Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/23/2018
03:52 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Software is Achilles Heel of Hardware Cryptocurrency Wallets

Upcoming Black Hat talk will detail software vulnerabilities that can put private cryptocurrency wallets and currency exchange services at risk.

Cryptocurrency exchanges and private wallets have been fully in cyberattacker crosshairs as criminals seek to make the most of an exploding new financial market that some analysts say will reach $1 trillion by the end of the year. In response to these attacks, a number of manufacturers have come out with secure hardware wallets meant to harden the storage of the cryptographic keys that serve as proof of ownership of vast sums of money. However, a new piece of research expected out of Black Hat USA next month shows that these secure hardware storage devices may not be as locked down as their users expect them to be.

Presented by Sergei Volokitin, the research will show how software attacks can be used to break the Secure Element, the supposedly tamper-resistant hardware platform upon which these hardware wallets base their protection. Volokitin found vulnerabilities in these wallets' trusted execution environment (TEE) operating systems that could be manipulated to compromise memory isolation and cause the wallet to give up operating system and application secrets.

"Despite the fact that the device makes use of secure hardware to protect the private keys, a number of flaws in the software design and implementation allowed us to create various attack scenarios, including remote, physical and supply chain attacks," explains Volokitin, who works as a security analyst for Riscure, a global security test lab based in the Netherlands. 

Using the identified vulnerabilities, anybody who can get physical access to the hardware wallet would be able to steal keys and data from the device. What's more, an attacker could theoretically create a supply chain attack where they poison the device from the get-go in order to gain full control of wallets on the device once users started putting data into the hardware's applications. It might sound like a far-fetched attack scenario, but given the stakes it's not unreasonable to consider.

"In cryptocurrency hardware wallets, the stakes are high, since single private key is the only asset preventing an attacker from stealing the coins and getting away with it," says Volokitin.

While particularly troubling for the cryptocurrency ecosystem, Volokitin's research also has broader implications across enterprise security. It's another lesson that hardened secure devices are only as tamper-proof as the firmware and other software embedded within them. 

"Although the hardware wallets are primarily designed to be used in cryptocurrency-related solutions, from a security point of view they are not much different from any other security devices," he says. "In fact, one of the compromised applications on the device was the secure application for FIDO authentication, which can be used in many other applications as well."

He explains that generally it is very difficult for end customers to evaluate the risk of using a hardware security device if it does not require mandatory certification.

"The main questions the end users of such secure devices need to ask themselves/the manufacturer is what manufacturer did to improve the security of the device," he says, explaining they should be looking for vendors that do extensive testing of their hardware products. "Doing an evaluation of a security solution by a third party, through an evaluation or a bug bounty, is an effective way to improve security of a product."

 

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-28026
PUBLISHED: 2021-03-05
jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can trigger arbitrary code execution or a denial of service.
CVE-2021-27907
PUBLISHED: 2021-03-05
Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javasc...
CVE-2021-20663
PUBLISHED: 2021-03-05
Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and ea...
CVE-2021-20664
PUBLISHED: 2021-03-05
Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlie...
CVE-2021-20665
PUBLISHED: 2021-03-05
Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and ear...