Another blow for the French company Ledger. Indeed, after a hack of certain personal data last week, a new security flaw has appeared. And this is even more important, since we are talking about the possibility of Bitcoin (BTC) theft! In this article, we will see in detail what this flaw is, and recommendations for your security.
Discovery of the fault by Monokh
In a long blog post, Monokh explains and details the security flaw that LEDGER devices suffer from. It seems that all the products of the French cybersecurity firm are concerned.
Indeed, the flaw affects the firmware (software) and not the hardware. The good news is that a software update by Ledger is therefore possible, and the flaw can be fixed for everyone. So don't throw your Ledger out the window!
Expected operation
Before describing the flaw, a little reminder of how your Ledger works.
When you want to use crypto on your Ledger, you need to install the corresponding application. So there is a Bitcoin app, a Litecoin app, a Dash app, etc.
The applications are supposed to be isolated from each other. Thus, when you want to transfer one of your cryptos, only the corresponding application is unlocked. By being unlocked, it can:
Export public keys;
Sign messages;
Confirm transactions.
Ledger applications
Thus, if you are handling Ethereum (ETH), only the Ethereum app is unlocked. You are then able to send them, but under no circumstances will you be able to confirm a Bitcoin transaction at the same time for example.
Explanation of the flaw
This flaw allows Bitcoin and Bitcoin forks applications to be unlocked at the same time. And therefore to interact with the Bitcoin app when it is the Litecoin app that we wanted to use for example.
The flaw therefore has two consequences:
Disclosure of your Bitcoin XPUB (all Bitcoin public addresses of your Ledger), and therefore, the amount of your funds;
Send Bitcoin transactions which will appear as altcoins transactions to the user.
Thus, Monokh managed to camouflage a Bitcoin transaction request as a Litecoin transaction request. The user therefore opens their Litecoin app, confirms the transaction, thinking they are sending LTCs, and ends up sending bitcoins against their will.
Deaf ear from Ledger
Monokh indicates in his blog article that he had warned Ledger for several months about this flaw.
Extract from Monokh blog post on the Ledger vulnerability Extract from Monokh blog post on the Ledger vulnerability
Despite the warnings and reminders, Ledger would not have acted accordingly. This is why Monokh chose to publicize the breach on Monday, August 3 through his article.
Ledger Response
Ledger’s cybersecurity team, Ledger Donjon, responded a day later (Tuesday, August 4) with an article.
In the latter, Ledger explains the flaw again, going into the technical details of the why and how.
Thus, we learn that it is the crypto bypass path that compromises the tightness of the various applications.
In addition, the company says it faces a complex choice between ensuring the safety of users and the use of their ledgers. Indeed, this flaw cannot be corrected without “breaking” certain things.
Thus, Ledger explains that changing the current behavior of apps could result in:
Incompatibility with other wallets;
An inability to use Bitcoin forks.
That's why they decided not to fix the flaw immediately. At this time, a warning message appears if you are about to confirm a transaction that appears to be abnormal.
In addition, their article will be updated when a new version of the Bitcoin app is released (to permanently resolve the flaw).
Safety recommendations
So in the end, are your Ledger and your funds in danger? No. Not directly. Just take care when sending your Bitcoin fork funds outward. Just check that you are on a platform you can trust!
But for all other cryptos, the flaw has no impact, no worries. Moreover, this flaw can only take place during sending. Storage is never compromised, you can let your cryptos and bitcoins sleep on your key without any hassle.
