Teenager hacks crypto-currency wallet

Ledger Nano devices are meant to keep people's crypto-currency safe

A hardware wallet designed to store crypto-currencies, and touted by its manufacturer as tamper-proof, has been hacked by a British 15-year-old.

Writing on his blog, Saleem Rashid said he had written code that gave him a back door into the Ledger Nano S, a $100 (£70) device that has sold millions around the world.

It would allow a malicious attacker to drain the wallet of funds, he said.

The firm behind the wallet said that it had issued a security fix.

It is believed the flaw also affects another model - the Nano Blue - and a fix for that will not be available "for several weeks", the firm's chief security officer, Charles Guillemet told Quartz magazine.

Crypto-currencies such as Bitcoin use an encryption method known as public key cryptography to protect funds. Users can spend the money stored only if they have access to the private key.

'No bounty'

Hardware wallets store these private keys and can be connected to a PC via a USB port.

The attack targets the device's micro-controllers, one of which stores the private key, while the other acts as its proxy to support display functions and the USB interface.

The latter is less secure and is not able to differentiate between genuine firmware - software programmed into a device - and code written by an outsider.

One big caveat for the method discovered by the teenager is that the attacker would need physical access to a wallet before it got into the hands of the victim - so, for instance, by buying one, altering it and then selling it on eBay or a similar online site.

In his blog, Rashid said that he had sent the code he had developed to Ledger "a few months ago", adding that he had not been paid a bounty.

He said that he chose to publish after Ledger's chief executive Eric Larcheveque made comments on Reddit which, according to the teenager, "were fraught with technical inaccuracy".

Danger 'exaggerated'

"As a result of this, I became concerned that this vulnerability would not be properly explained to customers," he wrote.

In his Reddit comments, Mr Larcheveque said that the security issue had "been greatly exaggerated".

"While possible, this proof of concept ranks by no means as a critical severity level and has never been demonstrated," he wrote.

He accused the teenager of becoming "visibly upset" when the firm did not share the fix as a "critical security update" and said his decision to go public had "generated a lot of panic".

Craig Young, a researcher at security firm Tripwire commented: "It is very difficult to thoroughly secure any device from attackers with physical access. This is why it is so critical to have trusted component makers, merchants, and repair facilities.

"In this particular case, it was discovered that anyone with physical access could modify the Ledger hardware wallet to gain access to funds. In effect, this would mean that someone selling this hardware wallet would be able to steal funds from their customers.

"Fortunately for Ledger owners, the problem was responsibly reported to the vendor and a co-ordinated disclosure minimised risk to end users."

A few weeks ago, Ledger confirmed that a separate flaw made its wallets susceptible to another attack in which malware could trick users into unknowingly sending their crypto-currency to hackers.