3 ms·

Coldcard's $38M (so far) exploit shakes faith in self-custody

32 points by wslh 2mo ago

wslh 2mo ago
Coldcard Security Advisory: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/ https://blog.coinkite.com/coldcard-mk3-seed-generation-warni...
- nonfamous 2mo ago
  That advisory would probably be more helpful if it described what the actual issue is. (I’m thinking maybe some content got lost when the Update at the top was added?)
  - sunshine-o 2mo ago
    Yes and it is very unclear to me what are actually the risks... I am unfamiliar with "coldcard" but can hackers find out which wallet is used for which account? or maybe it can be inferred by analysing the transaction (if any)? If the hackers do not know which accounts to attack first there is probably no need to panic right now.
greyface- 2mo ago
Spot the bug! #define MICROPY_HW_ENABLE_RNG (0) [...] #ifndef MICROPY_HW_ENABLE_RNG #error "get a HW TRNG plz" #endif
paulpauper 2mo ago
so there was $70 million just sitting there for five years in the open that anyone could have taken. Nuts. Enticed by riches, hackers worldwide are now going through all firmware source code , wit the help of the latest AI models, for all wallets to find misconfigurations and other problems. Expect more thefts from low entropy bugs. AI has clearly been shown to be more more adept at auditing code than humans.
- expedition32 2mo ago
  Meanwhile nobody has ever been able to hack a bank. Probably because they employ the actual pros unlike crypto.
  - KetoManx64 2mo ago
    > Nobody has been able to hack a bank Bro, people lose hundreds of millions of dollars to bank scams on a yearly basis.
    - matsemann 2mo ago
      Not the same. And it's not like the same scams don't exist for crypto. Even worse, many of them are automated. One bad npm install could swipe my crypto, but probably not my bank account.
    - rtkwe 2mo ago
      Bank scams mostly trick the user into making a transfer or having their credentials stolen somehow and very rarely directly hack the bank which is more like what this attack is doing.
  - name_nick_sex_m 2mo ago
    And their source code isnt wide open for analysis
  - mianos 2mo ago
    [dead]
sunshine-o 2mo ago
There must be a fascinated industry dedicated to cracking old, orphan, lost and forgotten accounts with bad seeds and entropy.
- fragmede 2mo ago
  Wired's story on Joe Grand is the tip of the iceberg. https://www.wired.com/story/roboform-password-3-million-dollar-crypto-wallet/ https://www.wired.com/story/roboform-password-3-million-doll...
angry_octet 2mo ago
Incredible hyperbole from the Amicus guy: "This is hugely damaging to the people who believe that 8 billion people will hold their Bitcoin in cold storage in the future," Lawrence said. "That dream is over. Done." Sky is falling stuff. Actual cryptography experts have shown the importance (and difficulty) of random number generation for ages. Yes, if your "hardware wallet" aka computer and software is implemented poorly you will have issues.
- pants2 2mo ago
  Crypto people make fun of me for making up passwords in my head, but my brain RNG has never been exploited, nor has anyone successfully Sherlock'd my password.
  - angry_octet 2mo ago
    If it's long enough it's fine. They key property for passphrases is being able to remember them. But diceware phrases where you actually roll dice are stronger, and has evident verifiability. RNG on computers is still hard, and a proper HSM has a carefully designed source of randomness and mixing. I'd trust Yubikey RNG mixing into Linux urandom much more than a random hardware wallet developer.
    - pants2 2mo ago
      Yeah, something very cool is XOR can only improve randomness as long as there's no correlation between the sources. So Linux RNG XOR'd with this comment is even better than it's source!
- sunshine-o 2mo ago
  Yes this has been a known problem of crypto/self custody since its inception. The 1 private key -> public key -> address is elegant but an horrible single point of failure. When people create a wallet, the quality of the entropy and seed is always: I guess good, for now... So far the only mitigation for that have been multi-signature but it has its own potential vulnerabilities. My understanding is the next big Ethereum upgrade might include "Frame Transaction" [0] which will bring a "native multisig" capability to accounts so you can easily always have 2 addresses with different seeds origin to mitigate the risk. - [0] https://forkcast.org/eips/8141/ https://forkcast.org/eips/8141/
swishman 2mo ago
This is really bad. This is going to set bitcoin back years.. if it ever comes back. There really is no point and no real use case for it outside of crime. Unless the whole world order collapses in which case we'll have bigger problems..
- KetoManx64 2mo ago
  - Yes it is bad, but there have been plenty of larger scale hardships in the past decade. - No it will not set back Bitcoin years - The US dollar is used for much more crime than Bitcoin ever has been - The financial world is collapsing in front of our eyes. The US dollar is inflating 8-12% every year, and the federal government wants to raise the debt ceiling even further. If you haven't realized how Bitcoin saves you from this by this point there's no point in trying to convince you otherwise.
- hahahaa 2mo ago
  The AI attacks are the scary piece so now you have something that you could spend $1m on tokens and brute force compute and it is worth it, for a prize of $10m+ and one million is a lot of AI
  - datsci_est_2015 2mo ago
    Is $1m a lot of AI? I’m finding that there’s significant diminishing returns in terms of what can be accomplished. The first dollar always seems to be the most impressive. By $10 I’m already underwhelmed, though.
    - hahahaa 2mo ago
      Definitely alot for vulnerability finding. It may not scale up as well for building systems.
      - datsci_est_2015 2mo ago
        I’ll buy that, good take.
nonfamous 2mo ago
From the Twitter advisory [1]: >>> To every other developer: we believe this is a sober reality of the new AI paradigm. AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts. If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike. Kinda turns the “many eyes” principle of OSS on its head, eh? [1] https://x.com/nvk/status/2083216713693151552?s=61 https://x.com/nvk/status/2083216713693151552?s=61
- markjenkinswpg 2mo ago
  From my perspective, the bug became shallow because the machine world extended the number of effective eyes. The aphorism applied, but just not fast enough as it took too long to get the right number of eyes. More people would have been harmed had the bug been in production longer. One unfortunate aspect is that responsible disclosure would have only saved some people, a responsible disclosure would have lead to a notice to migrate seeds and bad actors would have immediately realized seed generation was the root cause and would have swept many folks before they could even see the notice for themselves and get around to migrating.
- lxgr 2mo ago
  > If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike. You better assume the same for closed-source software too. Turns out modern models are pretty good with decompilers...
name_nick_sex_m 2mo ago
Been saying it for years, default values are a bad idea!
name_nick_sex_m 2mo ago
This article is bad because its adspam bullshit, and doesnt explain the vulnerability... .. but this stupidest thing coinkite did was their dogshit design: Trying to inject their RNG logic into lower levels and hoping 3rd party libraries (through micropython) used them correctly... rather than just using their hardware dependencies directly. That design, and all bugs that came out of it, seems massively and avoidably stupid
hahahaa 2mo ago
There you go. Roll dice. Build your own Babbage machine to encode the wallet address.
ranger_danger 2mo ago
This isn't the first time they've had a similar vulnerability that allowed for stealing coins: https://blog.bitbox.swiss/en/remote-multisig-theft-attack-on-the-coldcard-hardware-wallet/ https://blog.bitbox.swiss/en/remote-multisig-theft-attack-on...

