7 ms·

This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transact

This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And since I and most people mainly check the address we are sending to but don’t pay close attention to the change address, we could end up having our funds stolen that way. I’ve been thinking about moving to a multisig setup instead, that would have multiple computers independently used for checking and signing the transactions. So far I’ve been putting it off because a single wallet and being diligent about checking the output address that you send to seemed sufficient. But now I think moving to a multisig setup is something me and more people should do sooner rather than later.

woah 3y ago
So many of these exploits boil down to "hardware wallets not providing enough/the right information". The screen is tiny, and protocol devs don't usually put a lot of thought into making stuff easily human readable. Ideally a transaction can be fully understood and verified from the hardware wallet but we still have a ways to go.
- npoc 3y ago
  I use a repurposed mobile running BlueWallet
popol12 3y ago
No, you're wrong. The issue you're describing can't be exploited on Ledger devices at least. (Source: I’m a contributor to their bitcoin transaction parsing code) Their hardware wallet checks if the provided change output's address is actually owned by the device owner: - if it does, then the change output is simply hidden from the user validation flow - if it doesn’t it will appear as a second bitcoin transfer to approve, which require a second physical approval on the device. this is highly unusual and should trigger the user's suspicion. I can’t say for other vendors but this is pretty standard security practice I’m sure, hardware wallets are fighting against attacks that are way more elaborate than this one.
- codetrotter 3y ago
  Ok. I use Ledger. And I would not have thought of being suspicious of there being two addresses to confirm. So rather than being “wrong”, maybe I am more similar to most regular user of hardware wallets, and that this kind of attack would indeed be a disaster for a lot of users who have hardware wallets. Myself included.
  - pests 3y ago
    But.... if you did confirm two addresses, wouldn't the second one be suspicious solely because... if you're confirming it... it means you actually did something besides click a button right? And if it wasnt an address you owned?
    - elbear 3y ago
      Does each address show the amount transferred? If it doesn't, with my current knowledge of how things work, I would maybe assume the second address is used for a commission. Depending on what funds I would be transferring, maybe I would be suspicious and cancel the whole thing to find out why 2 addresses are displayed.
    - codetrotter 3y ago
      I would think one was the target address and the other was the change address. And then if I went so far as to double check that the other address was a change address, I’d do so by looking in the list of addresses for my wallet in Electrum. But in our scenario I am using a backdoored Electrum. And therefore it could be showing a mixture of the real addresses that belong to me in that list alongside addresses belonging to a different wallet that was set to show up there by whoever backdoored my copy of Electrum.
- nvdr 3y ago
  Ok, and what if you use your Ledger seed phrase to connect / recover on Exodus? Hardware wallet or not, if the recovery seed is exposed, are you in trouble?
stouset 3y ago
Reading this, it is bonkers to me that people think cryptocurrencies are ready or appropriate for mainstream use, either as a currency or as an investment. Line could go up, but if you aren’t extremely careful with processes that most people don’t and won’t comprehend—and don’t even realize are something you need to do—you can just straight up lose everything.
- RobertRies 3y ago
  The claim is that some day innovations, and checks, and some other technologies will fix this and do all of this automatically, somehow. That's why it's still early days.
  - ipython 3y ago
    Early days… 15 years later. To quote spaceballs, When exactly will “then” be “now”?
    - GauntletWizard 3y ago
      The history of finance is as long as recorded history, perhaps the reason for it[1]. That said, these kinds of crazes[2] are almost as old. [1]https://en.wikipedia.org/wiki/Complaint_tablet_to_Ea-n%C4%81%E1%B9%A3ir https://en.wikipedia.org/wiki/Complaint_tablet_to_Ea-n%C4%81... [2]https://en.wikipedia.org/wiki/Tulip_mania https://en.wikipedia.org/wiki/Tulip_mania
      - cypherpunks01 3y ago
        I don't recall ever reading about a tulip ETF, though, that could be kind of interesting
        jakupovic 3y ago
        Lol. HN is stuck in "CRYPTO BAD BOOO, We don't need no reason. We know", in the voice of HN group think.
Scoundreller 3y ago
> if my copy of Electrum was backdoored While it’s not foolproof, it’s a good reason to compile things yourself from source instead of using the binaries. Unless someone trusted is validating build reproducibility, but that isn’t as common as we’d all like. Some 4y old discussion of how some OSs for electrum are built reproducibly: https://old.reddit.com/r/Bitcoin/comments/dcz0my/what_is_not_good_about_electrums_transparency/ https://old.reddit.com/r/Bitcoin/comments/dcz0my/what_is_not...
- FabHK 3y ago
  This is clearly the right solution for the poor unbanked peasants crypto proponents are so concerned about. /s
t_mann 3y ago
Assuming the hardware wallet is safe, and that you indeed check all the recipient addresses and make no mistakes there, I don't see how the software should be able to fool you, though? I would assume that the hardware wallet is built to never leak your private key, at least not when signing a transaction, and the signature that it produces would always be for the exact transaction (recipient, amount, data,...) that you checked (since we assume the hardware wallet to be safe). Can you explain?
zepton 3y ago
Ledger fixed that exact issue in 2019: https://sergeylappo.github.io/posts/ledger-hack/ https://sergeylappo.github.io/posts/ledger-hack/
yieldcrv 3y ago
If you put your seed phrase anywhere that transmits it online, none of this information about outputs or ledgers matters This app simply transmitted seed phrases to a server, or derived the first private key of one and sent that Starting to agree with everyone else here, if the crypto enthusiasts on HN can’t differentiate
ews 3y ago
A hardware wallet would 100% have stopped this.
csomar 3y ago
> But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. Pretty sure this is not the case for Trezor (This was an angle that got addressed a long time ago). Also, Ethereum doesn't have a change address. > So far I’ve been putting it off because a single wallet and being diligent about checking the output address that you send to seemed sufficient. If you are too concerned and use Bitcoin, there is an easier/simpler way. Sign the transaction offline and don't broadcast it. Copy the transaction Hex and decode it. You can there read the details of the output addresses, fees, etc.. When you are sure, then you can broadcast the transaction.
- codetrotter 3y ago
  > Also, Ethereum doesn't have a change address Read the comment you quoted again. I said Electrum. The Bitcoin wallet.
sowbug 3y ago
Since BIP-32, receive and change addresses have been generated from a single seed, never from outside sources. Hardware wallets verify this. It's much more likely you'll fall victim to malware that waits until you're on an exchange website, and substitutes the attacker's receive address for the exchange's. You think you're depositing funds in your account, but they vanish instead. This is basically the same attack as fake escrow instructions emailed to people buying a home.
npoc 3y ago
Bluewallet Vault makes multi-sig simple. And when co-signing a transaction, it calculates the amount to display on the screen by calculating the difference between inputs & owned outputs, and so for general transactions this means you only need to check the amount and the destination address to be sure the right amount of money is going to the right place.
david4568 3y ago
[dead]

