1

Why can't a hacker edit the Ledger Chrome app to display the address the user thinks he's sending to while actually sending to a different address?

Suppose the scenario: Ledger employee wants a nice retirement, puts out a "software update" to the Chrome app to send all ETH to his address while the software shows the addresses the user thinks they're sending to; steals a bunch of ETH from many users at once before the message spreads on social media warning people to stop using the app. (Or suppose it's someone who hacked their software repository unbeknownst to Ledger.)

  • Related - The Clipboard Hijack Attack (external link): Bitcoin Malware Changes Destination Wallet To Steal 13 BTC – Richard Horrocks Dec 19 '17 at 12:08
  • This attack appears tangentially related: It appears here when the user copy+pasted, a different address was pasted visibly, so that the attack could have been thwarted by double-checking prior to submission. I am suggesting here that the application properly displays the input address, yet sends to a different address. It could be realized after the fact by checking etherscan, but by then hundreds could have been affected worldwide effectively simultaneously. It depends, of course, on how the software and hardware work together. I wonder about the hardware not showing the full address, #...#. – Internet User Dec 19 '17 at 12:19
1

This attack has recently (Jan 2018) been discovered in Ledger devices. Here is the report about it https://www.docdroid.net/Jug5LX3/ledger-receive-address-attack.pdf

The Attack

Ledger wallets generate the displayed receive address using JavaScript code running on the host machine.

This means that a malware can simply replace the code responsible for generating the receive address with its own address, causing all future deposits to be sent to the attacker.

Because receive addresses are consistently changing as part of the usual activity of the wallet, the user has no trivial way (like recognizing his address) to verify the integrity of the receive address.

As far as he knows, the displayed receive address is his actual receive address.

What Makes This Even Worse

  • All the ledger wallet software is located in the AppData folder, meaning that even an unprivileged malware can modify them (no need to gain administrative rights).
  • The ledger wallet doesn’t implement any integrity-check/anti-tampering to its source files, meaning they can be modified by anyone.
  • All the malware needs to do is replace one line of code in the ledger software, this can be achieved with less than 10 lines of python code.
  • New ledger users would typically send all their funds to the wallet once initialized. If the machine was pre-infected, this first transaction may be compromised causing the user to lose all of his funds.
  • The attack changes the receive address during its generation, causing even the automatically generated QR to be updated to the attacker’s address. Meaning that both the string and QR representations of the address are compromised.

Advice for Existing Ledger Customers

If you’re using the Bitcoin App – Before every receive transaction validate the integrity of the address using the monitor button.

If you’re using the Ethereum App – Treat the ledger hardware wallet the same as any other software- based wallet, and use it only on a Live CD operating system that is guaranteed to be malware-free. At least until this issue receives some kind of fix.

0

Why can't a hacker edit the Ledger Chrome app to display the address the user thinks he's sending to while actually sending to a different address?

He can1, just like he can hack your personal machine and install a keylogger or any other malware. The question isn't can he, but how likely is he to be able to given the protections in place.

(1I'm not concerned with how he might do this. I'm going down the "nothing is bulletproof" line of reasoning. Perhaps he doesn't hack the "real" app, but phishes you into installing a corrupt version, etc., etc..)

Suppose the scenario: Ledger employee wants a nice retirement, puts out a "software update" to the Chrome app to send all ETH to his address while the software shows the addresses the user thinks they're sending to; steals a bunch of ETH from many users at once before the message spreads on social media warning people to stop using the app. (Or suppose it's someone who hacked their software repository unbeknownst to Ledger.)

Yep, again, entirely possible. But you should be more concerned with how possible. Are they likely to have processes in place to stop this happening? Probably. Do you trust their reputation enough to ensure these processes are followed? That's for you to decide.

Security is a series of trade-offs and compromises. If you want to use their hardware and software, then you have to compromise on trust, just as you do when you trust your OS firewall or antivirus software to protect you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.