12 ms·

Extracting the private key from a TREZOR with an oscilloscope (2015)

399 points by mlejva 8y ago

atdrummond 8y ago
This was published in 2015. Updating to a more recent firmware, which requires a PIN when computing the public key, eliminates the utility of such an attack.
- deleted 8y ago
  [deleted]
- aaron_m04 8y ago
  Interesting. Do you have a link where I could read more about this?
  - cyphunk 8y ago
    https://github.com/trezor/trezor-mcu/commits/master?after=3185eb0fd444701e2bc976555545fe08d572c957+769 https://github.com/trezor/trezor-mcu/commits/master?after=31... As jochen mentions in his timeline in the post trezor asked he delay publication until they could fix the bug in release 1.3.3. he says they included a fix on Mar 30 which you'll find in the link above
sbhn 8y ago
Html5 oscilloscope if anyone needs one https://github.com/Sean-Bradley/Oscilloscope https://github.com/Sean-Bradley/Oscilloscope
bonyt 8y ago
It's amazing how hard it is to make something secure when considering side channels. Almost any bit of information can be used to extrapolate more - just consider this type of power-based attack, timing attacks, meltdown/spectre, CBC padding oracles, etc. Plus, suddenly people are pumping millions (or billions) into private keys on little devices, it is amazing.
- etherael 8y ago
  It seems that way from the outside, I'll grant. But I'll explain by analogy why I don't think it's as crazy as one might otherwise at first glance assume. It's possible to create gold artificially, but because of the cost of doing it vs just purchasing the natural stuff, you can be almost certain any gold you come into contact with is not artificially created. In much the same way, even though there are indeed tons of theoretical attacks that compromise various crypto keys linked to massive fortunes, because of the way the sector has evolved in terms of not making high value keys available in a low security context, and mitigating those threats in a high security context, the likelihood that any given crypto "account" you care to mention will ever be hacked is similarly low. It's not worth the attackers to invest the necessary resources to snag your minor android wallet stash, and even if they tried to bring those resources to bear on Xapo's vaults, they would fail. Also, the sector as a whole has basically pioneered a whole new class of security measures, at least to the extent they're now in reasonably wide circulation, and improved security consciousness and software in general around the space immensely, exactly because now a bug isn't just some time and embarrassment, it may well be losing millions of dollars in value. In that context it makes sense to invest in the security to do it right and think carefully about all possible attack surfaces and vulnerabilities.
nebulous1 8y ago
I did not know you could get dirt cheap USB oscilloscopes
- nickysielicki 8y ago
  My understanding is that generally speaking, it's throwing money at bad and you're much better off spending the $350-$500 or so for a proper entry-level scope. Check out the eevblog forums if you're in the market. [1] edit: it is worth noting that if you can deal with the design and hardware limitations, the limitations of the included proprietary software should not necessarily scare you off, sigrok [2] has support for a lot of these cheap devices. Since writing this comment, I also just discovered a newer project called openhantek [3], which seems to be very active. [1]: http://www.eevblog.com/forum/testgear/ http://www.eevblog.com/forum/testgear/ [2]: https://sigrok.org/ https://sigrok.org/ [3]: https://github.com/OpenHantek/openhantek https://github.com/OpenHantek/openhantek
  - nebulous1 8y ago
    Saw that OpenHantek when I was making sure I'd be able to use it with linux. I have no need for an oscilloscope, nor do I even know how to use one. They've always seemed pretty interesting to me, but when I've looked before I've managed to convince myself out of spending XXXX on something I may only use once. If we're talking in the sub 100 range then it seems like something I could use or not use, and then upgrade it if I actually find it wanting (ie I invest enough time to find something I want to do with it but can't). I think I'll do a bit more research anyway.
    - iamleppert 8y ago
      Not every use of money has to be “efficient”.
      - eric_h 8y ago
        Certainly - but it makes sense to optimize expenditures in the slightly uncomfortable range to avoid excessive waste.
zeroDivisible 8y ago
"Silence on the wire" [1] hypothesizes finding the state of systems from the outside world - or based on the lack of information. Found it entertaining to read and this article somehow reminded me about it. [1] https://www.goodreads.com/book/show/82994.Silence_on_the_Wire https://www.goodreads.com/book/show/82994.Silence_on_the_Wir...
- godelmachine 8y ago
  I got Silence on the Wire after reading your comment. Let's see how it is.
jnwatson 8y ago