woah 3y ago

So many of these exploits boil down to "hardware wallets not providing enough/the right information". The screen is tiny, and protocol devs don't usually put a lot of thought into making stuff easily human readable. Ideally a transaction can be fully understood and verified from the hardware wallet but we still have a ways to go.

npoc 3y ago
I use a repurposed mobile running BlueWallet

popol12 3y ago

No, you're wrong. The issue you're describing can't be exploited on Ledger devices at least. (Source: I’m a contributor to their bitcoin transaction parsing code) Their hardware wallet checks if the provided change output's address is actually owned by the device owner: - if it does, then the change output is simply hidden from the user validation flow - if it doesn’t it will appear as a second bitcoin transfer to approve, which require a second physical approval on the device. this is highly unusual and should trigger the user's suspicion. I can’t say for other vendors but this is pretty standard security practice I’m sure, hardware wallets are fighting against attacks that are way more elaborate than this one.

codetrotter 3y ago
Ok. I use Ledger. And I would not have thought of being suspicious of there being two addresses to confirm. So rather than being “wrong”, maybe I am more similar to most regular user of hardware wallets, and that this kind of attack would indeed be a disaster for a lot of users who have hardware wallets. Myself included.
- pests 3y ago
  But.... if you did confirm two addresses, wouldn't the second one be suspicious solely because... if you're confirming it... it means you actually did something besides click a button right? And if it wasnt an address you owned?
  - elbear 3y ago
    Does each address show the amount transferred? If it doesn't, with my current knowledge of how things work, I would maybe assume the second address is used for a commission. Depending on what funds I would be transferring, maybe I would be suspicious and cancel the whole thing to find out why 2 addresses are displayed.
  - codetrotter 3y ago
    I would think one was the target address and the other was the change address. And then if I went so far as to double check that the other address was a change address, I’d do so by looking in the list of addresses for my wallet in Electrum. But in our scenario I am using a backdoored Electrum. And therefore it could be showing a mixture of the real addresses that belong to me in that list alongside addresses belonging to a different wallet that was set to show up there by whoever backdoored my copy of Electrum.
nvdr 3y ago
Ok, and what if you use your Ledger seed phrase to connect / recover on Exodus? Hardware wallet or not, if the recovery seed is exposed, are you in trouble?

stouset 3y ago

Reading this, it is bonkers to me that people think cryptocurrencies are ready or appropriate for mainstream use, either as a currency or as an investment. Line could go up, but if you aren’t extremely careful with processes that most people don’t and won’t comprehend—and don’t even realize are something you need to do—you can just straight up lose everything.

