Hacker News Reader

Comment by dwh452 | Hacker News Reader

how can the implant send the seed words to an attacker? doesn't a crypto wallet have to talk an application on the host computer? wouldn't the communication between the wallet and the host computer never allow for the seed words to be sent from the wallet to the outside world? in other words how could an "implant" tampering of the wallet make the host computer suddenly start sending seed phrases to third parties?

View on HN

They sniffed the LCD interface and OCR'ed the seed words when they were displayed using an implanted tiny CPU. This is a very sophisticated attack.

They were almost certainly not doing the OCR on the device. Such a CPU would be too power-hungry and the process would still be too error-prone given the limited compute. They would just send the raw data to the C2, which could send it to an emulator, snapshot the output and send it to an LLM.

Well it doesn't need to be a generic purpose OCR, just one that works for this single UI layout and font.

and only needs to distinguish around the 1000 different words that are used in the seedphrase. So it is more word-recognition than character recognition.

i don't think OCRing a bitmap font is very expensive or power hungry, if you know the exact pixel configurations of the glyphs ahead of time

Exactly. No O, just CR.

Wire character recognition

Streaming the raw data would also be more flexible for other use cases. From what I've read, it was streaming off the generated recovery passphrase, but users aren't required to generate one--they can input one. That'd require a much more sophisticated algorithm than simply reading from the screen, since users are using two buttons to pick from hundreds of words in a randomized menu.

And besides, Ledger firmware can be updated to change fonts and such so it'd be long-term safer to just stream the raw data.

The attackers added their own tiny 4G or 5G board.

They put an eSIM in the device…

There is an eSIM with worldwide data in the device.

Though it's not what happened in this case, you could tamper with a crypto wallet to make it emulate a USB keyboard and once connected, send a series of keystrokes to download and run an exploit.

That's fairly risky, though, as it's very visible to users if it goes wrong, who could then alert the manufacturer, who could in turn warn other users.

I suspect that the attackers here have been waiting for enough funds to land on compromised wallets to be worth their efforts and then withdrew everything at once, with comparably little chance to get caught.

The implant could fabricate a reason to connect to a host computer. Like "Cannot display seed words, connect to a computer to debug"

Reply on news.ycombinator.com