15 Year Old Backdoors Ledger Hardware Cryptocurreny Wallet

[FirstArmada]

https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/

 

"There is absolutely no way that an attacker could replace the firmware and make it pass attestation without knowing the Ledger private key," officials said in 2015. Earlier this year, Ledger's CTO said attestation was so foolproof that it was safe to buy his company's devices on eBay.

 

On Tuesday, a 15-year-old from the UK proved these claims wrong. In a  post published to his personal blog , Saleem Rashid demonstrated proof-of-concept code that had allowed him to backdoor the Ledger Nano S, a $100 hardware wallet that company marketers have said has sold by the millions. The stealth backdoor Rashid developed is a minuscule 300-bytes long and causes the device to generate pre-determined wallet addresses and recovery passwords known to the attacker. The attacker could then enter those passwords into a new Ledger hardware wallet to recover the private keys the old backdoored device stores for those addresses.

 

Using the same approach, attackers could perform a variety of other nefarious actions, including changing wallet destinations and amounts for payments so that, for instance, an intended $25 payment to an Ars Technica wallet would be changed to a $2,500 payment to a wallet belonging to the backdoor developer. The same undetectable backdoor works on the $200 Ledger Blue, which is billed as a higher-end device. Variations on the exploit might also allow so-called "evil maid attacks," in which people with brief access to the device could compromise it while they clean a user's hotel room.

 

Good thing Ledger is french, if it was AT&T this kid would've had the FBI knock down his door in the middle of the night and spend the next decade inside a jail cell.

[Syntaxvgm]

What's with all these kids achieving shit. 

When I was 15 I was making my own wallhacks at best, most I ever achieved. 

Whoever cures cancer will be 14 I swear. 

[Nicnac]

1 minute ago, Syntaxvgm said:

What's with all these kids achieving shit. 

When I was 15 I was making my own wallhacks at best. 

I don't even know what I did when I was 15...

[FirstArmada]

5 minutes ago, Syntaxvgm said:

What's with all these kids achieving shit. 

When I was 15 I was making my own wallhacks at best. 

Whoever cures cancer will be 14 I swear. 

Being 15 fairly recently I can tell you majority are not, at least in Canada, it seems as if number of prodigies are rising while overall IQ is falling

[NovusBal]

When I was 15 I was eating freddos(FOR 5 PENCE EACH!) and swinging off trees, followed by a concussion, and that was for fun. Damn kids these days!

[vorticalbox]

17 minutes ago, NovusBal said:

When I was 15 I was eating freddos(FOR 5 PENCE EACH!) and swinging off trees, followed by a concussion, and that was for fun. Damn kids these days!

The price of fredos makes me sad.

 

When I was 15 I was hacking browser text games for lots of gold.

[bcredeur97]

When I was 15 I thought running a Minecraft server was some big accomplishment....

[paddy-stone]

When I was 15 I was using a sinclair spectrum, feeling up schoolgirls, and marveling at the new technology of the time, which was a dual VCR that could copy the tapes.

[edit] Thinking about it I may have been 16-17 for the dual VCR thing... NOT the schoolgirls thing as in my country we leave school at 16, and then I was working shifts and had not time to date

 

[SpaceGhostC2C]

1 hour ago, paddy-stone said:

When I was 15 I was using a sinclair spectrum, feeling up schoolgirls, and marveling at the new technology of the time, which was a dual VCR that could copy the tapes.

Yeah, and I'm supposed to believe that waiting for the Spectrum to read those cassettes left you enough time for girls 

[Brooksie359]

1 hour ago, paddy-stone said:

When I was 15 I was using a sinclair spectrum, feeling up schoolgirls, and marveling at the new technology of the time, which was a dual VCR that could copy the tapes.

[edit] Thinking about it I may have been 16-17 for the dual VCR thing... NOT the schoolgirls thing as in my country we leave school at 16, and then I was working shifts and had not time to date

 

Kinda weird that you specify schoolgirls. I mean at 15 who else would you be with?

[Tiber1337]

6 hours ago, Syntaxvgm said:

What's with all these kids achieving shit. 

When I was 15 I was making my own wallhacks at best, most I ever achieved. 

Whoever cures cancer will be 14 I swear. 

 

Well TBH kid's brains are on steroids compared to adults, the earlier he is exposed to a domain the better. For example every ChessMaster would never take on students who are older than 9-10, they claim their brain is already too old to be trained properly into thinking that much ahead. So prolly this kid started hacking when he was much younger.

[dalekphalm]

3 hours ago, Brooksie359 said:

Kinda weird that you specify schoolgirls. I mean at 15 who else would you be with?

The obvious answer is schoolboys? I mean, gay people exist, after all.

[paddy-stone]

3 hours ago, Brooksie359 said:

Kinda weird that you specify schoolgirls. I mean at 15 who else would you be with?

You'd be surprised, especially as I mentioned that we leave highschool at the age of 16. But yeah, was a bit redundant I guess as Most 15 year old schoolboys would be into schoolgirls.

[paddy-stone]

4 hours ago, SpaceGhostC2C said:

Yeah, and I'm supposed to believe that waiting for the Spectrum to read those cassettes left you enough time for girls 

LOL - now why didn't I think of that instead of watching some lame TV shows while I waited

 

[DoctorWho1975]

5 hours ago, paddy-stone said:

 feeling up schoolgirls

 

 

Now you'll end up being outed on social media, arrested with adult charges and expelled from school.

[Brooksie359]

13 hours ago, dalekphalm said:

The obvious answer is schoolboys? I mean, gay people exist, after all.

My point was they could have left it at girls.

