Trezor Bitcoin wallet hacked - Dave was bang on with his teardown. - Page 1
Forum section: electronics / general

author: funkyant
author_rank: Unknown
timestamp: August 17, 2017, 10:22:21 am
content: https://medium.com/@Zero404Cool/trezor-security-glitches-reveal-your-private-keys-761eeab03ff8Dave wondered why it wasn't potted. Dave wondered why they didn't have any tamper mechanisms.If they had have had those features, the hack wouldn't be possible.

author: EEVblog
author_rank: Unknown
timestamp: August 17, 2017, 11:48:04 am
content: Quote from: funkyant on August 17, 2017, 10:22:21 amAnd I said they should have used a secure processor.Any/all of these would have prevented this embarrassing hack.I do believe they replied on here saying they didn't need a secure processor because they could make it secure in software, oops

author: funkyant
author_rank: Unknown
timestamp: August 17, 2017, 11:55:14 am
content: That's a mighty big oops.

author: bd139
author_rank: Super Contributor
timestamp: August 17, 2017, 12:40:19 pm
content: Well there's some shitty tactics going on here. The device is flawed for certain, but Zero404Cool stuck a 2 BTC price on the source which is currently ~ 8900 USD. Responsible disclosure not. This is asking the vendor to pay up a ransom or handing vulnerabilities over to the highest bidder.Both the device and the attackers are a bunch of dicks... total circus.

author: Cerebus
author_rank: Super Contributor
timestamp: August 17, 2017, 04:32:35 pm
content: Quote from: bd139 on August 17, 2017, 12:40:19 pmWhat are you talking about? There's nothing in the link above that tallies with what you're saying, so you must have some information that we don't. (Either that or you're talking out of your hat, which wouldn't be unique on this forum.) Can you give us some more info, or a link, or at least a small clue?

author: bd139
author_rank: Super Contributor
timestamp: August 17, 2017, 04:41:32 pm
content: Try and download the source code from the medium article and you'll see.

author: firewalker
author_rank: Super Contributor
timestamp: August 17, 2017, 04:49:38 pm
content: The article could very well be a scam effort.Alexander.

author: senso
author_rank: Frequent Contributor
timestamp: August 17, 2017, 05:12:06 pm
content: It sends you here:https://satoshibox.com/fwipady7nvbqoqreeso4cf82And I didn't find another place that as the code.

author: bd139
author_rank: Super Contributor
timestamp: August 17, 2017, 05:31:28 pm
content: It's ether a scam or asshats:1. Find a flaw in something and publish as an alias on an anonymous publication platform.2. Demand 0.5 BTC for a canned exploit or 2 BTC for the source. All anonymous.There's no guarantee that's not a zip with "fuck-you.txt" in it.Versus Responsible disclosure:1. Contact vendor with disclosure and give them three months to sort it (in this case, close shop because the product is shit). Vendor can get a CVE sorted for it.2. Release the source publicly.3. Self promo based on (2).This is all about selling this exploit. GCHQ, NSA, Israeli gov, Russian federation, NK have probably already paid up now because it's chump change which helps no one.The flaw is probably legit but the researchers are dicks.

author: hans
author_rank: Super Contributor
timestamp: August 17, 2017, 08:15:12 pm
content: To be honest the article was annoying to read.Also, the picture shows a button at the reset pin. Personally I don't see how this can be used to glitch the device, unless you have a trained magic finger (or there is a huge fault in STM32s I'm currently ignorant of).There also seems to be some steps between prepared hardware and the final "memory dump" missing. Of course they want to have 8k$+ worth of BTC for that information. But as far as my ignorance stretches, I hope the STM32 has protection fuses set to block read/write SRAM/FLASH via SWD until you completely erase the chip.I suppose a custom application can be flashed via the bootloader (are firmware upgrades signature checked?) that takes the non-zero initialized SRAM memory dump from the bootloader and dumps it. Assuming that indeed that piece of information is true. But if that is the case, that certainly would be a huge flaw in the design.All in all I'm not convinced. Anyone can post a few pictures online with a button soldered to the reset pin of a board, an image of hand-crafted HEX dump and then ask thousands of dollars for the exact details that may indeed contain FU in it.