It was found that the Ledger Nano S bootloader can be tricked into flashing and executing untrusted firmware.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Watch this video and more on Hextree: https://app.hextree.io/courses/yt-crypto-wallet/hardware-wallet-security
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy
Research Site: https://wallet.fail/
Twitter: https://twitter.com/walletfail
Thomas Roth: https://twitter.com/stacksmashing
original wallet.fail talk: https://www.youtube.com/watch?v=Y1OBIGslgGM
The bootloader is used to update the firmware of the 'non-secure' processor in the Ledger Nano S and has full control over the display, USB and the buttons. Time might tell how critical this issue actually is, a strong proof-of-concept still requires a lot of work and maybe the guys from wallet.fail will publish more in the future. Or join the security research and play around with it yourself!
CHAPTERS
00:00 - What the Ledger Nano S Vulnerability Means
02:22 - How the Bootloader Updates Firmware Over APDU
04:36 - The f00dbabe Boot Protection
06:25 - Bypassing the Write Check Through Memory Aliasing
07:53 - What Malicious Firmware Could Control
09:22 - The Security Problem With the Dual-Chip Design
09:56 - Threat Modeling the Secure Element
11:22 - The Untrusted MCU as a Man in the Middle
12:23 - The Secure Channel and Ledger's Position
13:04 - Why the Display and Buttons Still Matter
14:30 - A Self-Restoring Malicious Firmware Proof of Concept
SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/
WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog
#HardwareSecurity #SecurityResearch
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
