Ledger Atom

[Meuserna]

the company published an article on its blog about Ledger Atom security architecture: https://www.ledger.com/blog-ledger-atom-security-architecture

here are some key points:

Supply chain risks have existed for years.

That whole post by Ledger reads like one giant facepalm.

Ledger, then: "There is no anti-tampering sticker on this box. A cryptographic mechanism checks the integrity of your Ledger device's internal software each time it is powered on. The Secure Element chip prevents any interception or physical replacement attempt. Ledger devices are engineered to be tamper-proof."

Ledger, now: "Supply chain risks have existed for years."

Good luck with that, eh? What a terrible company.

[Cricktor]

OK, I'm not known to be a fan of Ledger, rather the contrary.

Isn't it a nice concession to organized supply chain crime that this new device already comes with wifi and 5G connectivity and enough battery power onboard? Cool, no trojan implant here really anymore needed. The criminal hackers only need to find flaws in the software to tamper security boundaries (could be quite a challenge, but frankly who knows, as Ledger's firmware is usually an opaque mystery box). That's the spirt, Ledger, thank you for nothing!

I haven't yet read their whitepaper on this device's security model. Android OS is complex, same applies to iOS, and has constant need for patches, built-in obsolescense due to limited support periods. I'm not confident that Ledger will provide stellar Android OS support, so there will be attack vectors via Android OS anyway, that's mostly inevitable.

Will the FPGA be still programmable in the delivered product? (If yes: a nightmare to be tripped; if not: a discovered and exploitable flaw could render the security boundary moot.)

With further development of KI driven reverse-engineering of binary blobs, security-by-obscurity with Ledger's closed-source firmware policy might become less of a problem for criminals. Consider Ledger OS flawless and error-free? Please, seek medical help if you even had the faintest thoughts or hopes of that.

There could be traces of elements of S, Ar, Ca, Sm that escaped my brain beaker. Feel free to do your own chemistry with 'em.