4 ms·
I don't really see that being a feasible attack vector for any attacker - you can't really control who's gonna buy the tampered-with thing, so it can't be a tar
by dzaima 3y ago
I don't really see that being a feasible attack vector for any attacker - you can't really control who's gonna buy the tampered-with thing, so it can't be a targeted attack (unless the buyers are all high-value victims, in which case, don't resell; otherwise, add a random delay on reselling), and it's gonna be much more expensive than alternative methods for a non-targeted attack.
- michaelt 3y agoI always thought this would be a good attack vector for hardware bitcoin wallets. You make a subtly backdoored version (for example, tamper with the RNG so it only has a few bits of entropy) and you either return it, or sign up as a third-party seller and ship it to Amazon yourself, to be commingled with existing legitimate inventory. Then a year or two later, because you know all but a few bits of the private key, you grab the money and run. No need to control who gets the backdoored devices, just ship enough that you luck into some rich buyers.
- dzaima 3y agoI dearly hope that there isn't much reselling of hardware keys/wallets going on, that's indeed a nice and simple recipe for disasters.