Almost all security research has a question often left unanswered: what would be the financial consequence, if a discovered vulnerability is maliciously exploited? The security community almost never knows, unless a real attack takes place and the damage becomes known to the public. Development of the cryptocurrencies made it even more difficult to control the impact of an attack since all the security relies on a single wallet's private key which needs to stay secure. Multiple breaches of private wallets and public currency exchange services are well-known, and to address the issue a few companies have come up with secure hardware storage devices to preserve the wallet's secrets at all costs.
But, how secure are they? In this research, we show how software attacks can be used to break in the most protected part of the hardware wallet, the Secure Element, and how it can be exploited by an attacker. The number of identified vulnerabilities in the hardware wallet show how software vulnerabilities in the TEE operating system can lead to a compromise of the memory isolation and a reveal of secrets of the OS and other user applications. Finally, based on the identified vulnerabilities an attack is proposed which allows anyone with only physical access to the hardware wallet to retrieve secret keys and data from the device. Additionally, a supply chain attack on a device allowing an attacker to bypass security features of the device and have full control of the installed wallets on the device.
Speakers
Alyssa Milburn
Alyssa Milburn is a Security Analyst at Riscure where you can trust here to break stuff. She enjoys low-level computing, particularly compilers (including working with LLVM/gcc), kernel-level work and embedded platforms. She is fascinated by old computer games. She is also involved in various open source projects in this vein, in particular ScummVM, GemRB and openc2e. Reverse engineering is great fun too; as well as taking apart old computer games, she has also applied her skills for analyzing embedded firmware, and for security work.
Sergei Volokitin
Sergei Volokitin is a security analyst at Riscure in the Netherlands where his work is mostly focused on security evaluation of embedded systems and security testing of smart card platforms and TEE based solutions. He has a number of publications on Java Card platform attacks and conference presentations on hardware security.
Detailed Presentation:
(Source: Black Hat USA 2018, Las Vegas)
Comments