[QuantumBit]

Hmm a topic about a backdoor just majorly derailed into going on about how a guy said "schoolgirls" instead of "girls"

[paddy-stone]

4 hours ago, VegetableStu said:

well this schoolboy was into schoolkickinghardwaresecurityinthebutt

Yeah unfortunately I was born too early IMO, and we didn't even have an internet as we know it today at that time... I was 19-20 when Berners-Lee? created TCP and we actually had a world wide web to speak of. And although that was a good time, few people had the resources to spend on PCs at the time IMO. I got my first x86 PC in 1994-5 with a pentium 90 and even then that was expensive. Defintely more expensive than todays PCs, and they didn't come with cd-roms, modems or GPUs... IIRC it was around £1000-1200 for a very basic PC, and I got the cd-rom and soundcard for an additional £150. I didn;t even get a modem and dial-up until around 1999, and was massively relieved when we could finally get broadband in 2001-2002, even at 256KB/s was massively faster than dial-up and seemed amazing at the time

18 hours ago, DoctorWho1975 said:

 

Now you'll end up being outed on social media, arrested with adult charges and expelled from school.

 

I didn't mean against their will, LOL

 

5 hours ago, Brooksie359 said:

My point was they could have left it at girls.

 

Yes I could have, but at a certain age, talking about your achool days, you generally say schoolgirls and schoolboys, just to be specific.

[Brooksie359]

1 hour ago, paddy-stone said:

Yeah unfortunately I was born too early IMO, and we didn't even have an internet as we know it today at that time... I was 19-20 when Berners-Lee? created TCP and we actually had a world wide web to speak of. And although that was a good time, few people had the resources to spend on PCs at the time IMO. I got my first x86 PC in 1994-5 with a pentium 90 and even then that was expensive. Defintely more expensive than todays PCs, and they didn't come with cd-roms, modems or GPUs... IIRC it was around £1000-1200 for a very basic PC, and I got the cd-rom and soundcard for an additional £150. I didn;t even get a modem and dial-up until around 1999, and was massively relieved when we could finally get broadband in 2001-2002, even at 256KB/s was massively faster than dial-up and seemed amazing at the time

 

I didn't mean against their will, LOL

 

 

Yes I could have, but at a certain age, talking about your achool days, you generally say schoolgirls and schoolboys, just to be specific.

I mean when you say 15 that seems like it would be implied unless you specified to the contrary. It just sounds weird to say schoolgirl tbh. I honestly don't even know of many people who use the term like ever.

[paddy-stone]

16 minutes ago, Brooksie359 said:

I mean when you say 15 that seems like it would be implied unless you specified to the contrary. It just sounds weird to say schoolgirl tbh. I honestly don't even know of many people who use the term like ever.

Must be an age thing then and maybe country specific also.. older generation definitely say it, like "when I was a schoolboy of 15" kind of thing. As I said, I erred on this occasion and made a redundant statement somewhat. But not all schoolboys date schoolgirls, some date college girls, girls that work instead of going to any further education etc. when you're that age and leave school at 16, you might be dating a girl that's already left school, and so on.

Implied statements can be wrong, so it's better to be specific where possible anyway IMO.

 

What's your age? if you're under 30 or even 40, then you're probably less likely to hear or use the terms maybe. when the older generations reminisce, they are more likely to use the terms IMO.

[Tieox]

I do love how bent out of shape people get over words.  When I was a teenager at school we had a term for it that was drilled into you.

 

Sticks and stones.

 

Fucking learn it.

[Beskamir]

On 3/21/2018 at 6:44 AM, Syntaxvgm said:

What's with all these kids achieving shit. 

When I was 15 I was making my own wallhacks at best, most I ever achieved. 

Whoever cures cancer will be 14 I swear. 

Exactly this. I'm pretty competent and have made some nice stuff in the 21 years I've been alive but it's nothing exceptional. Like I've got a freenas server, pfsense router (for my vpn server), pretty decent github profile (most of which is private atm and the remainder is on my own gitgogs server), etc. but while these put me ahead of the majority it's nothing close to what some of these kids are capable of. Worse seeing stuff like this of kids doing impressive stuff makes me feel like I had in some way failed myself.

 

On 3/21/2018 at 6:50 AM, FirstArmada said:

Being 15 fairly recently I can tell you majority are not, at least in Canada, it seems as if number of prodigies are rising while overall IQ is falling

*Gasp* maybe IQ is just like the Dark Side of the Force! It does best if it can accumulate and concentrate in a few individuals rather than being spread over an empire. We need a Darth Bane that'll introduce the order of academia or something

[MyName13]

7 hours ago, ElfFriend said:

Exactly this. I'm pretty competent and have made some nice stuff in the 21 years I've been alive but it's nothing exceptional. Like I've got a freenas server, pfsense router (for my vpn server), pretty decent github profile (most of which is private atm and the remainder is on my own gitgogs server), etc. but while these put me ahead of the majority it's nothing close to what some of these kids are capable of. Worse seeing stuff like this of kids doing impressive stuff makes me feel like I had in some way failed myself.

 

 

Parents affect kids a lot, so blame your parents

 

Quote

*Gasp* maybe IQ is just like the Dark Side of the Force! It does best if it can accumulate and concentrate in a few individuals rather than being spread over an empire. We need a Darth Bane that'll introduce the order of academia or something

I don't think this guy's IQ has anything to do with this, it's more likely his interest.Imagine being locked in a room with some devices, you'd either examine them completely or die of boredom, that's the reason why some young people do things older people can't (or maybe he has a lot of free time).

[Syfes]

On 21-3-2018 at 1:46 PM, Nicnac said:

I don't even know what I did when I was 15...

I could tell you what I was doing back then, but that would definitely get me banned from the LTT forums...

[Nicnac]

2 hours ago, Syfes said:

I could tell you what I was doing back then, but that would definitely get me banned from the LTT forums...

stealin cars and f***ing bi***es?