No, Ledger Wasn’t Hacked: Susceptible Ethereum App Was Patched Earlier than Exploit, Firm Says

Cryptocurrency pockets developer Ledger rejects claims that it had been hacked after researchers at rival pockets maker OneKey reproduced a transaction-replacement vulnerability utilizing an outdated model of Ledger’s Ethereum app.

On Thursday, Yishi Wang, founder and CEO of OneKey, mentioned on X that the corporate’s Anzen safety crew recreated the assault in opposition to Ethereum app model 1.22.1 in a lab.

“The bug is a race situation between the transaction show logic and the underlying transaction buffer,” Wang wrote. “An attacker can overwrite the transaction ready to be signed whereas the consumer remains to be reviewing a reputable one.”

That might imply a hacker who had compromised the software program speaking with a weak Ledger app may present the consumer a reputable Ethereum transaction, then change its particulars earlier than signing, redirecting funds to the hacker’s pockets with out the change showing on the gadget.

Ledger Chief Expertise Officer Charles Guillemet rejected OneKey’s characterization, saying that reproducing an already-patched bug doesn’t quantity to “hacking Ledger.”

“What this thread describes is a vulnerability in an outdated model of the Ethereum app,” he responded on X. “It was recognized via our safety course of and glued in Ethereum app 1.22.2, launched August 13, earlier than this publish.”

In a safety bulletin printed on Thursday, Ledger mentioned the flaw may trigger an affected app to show one transaction whereas signing one other. An attacker would first want to manage communications between the gadget and its host via malware, a compromised pockets app or a hostile web site.

Ledger mentioned it discovered no proof that anybody exploited the vulnerability outdoors a laboratory.

“No consumer was hacked. No exploitation within the wild,” Guillemet wrote. “Working an exploit in opposition to an previous model after the repair has shipped is a lab train, not a discovering.”

Ledger added safeguards in Ethereum app model 1.22.2 on Aug. 13, then addressed the underlying concern in Safe SDK model 26.6.1 on Aug. 21 and rebuilt its apps with the corrected software program. The corporate recommends model 1.22.3 or later, which additionally fixes a separate transaction-display vulnerability. Ledger printed its bulletin on Aug. 27.

When requested about Onekey’s claims, Ledger pointed Decrypt to Ledger Donjon, the corporate’s inside safety analysis crew, which mentioned in a separate X publish that the episode confirmed why {hardware} wallets have to assist software program updates.

“All software program has bugs. {Hardware} wallets aren’t any exception,” the crew wrote. “That’s why updateability is a core a part of Ledger’s safety structure: when a vulnerability is discovered, whether or not by our personal Donjon crew or by exterior researchers, we will patch each gadget within the area. A pockets that may’t be up to date can’t be mounted.”

Ledger suggested clients to put in the most recent firmware and apps via Ledger Pockets, replace the Ethereum app to model 1.22.3 or later, and confirm the model proven on the gadget. Apps and firmware replace individually.

Earlier this month, after attackers stole greater than $130 million in Bitcoin from customers of Coldcard air-gapped wallets, Guillemet advised Decrypt that the incident was a warning for the {hardware} pockets business.

“We additionally do not simply depend on our personal phrase for it,” he mentioned. “Our Donjon analysis lab exists to attempt to break our merchandise earlier than anybody else can.”