Our attack begins by re-enabling the integrated bootloader of the processor using a fault-injection attack. This integrated bootloader has functionality to read-out the flash contents of the device, but verifies the protection-level of the chip while executing the command. By utilizing a second fault-injection attack it is possible to circumvent this check, and then the entire flash-contents of the device can be extracted 256 bytes at a time. By repeating the attack it is possible to extract all of the flash contents. Additionally, because the Trezor firmware utilizes an encrypted storage, we developed a script to crack the PIN of the dumped device, leading to a full compromise of the security of the Trezor wallets. The script was able to brute force any 4-digit pin in under 2 minutes. This attack demonstrates that the STM32-family of Cortex-M3/Cortex-M4 microcontrollers should not be used for storage of sensitive data such as cryptographic seeds even if these are stored in encrypted form.
It took Kraken Security Labs just 15 minutes to hack both of @trezor’s crypto hardware wallets. :
The security research team at Kraken has found a way to hack into the popular Trezor bitcoin hardware wallet. In merely 15 minutes with physical access to the device, the team extracted seeds from the wallet.
According to Kraken, Trezor Model T and Trezor One have a security flaw which makes the physical theft of seed possible in just 15 minutes. They said that hacking could be done using equipment costing a few hundred dollars. In an even scarier note, they added, 2ff7e9595c
コメント