32 points by wslh 2mo ago

wslh 2mo ago

Coldcard Security Advisory: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/ https://blog.coinkite.com/coldcard-mk3-seed-generation-warni...

nonfamous 2mo ago
That advisory would probably be more helpful if it described what the actual issue is. (I’m thinking maybe some content got lost when the Update at the top was added?)
- sunshine-o 2mo ago
  Yes and it is very unclear to me what are actually the risks... I am unfamiliar with "coldcard" but can hackers find out which wallet is used for which account? or maybe it can be inferred by analysing the transaction (if any)? If the hackers do not know which accounts to attack first there is probably no need to panic right now.

greyface- 2mo ago

Spot the bug! #define MICROPY_HW_ENABLE_RNG (0) [...] #ifndef MICROPY_HW_ENABLE_RNG #error "get a HW TRNG plz" #endif

paulpauper 2mo ago

so there was $70 million just sitting there for five years in the open that anyone could have taken. Nuts. Enticed by riches, hackers worldwide are now going through all firmware source code , wit the help of the latest AI models, for all wallets to find misconfigurations and other problems. Expect more thefts from low entropy bugs. AI has clearly been shown to be more more adept at auditing code than humans.

expedition32 2mo ago
Meanwhile nobody has ever been able to hack a bank. Probably because they employ the actual pros unlike crypto.
- KetoManx64 2mo ago
  > Nobody has been able to hack a bank Bro, people lose hundreds of millions of dollars to bank scams on a yearly basis.
  - matsemann 2mo ago
    Not the same. And it's not like the same scams don't exist for crypto. Even worse, many of them are automated. One bad npm install could swipe my crypto, but probably not my bank account.
  - rtkwe 2mo ago
    Bank scams mostly trick the user into making a transfer or having their credentials stolen somehow and very rarely directly hack the bank which is more like what this attack is doing.
- name_nick_sex_m 2mo ago
  And their source code isnt wide open for analysis
- mianos 2mo ago
  [dead]

sunshine-o 2mo ago

There must be a fascinated industry dedicated to cracking old, orphan, lost and forgotten accounts with bad seeds and entropy.

fragmede 2mo ago
Wired's story on Joe Grand is the tip of the iceberg. https://www.wired.com/story/roboform-password-3-million-dollar-crypto-wallet/ https://www.wired.com/story/roboform-password-3-million-doll...