The term of art for this kind of attack is SPA (simple power analysis). The fact that this is possible means that this is amateur hour engineering, with very little security QA. The more sophisticated attacks use DPA, differential power analysis, which accumulate the results of multiple runs and performs statistical analysis. When I was on a team that made a similar device over a decade ago, we were up to our eyeballs in academic papers about SPA and DPA hardware and software countermeasures. That doesn't mean we didn't make any mistakes, but at least we were knowledgeable enough to hook an oscilloscope up and see what's going on. These guys completely ignored an entire class of attacks, known in detail for a couple decades, (in reality since 1943, declassified 1972 ([1]). I wouldn't trust these guys to protect anything of value. [1] https://www.wired.com/2008/04/nsa-releases-se/ https://www.wired.com/2008/04/nsa-releases-se/
- dangero 8y ago
  Or those attacks were out of scope for this product.
  - fjsolwmv 8y ago
    Extracting a secret key from an supposedly PIN protected device looks in scope to me. What I don't understand is why this device recomputes the public key on each read, instead of storing it persistently after creation.
    - FLUX-YOU 8y ago
      >Extracting a secret key from an supposedly PIN protected device looks in scope to me. Prevented by not letting anyone casually hook up an oscilloscope to your TREZOR.
      - khedoros1 8y ago
        That sounds like a work-around/mitigation, not a solution.
touart 8y ago
There was another successful attack on another hardware wallet (Ledger) 3 months ago, by tampering the firmware used in one of the MCU - (Post by the author: https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/ https://saleemrashid.com/2018/03/20/breaking-ledger-security... ; HN thread: https://news.ycombinator.com/item?id=16627725 https://news.ycombinator.com/item?id=16627725)
nope96 8y ago
They hired him after this: https://medium.com/@satoshilabs/ethical-hacker-and-bitcoin-hero-johoe-joins-satoshilabs-as-trezor-cryptographer-36c9a6b10d52#.2wri5l7fx https://medium.com/@satoshilabs/ethical-hacker-and-bitcoin-h...
kxyvr 8y ago
Awhile back, I was looking at using a TREZOR as a U2F key. I liked it since the interface looked good, confirmation of sending the key on the device itself, and the software was open source. For those two reasons, it looked nicer than using a Yubikey, which closed it source with the Yubikey 4 and didn't provide confirmation on the device itself. That said, this attack didn't make the TREZOR look great. What's a good option for a U2F key? On a similar topic, with WebAuthn, is it worth waiting for FIDO2 keys?
- sturmeh 8y ago
  Yubikey of course, however there's no reason you can't use the TREZOR, just update the firmware and regenerate the seed if you think your device may have been compromised in the meantime. I think it's worth considering that these attacks are problematic in theory, but they still require quite a bit of access and opportunity.
- Fnoord 8y ago
  I recommend to use 2FA asap. Whatever implementation is better than none, though it depends on your attack surface/vector and even on the question how good your 1st factor is (your password). You can get a cheap, good YubiKey which is U2F/FIDO2 certified for 20 USD/EUR [1]. These communicate over USB-A or USB-C depending on the one you buy. We're in a transition of USB-A to USB-C that's always a rough time. Do you go for backwards compatibility, the (better) future standard, or both (buying two)? If you prefer Bluetooth or NFC the one I mentioned above is too limited. Then Google recommends a Feitan for the former, and I recommend a YubiKey NEO for the latter. YubiKey NEO is also open source. With regards to TREZOR/Ledger, 2FA usage is more of a nice by-product. People buy it as Bitcoin wallet 2FA and that it can be used for more is an afterthought. One that can save you a couple of bucks though. Either way I recommend at least 1 2FA backup. Could be codes, or an app, or a second YubiKey, or even SMS. Though, obviously, each of these has their weaknesses you could host the codes in e.g. cryptosteel [2] at a notary. I plan to do that with my important passwords (ie. the password for my password manager). [1] https://www.yubico.com/product/security-key-by-yubico/ https://www.yubico.com/product/security-key-by-yubico/ [2] https://cryptosteel.com/ https://cryptosteel.com/
- sowbug 8y ago
k_vi 8y ago
trezor or ledger?
- 4x3l 8y ago
  or bitbox?
remcob 8y ago
Some impressive work in this field has been done by Tel Aviv University. They where able to get private keys out of a laptop by merely touching the laptop [1] or placing a smartphone nearby [2]. [1]: http://www.tau.ac.il/~tromer/handsoff/ http://www.tau.ac.il/~tromer/handsoff/ [2]: https://www.tau.ac.il/~tromer/acoustic/ https://www.tau.ac.il/~tromer/acoustic/
1zael 8y ago
doyoulikeworms 8y ago
Is there an underground ring of hardware wallet crackers? Are we living in a cyberpunk future already?
- Cthulhu_ 8y ago
  I'm not sure to be honest, but I wouldn't be surprised if there would be hack attempts or people looking for those if they er, "found" a hardware wallet somewhere. Anyone that has a hardware wallet is bound to have a nontrivial amount of cryptocurrencies on there.
knorker 8y ago
Tell me again how we're supposed to be competent enough to run our own banks, and that as long as we never make a mistake reversing transactions are not a needed feature...

