Criminals are mailing hacked Ledger devices to steal cryptocurrency
bleepingcomputer.com
bleepingcomputer.com
Otherwise the scammers are wasting their time on people who have better infosec practices and are therefore low ROI targets.
But in this case they already put a lot of effort into it? ie. they made the fake device, packaged it with shrinkwrap, and paid for shipping. The only thing left is for the victim to enter the seed, which requires zero effort on their part.
Every few weeks I'll try to go along with one of the scam phone calls I get. I haven't been able to act the right way to prevent the caller from hanging up after like 2 or 3 sentences.
I’ve tried every posible reply I can think of in every intonation from fear to confusion to anger to genuinely glad they’ve called. They always just hang up.
I suspect some of the scambaiter youtubers are works of fiction. Most aren’t dumb enough to play along very long when they realize they’re being played.
I can believe this for emails but this seems like something that was deliberately quite polished aside from the wording
The idea is that someone who fell for a scam is going to fall for another one.
They couldn't get their English right? It's obviously not laziness at play, right?
Would you reject the device based solely on the bad English? Many would assume that they threw the documentation job at a relatively new junior/intern unless there were other red flags. I've seen terrible English in documentation from reputable companies.
other option is that they are doing a/b test of different messages
In the case of the fake Ledger devices, there's no similar overhead. A more convincing letter is almost certainly going to lead to more people plugging in the device and going through the steps. The incentive is reversed here.
Other then that the boxing, the device, etc. are really convincing.
At times over the years I've received legitimate letters or emails along lines like "Foo Inc. now runs Bar Corp.'s former insurance business, and your Bar account is now a Foo account" -- with the only notice coming from Foo. Or legitimate bank emails linking to random third-party websites. We get trained to expect this kind of vulnerability.
Not surprising that given the lack of interest in protecting their customers privacy that their marketing databases were poorly protected as well.
> sent you a new device you must switch to a new device
> this *kinda* breach
> there is a manual inside your new box you can read that
Seriously?
So it's just a guess but with those two observations I would guess the scammers are from China.
https://www.businessinsider.com/why-nigerian-scam-emails-are...
(1) Sending email is nearly free, creating devices is not. Not sure if the economics match.
(2) False positive filtering matter because spammer need to manually reply to emails, creating more work. But with these devices this is not the case, it's all automated. There is no need to filter out smart people.
How I it possible to keep a private key private, if you have to use 3rd party hardware and software (no one builds their own computer components), to use the key?
It isn't. And this is the fundamental problem with using crypto for its' (professed, intended) use of a trustless currency. In order to actually do that, you need to run a full node on your own hardware. However no one wants to do that, so we've literally just reinvented the existing trust based banking system on top of it all, with the added benefit of zero transparency or regulation.
https://estudiobitcoin.com/do-you-trust-your-seed-dont-gener...
Hardware wallets make no sense, they are about as secure as just using a third party custodian.
The current ones don't seem to require creating an account/linking to the profile used for ordering the device, so a targeted attack as described in my parent post does not seem possible, but I don't know if it's always been like that.
The European data retention law certainly wouldn't apply if their backends aren't actually receiving this data..
However that might well be that of a third party, or their own but without any unique/linkable identifier being transmitted with the requests.
Certainly these endpoint have no authentication / user accounts though, and I don't think it'd be easy for some low level hacker to associate an IP address with a specific person.