Hardware wallet Ledger helps competitor Trezor resolve security vulnerability

Hardware wallet supplier Trezor has patched up a information flaw successful 2 of its latest models aft rival steadfast Ledger’s open-source probe limb discovered a vulnerability successful their microcontrollers. 

Ledger Donjon acknowledged Trezor has made respective information advancements of precocious but recovered cryptographic operations could inactive beryllium performed connected the microcontroller of Trezor’s Safe 3 and 5 models, which could marque them “vulnerable to much precocious attacks.”

Fortunately, Trezor has since addressed the vulnerabilities found, Ledger’s main exertion serviceman Charles Guillemet said successful a March 12 X post.

“We judge that making the ecosystem much unafraid helps everyone, and is captious arsenic we propulsion towards broader adoption of crypto and integer assets,” Guillemet added.

Source: Charles Guillemet

Trezor had already implemented “Secure Elements” — chips designed to protect the user's PIN code and cryptographic secrets — arsenic immoderate of Trezor’s devices could beryllium tampered with by modifying the bundle moving connected it, perchance allowing menace actors to bargain idiosyncratic funds.

The Secure Elements diagnostic “effectively thwarts immoderate inexpensive hardware attack, successful peculiar voltage glitching,” Ledger said successful a March 12 post.

“[This] gives users assurance that their funds are harmless adjacent if their instrumentality gets misplaced oregon stolen.”

However, Ledger recovered different imaginable onslaught vector stemmed from the microcontroller, the different main portion of Trezor’s two-chip design for its Safe 3 and 5 models.

Trezor implemented a firmware integrity cheque to observe modified software, but Ledger was capable to show that an attacker could inactive bypass this information check.

This contented has since been resolved by Trezor — though neither Ledger nor Trezor person explained how. Cointelegraph reached retired to Trezor but didn’t person an contiguous response.

Trezor’s microcontroller successful the Trezor Safe 3 model. Source: Ledger

Trezor confirmed connected X that idiosyncratic funds stay harmless and that nary enactment is required.

Related: ‘Dark Skippy’ method tin bargain Bitcoin hardware wallet keys

However, erstwhile asked whether Trezor was capable to spot this contented via firmware, the hardware wallet supplier responded: “Unfortunately not.”

“In cybersecurity, the aureate regularisation is simple: thing is afloat unbreakable. That’s wherefore we person already implemented a multi-layer defence against proviso concatenation attacks and ever counsel our users to acquisition from authoritative sources.”

Ledger isn’t immune to security vulnerabilities either.

In December 2023, a hacker committed a information breach into Ledger’s connector library and stole $484,000 worthy of crypto assets.

Another menace histrion who breached Ledger’s systems published the mailing addresses of astir 270,000 Ledger customers successful June 2020.

Magazine: Crypto fans are obsessed with longevity and biohacking: Here’s why