399 points by mlejva 8y ago

This was published in 2015. Updating to a more recent firmware, which requires a PIN when computing the public key, eliminates the utility of such an attack.

deleted 8y ago
[deleted]
aaron_m04 8y ago
Interesting. Do you have a link where I could read more about this?
- cyphunk 8y ago
  https://github.com/trezor/trezor-mcu/commits/master?after=3185eb0fd444701e2bc976555545fe08d572c957+769 https://github.com/trezor/trezor-mcu/commits/master?after=31... As jochen mentions in his timeline in the post trezor asked he delay publication until they could fix the bug in release 1.3.3. he says they included a fix on Mar 30 which you'll find in the link above

sbhn 8y ago

Html5 oscilloscope if anyone needs one https://github.com/Sean-Bradley/Oscilloscope https://github.com/Sean-Bradley/Oscilloscope

bonyt 8y ago

It's amazing how hard it is to make something secure when considering side channels. Almost any bit of information can be used to extrapolate more - just consider this type of power-based attack, timing attacks, meltdown/spectre, CBC padding oracles, etc. Plus, suddenly people are pumping millions (or billions) into private keys on little devices, it is amazing.

etherael 8y ago
It seems that way from the outside, I'll grant. But I'll explain by analogy why I don't think it's as crazy as one might otherwise at first glance assume. It's possible to create gold artificially, but because of the cost of doing it vs just purchasing the natural stuff, you can be almost certain any gold you come into contact with is not artificially created. In much the same way, even though there are indeed tons of theoretical attacks that compromise various crypto keys linked to massive fortunes, because of the way the sector has evolved in terms of not making high value keys available in a low security context, and mitigating those threats in a high security context, the likelihood that any given crypto "account" you care to mention will ever be hacked is similarly low. It's not worth the attackers to invest the necessary resources to snag your minor android wallet stash, and even if they tried to bring those resources to bear on Xapo's vaults, they would fail. Also, the sector as a whole has basically pioneered a whole new class of security measures, at least to the extent they're now in reasonably wide circulation, and improved security consciousness and software in general around the space immensely, exactly because now a bug isn't just some time and embarrassment, it may well be losing millions of dollars in value. In that context it makes sense to invest in the security to do it right and think carefully about all possible attack surfaces and vulnerabilities.

nebulous1 8y ago

I did not know you could get dirt cheap USB oscilloscopes

nickysielicki 8y ago
My understanding is that generally speaking, it's throwing money at bad and you're much better off spending the $350-$500 or so for a proper entry-level scope. Check out the eevblog forums if you're in the market. [1] edit: it is worth noting that if you can deal with the design and hardware limitations, the limitations of the included proprietary software should not necessarily scare you off, sigrok [2] has support for a lot of these cheap devices. Since writing this comment, I also just discovered a newer project called openhantek [3], which seems to be very active. [1]: http://www.eevblog.com/forum/testgear/ http://www.eevblog.com/forum/testgear/ [2]: https://sigrok.org/ https://sigrok.org/ [3]: https://github.com/OpenHantek/openhantek https://github.com/OpenHantek/openhantek
- nebulous1 8y ago
  Saw that OpenHantek when I was making sure I'd be able to use it with linux. I have no need for an oscilloscope, nor do I even know how to use one. They've always seemed pretty interesting to me, but when I've looked before I've managed to convince myself out of spending XXXX on something I may only use once. If we're talking in the sub 100 range then it seems like something I could use or not use, and then upgrade it if I actually find it wanting (ie I invest enough time to find something I want to do with it but can't). I think I'll do a bit more research anyway.
  - iamleppert 8y ago
    Not every use of money has to be “efficient”.
    - eric_h 8y ago
      Certainly - but it makes sense to optimize expenditures in the slightly uncomfortable range to avoid excessive waste.

zeroDivisible 8y ago

"Silence on the wire" [1] hypothesizes finding the state of systems from the outside world - or based on the lack of information. Found it entertaining to read and this article somehow reminded me about it. [1] https://www.goodreads.com/book/show/82994.Silence_on_the_Wire https://www.goodreads.com/book/show/82994.Silence_on_the_Wir...

godelmachine 8y ago
I got Silence on the Wire after reading your comment. Let's see how it is.

