Trezor Hardware Wallet Hacked in 15 Minutes
By Marko Vidrih on The Capital
Experts at the security laboratory of the Kraken cryptocurrency exchange showed a method for extracting and cracking seed phrases from the Trezor One and Trezor Model T hardware crypto-wallets. The hack requires 15 minutes of physical access to the Trezor and the $75 device.
The attack is possible due to vulnerabilities inherent in the microcontroller used in Trezor wallets.
“Unfortunately, this means that it will be difficult for the Trezor team to do anything with this vulnerability without processing equipment,” the experts say.
Until the vulnerability is fixed, they recommend that users do not provide physical access to their devices to third parties, as this can lead to the loss of all cryptocurrencies stored in them. In addition, they should activate the passphrase using the BIP39 scheme in the Trezor client. The authors note that this may complicate the use of the wallet, but the passphrase is not stored in it and therefore protects against the described attack.
Kraken previously described the attack on KeepKey wallet. In their latest publication, they note that the attack on Trezor is very similar to the first — all of these devices use the same chip family. As in the case of KeepKey, the attack on Trezor is carried out by means of a “voltage failure” in the chip, which opens up the possibility of extracting the seed phrase. Hacking the PIN code used to protect this phrase, according to experts, does not present any problems and is carried out by brute force.
Representatives of Trezor in March 2019 commented on one of the variations of such an attack. Then they recognized the existence of vulnerabilities, but drew attention to the complexity of such attacks in practice and recommended that users set passphrases to completely stop the possibility of unauthorized access.
According to Kraken, the chips used in these wallets were not originally designed to store sensitive information and should not be the only means of protecting cryptocurrency assets for the user.
Kraken notes that although similar experiments with Trezor wallets were carried out before them, they were the first to publish full technical details of this attack, which may be of interest to specialists.
Author: Marko Vidrih
Featured image credit: trezor.io
