SlowMist Analyzes Suspected Hardware Implant Attack on Ledger: Malicious Module May Steal Seed Phrases via Screen Data Cable

BlockBeats news, October 10: SlowMist Chief Information Security Officer 23pds posted that if the Ledger device PCB was modified in the manner described by former Mt. Gox CEO Mark Karpelès, then the attacker would possess a fairly high level of technical sophistication.

The attack flow may be: the wallet generates the mnemonic within the secure element (SE), then displays the mnemonic on the screen for the user to write down; a malicious module obtains the displayed content through screen data lines such as SPI, records the complete mnemonic, and then sends the data to the attacker via LTE/eSIM, ultimately leading to the theft of the user's assets.

The role of the secure element is to prevent the private key from being directly read or exported, but it cannot prevent an external module from obtaining the information being displayed on the screen. However, the above analysis is based on the premise that the PCB was indeed modified in the described manner, and the relevant attack path and hardware implantation situation still await independent verification.

BlockBeats reported yesterday that former Mt. Gox CEO Mark Karpelès disclosed in a post that a Ledger hardware wallet he received appeared to have been implanted with a spy module. The device came from Malaysia, the outer shrink wrap was intact, and after opening it, abnormalities were difficult to detect immediately. The implant was hidden in the position where the screen's original cushioning pad should have been.

Karpelès further explained that the module contains an LTE communication component, an antenna, an eSIM, and a microcontroller connected to the Ledger SPI bus. It can analyze the characters displayed by the device to the user and send the relevant data after the mnemonic setup is completed.