Comment by dboreham

On a whim I read TFA. What it reported as happening isn't quite what some of the comments here represent. Now, I'm sure there are all kinds of vulnerabilities in Ledger, but this attack seems to be a quite crude supply chain attack mounted on some part of Ledger's retail distribution network. It's actually not even clear that's the case because it talks about these being sold for "half the usual price" so they may have been gray market or second hand. Anyway, this is like buying a Yubikey from Amazon or eBay. You don't do that because Yubico sells direct, which is how you should buy them, to avoid obvious supply chain attacks.

There are other elements of the article that are confused: an "eSIM" is SOFTWARE, not a "tiny chip". Perhaps they mean a "realSIM"?? The SIM is of course only needed to authenticate to a cell network. The article mentions an LTE module. So the e/not-e-SIM aspect seems a little by the by. The main meat of the trojan was a regular ARM SoC.