Ledger, the French maker of hardware cryptocurrency wallets, posts firmware updates, security fixes, and responses to researchers.
HN links its response to the Wallet.fail talk; one commenter praises the constructive reply, another calls Ledger inept at security and says the attack was not absurd.
Ledger | Senior Software Engineer, Software Engineer, Embedded Application Engineer | Paris, France | ONSITE
We build crypto-security solutions related to the blockchains with our unique technology: Blockchain Oriented Ledger OS (BOLOS). We provide this OS in 3 products:
- Cold storage Hardware Wallet solution for BtoC: Ledger Nano S (https://www.ledger.com/products/ledger-nano-s)
- Software and Hardware enterprise-grade Wallet: Ledger Vault (https://www.ledger.com/pages/ledger-vault)
- IoT security in a blockchain: We have a partnership with Engie (energy company) to log green energy production in a blockchain to ensure its tracability (https://www.ledger.fr/2018/10/10/engie-and-ledger-partner-to-develop-the-first-blockchain-hardware-securing-data-at-the-source-of-energy-production/)
We have 3 open positions:
- Senior Software Engineer, Scala, with some experience in Cassandra or ScyllaDB (https://ledger.welcomekit.co/jobs/senior-software-engineer_paris_LEDGE_RkPKyRm)
- Software Engineer, Scala and/or Python (https://ledger.welcomekit.co/jobs/vault-software-engineer_paris)
- Embedded Application Engineer, IoT (https://ledger.welcomekit.co/jobs/embedded-application-engineer_paris)
Backend Stack: Scala (Finatra, CatsIO, fs2.Stream) and Python 3 (Flask), ScyllaDB.
Infra: AWS, Ansible
Competitive salary and benefits, stock options, location in central Paris (75002)
You don’t need to speak French to join us, we all speak English. We offer French classes to non French…
Ledger has for a long time been grossly inept in security, there's really nothing absurd about this attack at all. In the Bitcoin industry we frequently see very detailed setup for long timeframe attacks and substantial effort going into identity theft and physical compromise. Worse, for these deices in particular a backdoored device is almost undetectable due to the way ECDSA can be used to transmit encrypted data in its signatures.
Ledger was recently compromised, or showed that they have no release process (both equally bad) by releasing a version of their application which stole user funds. Their claim is that they released a development version from a dirty git clone that contained "testing" code which happened to have a hardcoded address for sending every transaction to.
https://www.ledger.fr/2018/08/03/important-message-concerning-the-ledger-wallet-ethereum-chrome-app/
The "Ledger Bounty Program Reward Agreement" appears to have a clause that may allow Ledger to prevent a researcher from publish their own report.
>"You have complied and will continue to comply with the responsible disclosure process described in the Ledger Bounty Program which includes your agreement (a) not to disclose the security related bug to anyone without Ledger’s prior written consent," - [0]
I'm not a lawyer so I could be reading this wrong or maybe they never intended to enforce that clause.
[0]: Ledger Bounty Program Reward Agreement https://www.ledger.fr/wp-content/uploads/2018/03/Ledger-Bounty-Program-Reward-Agreement.pdf
On the ledger blog:
https://www.ledger.fr/2018/03/20/firmware-1-4-deep-dive-security-fixes/
> We would like to congratulate the three security researchers who found these bounties.
> Saleem Rashid – MCU fooling
> We fully appreciate their contribution, and they certainly deserve their rewards.
> We have asked each security researcher to sign our Ledger Bounty Program Reward Agreement, that you can review as part of our transparency process
> (this document doesn’t prevent the researcher to publish their own reports).
I didn't watch the 35c3 presentation, but it certainly looks like it's an absurd attack. Kudos to Ledger people for constructively replying to it.
Some talks in 35c3, defcon, etc remind me of the rubber hose security (https://xkcd.com/538/).
On the other hand, www.ledger.fr web site does not properly redirect to HTTPS (e.g http://www.ledger.fr/bounty-program/) and that would've been a more practical one.
Seems like Ledger finally published a security advisory[0].
It also seems like they finally accepted OP's bug report as part of their bounty program.
[0]: https://www.ledger.fr/2018/03/20/firmware-1-4-deep-dive-security-fixes/