jnwatson 8y ago

The term of art for this kind of attack is SPA (simple power analysis). The fact that this is possible means that this is amateur hour engineering, with very little security QA. The more sophisticated attacks use DPA, differential power analysis, which accumulate the results of multiple runs and performs statistical analysis. When I was on a team that made a similar device over a decade ago, we were up to our eyeballs in academic papers about SPA and DPA hardware and software countermeasures. That doesn't mean we didn't make any mistakes, but at least we were knowledgeable enough to hook an oscilloscope up and see what's going on. These guys completely ignored an entire class of attacks, known in detail for a couple decades, (in reality since 1943, declassified 1972 ([1]). I wouldn't trust these guys to protect anything of value. [1] https://www.wired.com/2008/04/nsa-releases-se/ https://www.wired.com/2008/04/nsa-releases-se/

dangero 8y ago
Or those attacks were out of scope for this product.
- fjsolwmv 8y ago
  Extracting a secret key from an supposedly PIN protected device looks in scope to me. What I don't understand is why this device recomputes the public key on each read, instead of storing it persistently after creation.
  - FLUX-YOU 8y ago
    >Extracting a secret key from an supposedly PIN protected device looks in scope to me. Prevented by not letting anyone casually hook up an oscilloscope to your TREZOR.
    - khedoros1 8y ago
      That sounds like a work-around/mitigation, not a solution.

touart 8y ago

There was another successful attack on another hardware wallet (Ledger) 3 months ago, by tampering the firmware used in one of the MCU - (Post by the author: https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/ https://saleemrashid.com/2018/03/20/breaking-ledger-security... ; HN thread: https://news.ycombinator.com/item?id=16627725 https://news.ycombinator.com/item?id=16627725)

nope96 8y ago

They hired him after this: https://medium.com/@satoshilabs/ethical-hacker-and-bitcoin-hero-johoe-joins-satoshilabs-as-trezor-cryptographer-36c9a6b10d52#.2wri5l7fx https://medium.com/@satoshilabs/ethical-hacker-and-bitcoin-h...

kxyvr 8y ago

Awhile back, I was looking at using a TREZOR as a U2F key. I liked it since the interface looked good, confirmation of sending the key on the device itself, and the software was open source. For those two reasons, it looked nicer than using a Yubikey, which closed it source with the Yubikey 4 and didn't provide confirmation on the device itself. That said, this attack didn't make the TREZOR look great. What's a good option for a U2F key? On a similar topic, with WebAuthn, is it worth waiting for FIDO2 keys?

sturmeh 8y ago
Yubikey of course, however there's no reason you can't use the TREZOR, just update the firmware and regenerate the seed if you think your device may have been compromised in the meantime. I think it's worth considering that these attacks are problematic in theory, but they still require quite a bit of access and opportunity.
Fnoord 8y ago
I recommend to use 2FA asap. Whatever implementation is better than none, though it depends on your attack surface/vector and even on the question how good your 1st factor is (your password). You can get a cheap, good YubiKey which is U2F/FIDO2 certified for 20 USD/EUR [1]. These communicate over USB-A or USB-C depending on the one you buy. We're in a transition of USB-A to USB-C that's always a rough time. Do you go for backwards compatibility, the (better) future standard, or both (buying two)? If you prefer Bluetooth or NFC the one I mentioned above is too limited. Then Google recommends a Feitan for the former, and I recommend a YubiKey NEO for the latter. YubiKey NEO is also open source. With regards to TREZOR/Ledger, 2FA usage is more of a nice by-product. People buy it as Bitcoin wallet 2FA and that it can be used for more is an afterthought. One that can save you a couple of bucks though. Either way I recommend at least 1 2FA backup. Could be codes, or an app, or a second YubiKey, or even SMS. Though, obviously, each of these has their weaknesses you could host the codes in e.g. cryptosteel [2] at a notary. I plan to do that with my important passwords (ie. the password for my password manager). [1] https://www.yubico.com/product/security-key-by-yubico/ https://www.yubico.com/product/security-key-by-yubico/ [2] https://cryptosteel.com/ https://cryptosteel.com/
sowbug 8y ago

k_vi 8y ago

trezor or ledger?

4x3l 8y ago
or bitbox?

remcob 8y ago

Some impressive work in this field has been done by Tel Aviv University. They where able to get private keys out of a laptop by merely touching the laptop [1] or placing a smartphone nearby [2]. [1]: http://www.tau.ac.il/~tromer/handsoff/ http://www.tau.ac.il/~tromer/handsoff/ [2]: https://www.tau.ac.il/~tromer/acoustic/ https://www.tau.ac.il/~tromer/acoustic/

1zael 8y ago

doyoulikeworms 8y ago

Is there an underground ring of hardware wallet crackers? Are we living in a cyberpunk future already?

Cthulhu_ 8y ago
I'm not sure to be honest, but I wouldn't be surprised if there would be hack attempts or people looking for those if they er, "found" a hardware wallet somewhere. Anyone that has a hardware wallet is bound to have a nontrivial amount of cryptocurrencies on there.

knorker 8y ago

Tell me again how we're supposed to be competent enough to run our own banks, and that as long as we never make a mistake reversing transactions are not a needed feature...