How to Hack a Ledger Hardware Wallet

Note: this guide is for educational purposes only. Its sole intention is to educate users about attacks and help to understand how to protect themselves from hacks.

ABSTRACT —

Cryptocurrency wallets consist of a collection of private keys for spending funds and public keys for receiving funds. Most wallet clients will have a program that generates new public keys with every new transaction. This is done to protect a user’s privacy by scattering their funds across many addresses rather than just one.

THE ATTACK —

Ledger wallets are one of the many that generate new public keys for each receiving transaction. They accomplish this by using a simple JavaScript code that runs client-side. This means that malicious code can easily replace the automatically generated receiving address with a hacker’s.

Since public keys regularly change, users would not suspect any issues and have no way to verify the validity of the receiving address. As far as any user knows, the address displayed is their own.

PROBLEMS AT STAKE —

• Ledger doesn’t have any verification checks to ensure its source files have not been modified.
• The Ledger wallet software is located in the AppData folder, meaning malware doesn’t need administative access to modify them.
• The malware only needs to be programmed to change 1 line of code, which can be easily accomplished with a program consisting of just a few lines of code in Python.
• The changed code is also used to generate a QR code, meaning that even the QR code will be updated to the hacker’s address.

PROOF OF WORK—

1- Locate the Ledger wallet JavaScript file:

C:\Users\USERNAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\EXTENSION NAME\VERSION\src\wallet\wallet.js

2- Open the source file and locate this line:

return (_ref = this.wallet.cache) != null ? _ref.get(this.getCurrentPublicAddressPath()) : void 0;

3- Replace it with the following:

return “RECEIVING ADDRESS”;

The next time you try to deposit funds they will be sent to the address inserted, whether you copy the string or use the QR code.

REMEDIATION —

When depositing funds, there may be a small monitor button that appears on the bottom right of the receiving screen. Pressing this button will cause a correctly generated address show on the screen of the hardware wallet. If there is any variation between the addresses, DO NOT DEPOSIT FUNDS.

Note that this feature is not documented and is not a part of the receiving process, but it will help to remedy the issue at hand. A solution should be implemented to force the user to verify the receiving address.

ENDNOTE —

To improve the security of your hardware wallet, send a letter to Ledger by submitting a request HERE.

Follow me on twitter — @thepariscormier