BitBoxApp 4.16.0 with BitBox02 Firmware 5.0.0 Release
This update includes an important security patch in the firmware, as well as new features in the BitBoxApp and BitBox02. We recommend that you update to the latest desktop app and firmware before you next use your BitBox02.
What happened?
On 14 October 2019, LazyNinja responsibly disclosed to us through our bug bounty program a vulnerability regarding raising the unlock attempts through a side-channel attack on the BitBox02 microcontroller unit (MCU). The secure chip still limits the total number of unlock attempts. The update released today patches the vulnerability, and we strongly encourage all users to update to the latest desktop app and BitBox02 firmware. We have no reports of lost funds and have found no evidence that the vulnerability was exploited. We would like to thank LazyNinja for his support in improving the security of our products.
Am I at risk?
If you chose an easy-to-brute-force password (for example using only a few characters or not using a mix of lowercase, uppercase and digits) and you allowed an attacker physical access to your BitBox02 for longer periods of times (months in total) then the attacker could have unlocked your device, bypassing the set limit of 10 attempts in the process. Thanks to our security-in-depth, a brute force attack to guess the password would still be limited to 730’500 attempts. This is the hard upper limit because of the configuration of the secure chip. Assuming a special made device for brute-forcing needs about 10 seconds to guess a password, reaching the upper limit would take approximately 85 days (non-stop). The probability of an attacker guessing, for example, a random 5 character password using lowercase, uppercase and digits is 0.08%, 6 characters is 0.012%, and 7 characters is 0.00002%.
BitBox01 note
Since in the BitBox01 the capabilities of the secure chip are not leveraged like in the BitBox02 (see an explanation in this blog post), protection against physical access is not in scope. Please use a strong password to stay safe.
What should I do to stay safe?
Be sure to always use the latest desktop app and firmware. You can download the latest desktop app 4.16.0 here: https://shiftcrypto.ch/start.
The desktop app has the latest firmware embedded inside. The desktop app will guide you through the process of how to install the firmware on the BitBox02. Prior to updating, you can optionally verify your backups by following our BitBox Backup Verification Guide.
What’s new: BitBoxApp 4.15.0 and 4.16.0
Feature: Buy bitcoin with a credit card
You now have the option to buy bitcoin in the BitBoxApp through Safello (SEPA region). This feature is an initial option we decided to offer, and we plan to continue adding similar services depending on customer demand. Safello allows you to buy bitcoins using your credit card. As is currently customary, they require KYC and the fee is 7%.
Feature: Additional languages
We have added translations of the app to Chinese, Persian, Turkish, and Bulgarian.
Fix: Electrs API upgrade
There was an issue with the confirmation count when using a recent version of Electrs as a backend to the BitBoxApp. This is now fixed, and Electrs can be used seamlessly.
What’s new: BitBox02 (firmware 5.0.0)
Feature/Fix: DAI USDC
We added support for two more ERC20 tokens in the BitBox02 Multi: USD Coin (USDC) and Multi-Collateral Dai (DAI). We renamed the old Single Collateral Dai token to Sai in our app and you will now see both in our app until Sai shuts down (the date of which is to be determined). For more information, please refer to the MakerDAO upgrade timeline: https://blog.makerdao.com/single-coallateral-dai-to-multi-collateral-dai-upgrade-timeline-and-actions/
What is Sai/Dai? What do I do?
First, if you are unsure which token you are holding, please make sure to activate both SAI and DAI in the BitBoxApp settings. Multi-Collateral Dai launched on November 18, 2019 and the name (and ticker) of the old Single Collateral Dai changed to Sai (SAI). If you held Dai on the BitBox02 before the upgrade on November 18, you will now see it as Sai in the BitBoxApp. This means you need to migrate your funds using https://migrate.makerdao.com/. If you only see Dai in our App, you are all set and don’t need to do anything.
Fix: U2F
We have improved the U2F user experience to be much easier to use. The confirmation screen on the BitBox02 does not refresh repeatedly anymore, making it easier to confirm. On Windows, the user is still required to do one extra refresh of the website if the device is locked. We are working on a solution for that as well.
Fix: Passphrase entry
Following our customer feedback, we changed the passphrase entry: instead of confirming it twice, you now enter it once and then visually confirm it. This is much faster and more convenient to use. The passphrase is an optional feature that can be enabled in the “Expert settings”. To learn more about it, please read our user guide.
How can I stay up-to-date?
We encourage you to sign up to the security announce mailing list to stay up to date with the latest security news from Shift, including release notes and bug fixes, by following this link: https://groups.google.com/a/shiftcrypto.ch/group/security-announce/subscribe.
As always, please do not hesitate to contact us at support@shiftcrypto.ch if you have any questions.
Thank you for your continued support.
The Shift Cryptosecurity Team
