Comment by whywhywhywhy
18 days ago
Use a device that’s mass produced enough it can’t be targeted e.g a MacBook, then keep it airgapped and don’t do normal computing on it.
18 days ago
Use a device that’s mass produced enough it can’t be targeted e.g a MacBook, then keep it airgapped and don’t do normal computing on it.
Hardware wallets are air-gapped. The issue here was a distributor got acquired and then snuck a chip in that could read the spi link between the microcontroller and the screen. The chip had its own cellular modem and could send the passphrase that was shown on the screen to the attackers.
If you sell a device specifically for storing large amounts of liquid assets, that puts a huge target on that device. You are basically asking for supply chain attacks
An ordinary MacBook does not have that issue. If you are a high-value target, you can further decrease your risk profile by buying it from a random physical store, further preventing targeted attacks.
Nobody said hardware wallets aren't air-gapped. They said take something normal and usual enough not to be an attractive target for bespoke crypto stealers, and then airgap that to make your wallet.
The post you're replying to is arguing that it wouldn't be feasible to do that with a MacBook (at least if you buy it off the shelf at Best Buy).
Boy that was a slog, to dig deep enough through the slop to find the technical details…
In retrospect @gigachad’s summary is worth as much as both articles combined, but for the Clauded technical source (with pictures!) that Ledger’s Claude-release refers to: https://www.tibane.net/research/ledger-nano-x-implant
>Hardware wallets are air-gapped.
The ones with hidden eSIMs aren't!
airgapped pre crypto devices are extra safe: break out the ti82! don’t buy a ti82 for this purpose, it has to be one you had in your closet. If a blog post describes how to code it in TiBasic then affiliate links a calculator in ebay, well…
As dense as MacBooks are, it is nearly trivial to fit a spying device inside them, especially compared to small hardware wallets like Ledger Nanos. As secure as macOS is, once a device is inside the chassis, there are numerous ways to read data. USB serial is easily decodable, as are the many SPI, I2C, and other buses inside the machine.
Keyboard traffic is plain. Bluetooth access depends on where you are positioned. DVI is not hard to decode for capturing the entire screen. KVMs are so small now that one could easily be snuck in. Even though the motherboard is very compact, there is space above it and near the batteries.
by buying a mass produced generalist device (preferably from a randomly chosen vendor) and then restricting it to a specialized purpose you are effectively negating a targeted attack.
I always assumed the people buying those crypto gadgets were idiots.
also, if Apple falls to a supply chain attack like this where their laptops are backdoored crypto theft will be problem number #10.
Qubes OS can be more secure than airgapping in some cases: https://doc.qubes-os.org/en/latest/introduction/faq.html#how...