4 ms·

Wow, how much would it cost to prep and send one of these fake Ledgers? This takes a lot more up front investment than a 419 email scam.

coldacid 5y ago
Whatever the cost, versus current crypto prices it must be worth the investment.
ceejayoz 5y ago
491 scams have little chance of multi-million dollar payouts.
lxgr 5y ago
Not sure how extensive the Ledger leak was, but if it included public keys/addresses as well as names and mailing addresses addresses, they could target people with large cryptocurrency holdings.
- randomhodler84 5y ago
  Ledger don’t have a record of holdings. They have no idea of your coin addresses or public keys. The shipping records (physical address, email addresses) were leaked, however. Any attacks are random guesses that the victim has funds.
  - HappyTypist 5y ago
    Ledger is subject to European data retention law, and their backends are fully capable of recording how much cryptocurrency someone has.
    - thebean11 5y ago
      Are you just speculating, or do you know that their software shares public keys and/or balances with the backend? I kind of doubt it. The European data retention law certainly wouldn't apply if their backends aren't actually receiving this data..
      - lxgr 5y ago
        Given that their apps are not full nodes, it must be sharing them with some backend to check balances and previous transactions. However that might well be that of a third party, or their own but without any unique/linkable identifier being transmitted with the requests.
        thebean11 5y ago
        Yeah good point, they need to at least be making requests containing the public addresses. I'd guess not with any identifiable information beyond IP address, and not sure if the law would force them to store the specific requests associated with an IP address..seems crazy but possible. Certainly these endpoint have no authentication / user accounts though, and I don't think it'd be easy for some low level hacker to associate an IP address with a specific person.
  - lxgr 5y ago
    They do offer companion apps that allow tracking your balances, though. The current ones don't seem to require creating an account/linking to the profile used for ordering the device, so a targeted attack as described in my parent post does not seem possible, but I don't know if it's always been like that.

coldacid 5y ago

Whatever the cost, versus current crypto prices it must be worth the investment.

ceejayoz 5y ago

491 scams have little chance of multi-million dollar payouts.

lxgr 5y ago

Not sure how extensive the Ledger leak was, but if it included public keys/addresses as well as names and mailing addresses addresses, they could target people with large cryptocurrency holdings.

randomhodler84 5y ago
Ledger don’t have a record of holdings. They have no idea of your coin addresses or public keys. The shipping records (physical address, email addresses) were leaked, however. Any attacks are random guesses that the victim has funds.
- HappyTypist 5y ago
  Ledger is subject to European data retention law, and their backends are fully capable of recording how much cryptocurrency someone has.
  - thebean11 5y ago
    Are you just speculating, or do you know that their software shares public keys and/or balances with the backend? I kind of doubt it. The European data retention law certainly wouldn't apply if their backends aren't actually receiving this data..
    - lxgr 5y ago
      Given that their apps are not full nodes, it must be sharing them with some backend to check balances and previous transactions. However that might well be that of a third party, or their own but without any unique/linkable identifier being transmitted with the requests.
      - thebean11 5y ago
        Yeah good point, they need to at least be making requests containing the public addresses. I'd guess not with any identifiable information beyond IP address, and not sure if the law would force them to store the specific requests associated with an IP address..seems crazy but possible. Certainly these endpoint have no authentication / user accounts though, and I don't think it'd be easy for some low level hacker to associate an IP address with a specific person.
- lxgr 5y ago
  They do offer companion apps that allow tracking your balances, though. The current ones don't seem to require creating an account/linking to the profile used for ordering the device, so a targeted attack as described in my parent post does not seem possible, but I don't know if it's always been like that.