angry_octet 2mo ago

Incredible hyperbole from the Amicus guy: "This is hugely damaging to the people who believe that 8 billion people will hold their Bitcoin in cold storage in the future," Lawrence said. "That dream is over. Done." Sky is falling stuff. Actual cryptography experts have shown the importance (and difficulty) of random number generation for ages. Yes, if your "hardware wallet" aka computer and software is implemented poorly you will have issues.

pants2 2mo ago
Crypto people make fun of me for making up passwords in my head, but my brain RNG has never been exploited, nor has anyone successfully Sherlock'd my password.
- angry_octet 2mo ago
  If it's long enough it's fine. They key property for passphrases is being able to remember them. But diceware phrases where you actually roll dice are stronger, and has evident verifiability. RNG on computers is still hard, and a proper HSM has a carefully designed source of randomness and mixing. I'd trust Yubikey RNG mixing into Linux urandom much more than a random hardware wallet developer.
  - pants2 2mo ago
    Yeah, something very cool is XOR can only improve randomness as long as there's no correlation between the sources. So Linux RNG XOR'd with this comment is even better than it's source!
sunshine-o 2mo ago
Yes this has been a known problem of crypto/self custody since its inception. The 1 private key -> public key -> address is elegant but an horrible single point of failure. When people create a wallet, the quality of the entropy and seed is always: I guess good, for now... So far the only mitigation for that have been multi-signature but it has its own potential vulnerabilities. My understanding is the next big Ethereum upgrade might include "Frame Transaction" [0] which will bring a "native multisig" capability to accounts so you can easily always have 2 addresses with different seeds origin to mitigate the risk. - [0] https://forkcast.org/eips/8141/ https://forkcast.org/eips/8141/

swishman 2mo ago

This is really bad. This is going to set bitcoin back years.. if it ever comes back. There really is no point and no real use case for it outside of crime. Unless the whole world order collapses in which case we'll have bigger problems..

KetoManx64 2mo ago
- Yes it is bad, but there have been plenty of larger scale hardships in the past decade. - No it will not set back Bitcoin years - The US dollar is used for much more crime than Bitcoin ever has been - The financial world is collapsing in front of our eyes. The US dollar is inflating 8-12% every year, and the federal government wants to raise the debt ceiling even further. If you haven't realized how Bitcoin saves you from this by this point there's no point in trying to convince you otherwise.
hahahaa 2mo ago
The AI attacks are the scary piece so now you have something that you could spend $1m on tokens and brute force compute and it is worth it, for a prize of $10m+ and one million is a lot of AI
- datsci_est_2015 2mo ago
  Is $1m a lot of AI? I’m finding that there’s significant diminishing returns in terms of what can be accomplished. The first dollar always seems to be the most impressive. By $10 I’m already underwhelmed, though.
  - hahahaa 2mo ago
    Definitely alot for vulnerability finding. It may not scale up as well for building systems.
    - datsci_est_2015 2mo ago
      I’ll buy that, good take.

nonfamous 2mo ago

From the Twitter advisory [1]: >>> To every other developer: we believe this is a sober reality of the new AI paradigm. AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts. If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike. Kinda turns the “many eyes” principle of OSS on its head, eh? [1] https://x.com/nvk/status/2083216713693151552?s=61 https://x.com/nvk/status/2083216713693151552?s=61

markjenkinswpg 2mo ago
From my perspective, the bug became shallow because the machine world extended the number of effective eyes. The aphorism applied, but just not fast enough as it took too long to get the right number of eyes. More people would have been harmed had the bug been in production longer. One unfortunate aspect is that responsible disclosure would have only saved some people, a responsible disclosure would have lead to a notice to migrate seeds and bad actors would have immediately realized seed generation was the root cause and would have swept many folks before they could even see the notice for themselves and get around to migrating.
lxgr 2mo ago
> If your firmware is open-source or has ever been public, assume it's already being read by attackers and defenders alike. You better assume the same for closed-source software too. Turns out modern models are pretty good with decompilers...

name_nick_sex_m 2mo ago

Been saying it for years, default values are a bad idea!

name_nick_sex_m 2mo ago

This article is bad because its adspam bullshit, and doesnt explain the vulnerability... .. but this stupidest thing coinkite did was their dogshit design: Trying to inject their RNG logic into lower levels and hoping 3rd party libraries (through micropython) used them correctly... rather than just using their hardware dependencies directly. That design, and all bugs that came out of it, seems massively and avoidably stupid

hahahaa 2mo ago

There you go. Roll dice. Build your own Babbage machine to encode the wallet address.

ranger_danger 2mo ago

This isn't the first time they've had a similar vulnerability that allowed for stealing coins: https://blog.bitbox.swiss/en/remote-multisig-theft-attack-on-the-coldcard-hardware-wallet/ https://blog.bitbox.swiss/en/remote-multisig-theft-attack-on...