Comment by mikeryan
17 days ago
Selling Ledger wallets or compromised Ledger wallets? My understanding was a reputable reseller (Cryptobilis) was bought and then the wallets were modified via the reseller chain. This isn’t on Ledger it’s a (literal) supply chain attack. Unless MediaMarkt was buying via the reseller?
according to this guy, compromised (https://x.com/0xJohannes_/status/2109240472933671125). Interestingly, Mediamarkt removed the device from their shop quickly after (https://www.mediamarkt.de/de/product/_ledger-sas-nano-s-plus... now 404).
They would remove them regardless of known compromise, because they have no way to verify it in-house and it’s the simplest PR and legal strategy.
Verifying it in house is extremely easy once someone else has already done the hard work of identifying the existence of the implants in the first place.
Any random person who can play spot-the-difference with two different pictures and is armed with a hammer could verify it in 15 minutes.
They don't even have to be technical or understand what the chips do or how the technical aspects of the compromise work, a raw visual check is all you need.
> This isn’t on Ledger it’s a (literal) supply chain attack.
Supply chain attack?
"Can't do shit, not my problem."
If it was that easy to shed responsibility.
TBF that characterization was mine. It’s not been Ledger’s response AFAIK.
I don't know coin stuff, but if top comment's...
"We're talking here about a tiny eSIM implant and a little CPU doing OCR on the fonts appearing on the hardware wallet's screen to read the secrets during set up. So the secure element ain't tampered with."
...is accurate...it's one of the rare times I'd agree there's nothing they can do. And I was all prepared to storm in here saying "convenient excuse!"
>there's nothing they can do
The device should have bricked itself after someone opened it up to put hidden stuff inside. Also showing the key phrase to the user instead of keeping it secret to the secure element is a questionable decision.
11 replies →