What's to stop Ledger from sending to a hacker's address?

Question

Why can't a hacker edit the Ledger Chrome app to display the address the user thinks he's sending to while actually sending to a different address?

Suppose the scenario: Ledger employee wants a nice retirement, puts out a "software update" to the Chrome app to send all ETH to his address while the software shows the addresses the user thinks they're sending to; steals a bunch of ETH from many users at once before the message spreads on social media warning people to stop using the app. (Or suppose it's someone who hacked their software repository unbeknownst to Ledger.)

Answer 1

Why can't a hacker edit the Ledger Chrome app to display the address the user thinks he's sending to while actually sending to a different address?

He can¹, just like he can hack your personal machine and install a keylogger or any other malware. The question isn't can he, but how likely is he to be able to given the protections in place.

(¹I'm not concerned with how he might do this. I'm going down the "nothing is bulletproof" line of reasoning. Perhaps he doesn't hack the "real" app, but phishes you into installing a corrupt version, etc., etc..)

Suppose the scenario: Ledger employee wants a nice retirement, puts out a "software update" to the Chrome app to send all ETH to his address while the software shows the addresses the user thinks they're sending to; steals a bunch of ETH from many users at once before the message spreads on social media warning people to stop using the app. (Or suppose it's someone who hacked their software repository unbeknownst to Ledger.)

Yep, again, entirely possible. But you should be more concerned with how possible. Are they likely to have processes in place to stop this happening? Probably. Do you trust their reputation enough to ensure these processes are followed? That's for you to decide.

Security is a series of trade-offs and compromises. If you want to use their hardware and software, then you have to compromise on trust, just as you do when you trust your OS firewall or antivirus software to protect you.

Answer 2

This attack has recently (Jan 2018) been discovered in Ledger devices. Here is the report about it https://www.docdroid.net/Jug5LX3/ledger-receive-address-attack.pdf

The Attack

Ledger wallets generate the displayed receive address using JavaScript code running on the host machine.

This means that a malware can simply replace the code responsible for generating the receive address with its own address, causing all future deposits to be sent to the attacker.

Because receive addresses are consistently changing as part of the usual activity of the wallet, the user has no trivial way (like recognizing his address) to verify the integrity of the receive address.

As far as he knows, the displayed receive address is his actual receive address.

What Makes This Even Worse

• All the ledger wallet software is located in the AppData folder, meaning that even an unprivileged malware can modify them (no need to gain administrative rights).
• The ledger wallet doesn’t implement any integrity-check/anti-tampering to its source files, meaning they can be modified by anyone.
• All the malware needs to do is replace one line of code in the ledger software, this can be achieved with less than 10 lines of python code.
• New ledger users would typically send all their funds to the wallet once initialized. If the machine was pre-infected, this first transaction may be compromised causing the user to lose all of his funds.
• The attack changes the receive address during its generation, causing even the automatically generated QR to be updated to the attacker’s address. Meaning that both the string and QR representations of the address are compromised.

Advice for Existing Ledger Customers

If you’re using the Bitcoin App – Before every receive transaction validate the integrity of the address using the monitor button.

If you’re using the Ethereum App – Treat the ledger hardware wallet the same as any other software- based wallet, and use it only on a Live CD operating system that is guaranteed to be malware-free. At least until this issue receives some kind of fix.

Answer 3

Malware infected, delivered via a docx file, infected this computer, activated developer mode on Chrome, replaced Metamask with a malicious version, and stole $8 million from this account: https://www.youtube.com/watch?v=__8sGeBVYrM

In other words: you have to check that the operation you are approving is the operation you intend to approve. It is hard to do so on a small screen, you might consider using a Ledger device with a more readable display.