BitBoxApp 4.16.0 with BitBox02 Firmware 5.0.0 Release

Shift Crypto
Dec 17, 2019 · 4 min read

This update includes an important security patch in the firmware, as well as new features in the BitBoxApp and BitBox02. We recommend that you update to the latest desktop app and firmware before you next use your BitBox02.

Image for post
Image for post

What happened?

On 14 October 2019, LazyNinja responsibly disclosed to us through our bug bounty program a vulnerability regarding raising the unlock attempts through a side-channel attack on the BitBox02 microcontroller unit (MCU). The secure chip still limits the total number of unlock attempts. The update released today patches the vulnerability, and we strongly encourage all users to update to the latest desktop app and BitBox02 firmware. We have no reports of lost funds and have found no evidence that the vulnerability was exploited. We would like to thank LazyNinja for his support in improving the security of our products.

Am I at risk?

If you chose an easy-to-brute-force password (for example using only a few characters or not using a mix of lowercase, uppercase and digits) and you allowed an attacker physical access to your BitBox02 for longer periods of times (months in total) then the attacker could have unlocked your device, bypassing the set limit of 10 attempts in the process. Thanks to our security-in-depth, a brute force attack to guess the password would still be limited to 730’500 attempts. This is the hard upper limit because of the configuration of the secure chip. Assuming a special made device for brute-forcing needs about 10 seconds to guess a password, reaching the upper limit would take approximately 85 days (non-stop). The probability of an attacker guessing, for example, a random 5 character password using lowercase, uppercase and digits is 0.08%, 6 characters is 0.012%, and 7 characters is 0.00002%.

Since in the BitBox01 the capabilities of the secure chip are not leveraged like in the BitBox02 (see an explanation in this blog post), protection against physical access is not in scope. Please use a strong password to stay safe.

What should I do to stay safe?

Be sure to always use the latest desktop app and firmware. You can download the latest desktop app 4.16.0 here: https://shiftcrypto.ch/start.

The desktop app has the latest firmware embedded inside. The desktop app will guide you through the process of how to install the firmware on the BitBox02. Prior to updating, you can optionally verify your backups by following our BitBox Backup Verification Guide.

What’s new: BitBoxApp 4.15.0 and 4.16.0

You now have the option to buy bitcoin in the BitBoxApp through Safello (SEPA region). This feature is an initial option we decided to offer, and we plan to continue adding similar services depending on customer demand. Safello allows you to buy bitcoins using your credit card. As is currently customary, they require KYC and the fee is 7%.

We have added translations of the app to Chinese, Persian, Turkish, and Bulgarian.

There was an issue with the confirmation count when using a recent version of Electrs as a backend to the BitBoxApp. This is now fixed, and Electrs can be used seamlessly.

What’s new: BitBox02 (firmware 5.0.0)

We added support for two more ERC20 tokens in the BitBox02 Multi: USD Coin (USDC) and Multi-Collateral Dai (DAI). We renamed the old Single Collateral Dai token to Sai in our app and you will now see both in our app until Sai shuts down (the date of which is to be determined). For more information, please refer to the MakerDAO upgrade timeline: https://blog.makerdao.com/single-coallateral-dai-to-multi-collateral-dai-upgrade-timeline-and-actions/

What is Sai/Dai? What do I do?
First, if you are unsure which token you are holding, please make sure to activate both SAI and DAI in the BitBoxApp settings. Multi-Collateral Dai launched on November 18, 2019 and the name (and ticker) of the old Single Collateral Dai changed to Sai (SAI). If you held Dai on the BitBox02 before the upgrade on November 18, you will now see it as Sai in the BitBoxApp. This means you need to migrate your funds using https://migrate.makerdao.com/. If you only see Dai in our App, you are all set and don’t need to do anything.

We have improved the U2F user experience to be much easier to use. The confirmation screen on the BitBox02 does not refresh repeatedly anymore, making it easier to confirm. On Windows, the user is still required to do one extra refresh of the website if the device is locked. We are working on a solution for that as well.

Following our customer feedback, we changed the passphrase entry: instead of confirming it twice, you now enter it once and then visually confirm it. This is much faster and more convenient to use. The passphrase is an optional feature that can be enabled in the “Expert settings”. To learn more about it, please read our user guide.

How can I stay up-to-date?

We encourage you to sign up to the security announce mailing list to stay up to date with the latest security news from Shift, including release notes and bug fixes, by following this link: https://groups.google.com/a/shiftcrypto.ch/group/security-announce/subscribe.

As always, please do not hesitate to contact us at support@shiftcrypto.ch if you have any questions.

Thank you for your continued support.

The Shift Cryptosecurity Team

ShiftCrypto

Swiss made hardware wallet BitBox02. Get yours: https://shiftcrypto.shop

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store