RobertRies 3y ago
The claim is that some day innovations, and checks, and some other technologies will fix this and do all of this automatically, somehow. That's why it's still early days.
- ipython 3y ago
  Early days… 15 years later. To quote spaceballs, When exactly will “then” be “now”?
  - GauntletWizard 3y ago
    The history of finance is as long as recorded history, perhaps the reason for it[1]. That said, these kinds of crazes[2] are almost as old. [1]https://en.wikipedia.org/wiki/Complaint_tablet_to_Ea-n%C4%81%E1%B9%A3ir https://en.wikipedia.org/wiki/Complaint_tablet_to_Ea-n%C4%81... [2]https://en.wikipedia.org/wiki/Tulip_mania https://en.wikipedia.org/wiki/Tulip_mania
    - cypherpunks01 3y ago
      I don't recall ever reading about a tulip ETF, though, that could be kind of interesting
      - jakupovic 3y ago
        Lol. HN is stuck in "CRYPTO BAD BOOO, We don't need no reason. We know", in the voice of HN group think.

Scoundreller 3y ago

> if my copy of Electrum was backdoored While it’s not foolproof, it’s a good reason to compile things yourself from source instead of using the binaries. Unless someone trusted is validating build reproducibility, but that isn’t as common as we’d all like. Some 4y old discussion of how some OSs for electrum are built reproducibly: https://old.reddit.com/r/Bitcoin/comments/dcz0my/what_is_not_good_about_electrums_transparency/ https://old.reddit.com/r/Bitcoin/comments/dcz0my/what_is_not...

FabHK 3y ago
This is clearly the right solution for the poor unbanked peasants crypto proponents are so concerned about. /s

t_mann 3y ago

Assuming the hardware wallet is safe, and that you indeed check all the recipient addresses and make no mistakes there, I don't see how the software should be able to fool you, though? I would assume that the hardware wallet is built to never leak your private key, at least not when signing a transaction, and the signature that it produces would always be for the exact transaction (recipient, amount, data,...) that you checked (since we assume the hardware wallet to be safe). Can you explain?

zepton 3y ago

Ledger fixed that exact issue in 2019: https://sergeylappo.github.io/posts/ledger-hack/ https://sergeylappo.github.io/posts/ledger-hack/

yieldcrv 3y ago

If you put your seed phrase anywhere that transmits it online, none of this information about outputs or ledgers matters This app simply transmitted seed phrases to a server, or derived the first private key of one and sent that Starting to agree with everyone else here, if the crypto enthusiasts on HN can’t differentiate

ews 3y ago

A hardware wallet would 100% have stopped this.

csomar 3y ago

> But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. Pretty sure this is not the case for Trezor (This was an angle that got addressed a long time ago). Also, Ethereum doesn't have a change address. > So far I’ve been putting it off because a single wallet and being diligent about checking the output address that you send to seemed sufficient. If you are too concerned and use Bitcoin, there is an easier/simpler way. Sign the transaction offline and don't broadcast it. Copy the transaction Hex and decode it. You can there read the details of the output addresses, fees, etc.. When you are sure, then you can broadcast the transaction.

codetrotter 3y ago
> Also, Ethereum doesn't have a change address Read the comment you quoted again. I said Electrum. The Bitcoin wallet.

sowbug 3y ago

Since BIP-32, receive and change addresses have been generated from a single seed, never from outside sources. Hardware wallets verify this. It's much more likely you'll fall victim to malware that waits until you're on an exchange website, and substitutes the attacker's receive address for the exchange's. You think you're depositing funds in your account, but they vanish instead. This is basically the same attack as fake escrow instructions emailed to people buying a home.

npoc 3y ago

Bluewallet Vault makes multi-sig simple. And when co-signing a transaction, it calculates the amount to display on the screen by calculating the difference between inputs & owned outputs, and so for general transactions this means you only need to check the amount and the destination address to be sure the right amount of money is going to the right place.

david4568 3y ago

[dead]