeg photo of the board. Much clearly didnt state to enter the seed phrase dude. Just go to the site Im 100% sure it wasnt said it.

But Im guessing they gonna use AI in their process.

Yes, there is no need to connect or put in any information like seeds. Just need to choose the information of your device, and the picture type you put.


Just for educational purposes, I decided to use these apps. I took an example from @julerz12 device^[1], Ledger Nano S, he asked Mark Kerpeler, and he said the device has no problem. But I want to see how these tools check.

Board check

• Your device: You need to manually choose your device
• Photos of the opened board: At the time of putting the picture, AI automatically marks the photo board (front/back). You can still change it manually, in case the AI marked the board wrong.

Results are out in 5-10 seconds.

Here is the report result from the tampered app.

[joniboini]

Here is the report result from the tampered app.

I wonder if uploading a video will help the detection better. Then again, someone who can buy a HW and opening it probably has decent phones to take pictures. Looks like they references some sources from Ledger and other manufacturers too, though I guess the recent attack shows scammers can bypass them. I'm not sure if this is their only data source or they have their own database of opened HW but doesn't share it publicly. I wonder why the "marking" result doesn't show anything though.

[ryzaadit]

I wonder if uploading a video will help the detection better. Then again, someone who can buy a HW and opening it probably has decent phones to take pictures.

Since there is no mentioned about video, I think it's only by picture.

Looks like they references some sources from Ledger and other manufacturers too, though I guess the recent attack shows scammers can bypass them. I'm not sure if this is their only data source or they have their own database of opened HW but doesn't share it publicly. I wonder why the "marking" result doesn't show anything though.

Yes, they used manufacturers' information for the AI. Otherwise, AI could lead you to give false, misleading, or outdated information in the result report. In the top right corner, you can try to check the device. Then, you will see the details of the resources they're using. I check on there, and they seems to also inputed the chips mark maybe to make the AI focused on those only.

I wonder why the "marking" result doesn't show anything though.

Perhaps, maybe due to the angle of the picture? I only tested as educational purpose just want to see how the report looks like by using someone else picture in the internet. The AI maybe can't reading the picture enough to give you a best result.

[julerz12]

Results are out in 5-10 seconds.

Here is the report result from the tampered app.

I had the same result when using the app.
I guess it requires a high-def, ultra-close-up photo of the PCB. Close and clear enough so that it can read the markings on it and make an accurate reading.

The AI maybe can't reading the picture enough to give you a best result.

Interestingly, I fed the same images to Google Search AI, and this is what it told me:

[Cricktor]

Better and shadow-free lighting for the pictures is advisable which many people don't know how to make (it's possible without special equipment, use your brain or google some suggestions).


Shouldn't a hardware wallet manufacturer provide such a service, together with good high resolution pictures of every internal board revisions of their hardware wallets? I think, we as customers should demand at least the pictures.

As trojan implants have become a viable attack vector (at least for hardware wallets which lack countermeasures due to non-encrypted communication of MCU with screen and ease of tampering the screen electronics to obtain screen content, too much empty space for implants, too easy to open and close again casing allowing tampering to be mostly undetected by customers), there need to be better and more countermeasures and hopefully better verification that a device hasn't been tampered. (I know it's not going to be easy, but Ledger's case shows it's far too easy for determined criminals...)

Something is wrong when you can't trust your hardware wallet. Even when I order it directly from the manufacturer, there are other parties involved to deliver the device to me. The commonly not well paid people in the delivery service chain can become an attack/bribe target, too. How can a customer be sure, no tampering is happening there? (Would at least need an individual device serial no. that is securely communicated between manufacturer and customer but not to the delivery chain.)

[PrivacyG]

It would be a good addition to also have a manual check instead of an AI verification.  I do not know what to think about this tool.  Some people take 'AI' as the final, definitive answer.  A false 'clean' result could lead to losses for such people.

I do know there are disclaimers that it should not be treated as a final answer, but I would personally prefer a manual verification by visually comparing what I have in front of me with what I see on the screen.

Shouldn't a hardware wallet manufacturer provide such a service, together with good high resolution pictures of every internal board revisions of their hardware wallets? I think, we as customers should demand at least the pictures.

Every time I wanted to get an official verification for a product, I was asked to send multiple pictures of the product and they would confirm with out telling me what was or could be wrong.  They justified that by telling me that if they explained how to check whether it is legitimate or a replica, then the bad people who create replicas would also know where to improve.

Now I am not sure how that would work here.  As in.  I doubt it would be possible to replicate the circuit board in such a way you would not even tell the difference.  But that can be some thing to take into account.

[m2017]

Something is wrong when you can't trust your hardware wallet.

To ensure the security of your crypto assets, should always assume that your HW-device is potentially compromised. Before using it, verify that this is not the case by conducting both an external and an internal analysis. An external check involves looking for signs of tampering, unauthorized physical intervention, or the presence of foreign components (while such inspection is still possible). An internal check involves generating a new seed phrase on the HW-device (ensuring that no seed phrase was pre-generated) and then sending a test transaction to the wallet to see if the assets are subsequently stolen.

Even when I order it directly from the manufacturer, there are other parties involved to deliver the device to me. The commonly not well paid people in the delivery service chain can become an attack/bribe target, too.

That is precisely why I believe all HW-devices should be considered "conditionally compromised". The presence of any intermediary between the seller and the buyer constitutes a potential threat.

How can a customer be sure, no tampering is happening there?

Buy it straight off the assembly line at the HW manufacturer’s assembly plant.

(Would at least need an individual device serial no. that is securely communicated between manufacturer and customer but not to the delivery chain.)

It’s an intriguing idea, at least until the next data breach occurs. Once that happens, it effectively becomes a system for tracking individuals (akin to a KYC), as the user’s data would be "hard-linked" to the specific HW-device and its serial number.

As a potential solution, the serial number could be made temporary: once the buyer receives the device and verifies the serial number, that number, along with any associated information, would be deleted from the HW manufacturer’s records (with the understanding that, throughout the interim period, the data was stored in an encrypted format).

[Pmalek]

Usually when something bad happens like this supply chain attack on Ledger hardware wallets, the community steps up and gets active. Something good can always come out of bad times like this app that probably would never have been developed otherwise.

There is an interesting post by Ledger on the X post shared in OP. They said something I didn't know before. Opening a Ledger hardware wallet physically doesn't automatically void the warranty. The warrant is only voided if the device gets damaged in the process. Therefore, those who still use Ledgers but believe they can't perform hardware integrity checks should think about doing it. They just need to be careful not to damage any parts if they want to keep their warranties.