Oct 2019 - Ledger Faulty Secure Element Phishing - $Unknown (Global)
"Based in France, Ledger is the largest cryptocurrency hardware wallet company." "Ledger is a hardware cryptocurrency wallet that is used to store, manage, and sell cryptocurrency. The funds held in these wallets are secured using a 24-word recovery phrase and an optional secret passphrase that only the owner knows."
"Ledger offers two products, the Nano S and Nano X, that can store the digital keys used to secure crypto wallets. The devices can be used with a variety of cryptocurrencies, are compatible with numerous apps, and are supposed to offer a safe way to manage crypto without compromising too much on convenience. Ledger says on its website that it has sold 1.5 million products to customers in 165 countries to date."
"A new phishing attempt is being sent by email to our customers, from an unknown party impersonating Ledger. Please do NOT open the attached executable file!"
"To clarify the situation - it appears that the targeted email addresses were taken from a set of Crypto-related-Slack-channels. Our community is helping us collecting additional information on the matter." "As OP said " The email address was used for Slack which has nothing to do with anything I did to buy this ledger wallet." - they're just scammers fishing around with likely some database listing leaked e-mail addresses related to crypto sites." "Unfortunately it was trivial to query all e-mail addresses for users in a Slack group at some point. Guess some lists were made for that kind of purpose."
"This email is far more convincing than the average crypto scam email. The email comes from “supportledger.com” and it has full SPF/DKIM verification for that domain, meaning most email services won’t throw it into your junk/spam folder. If you browse to that website, it redirects to the official Ledger support website (which makes no mention of such a vulnerability under announcements, how strange). The domain however is not owned or part of Ledger at all and thus fully authenticating the domain to send emails is not difficult."
"In the email, users are notified of how their wallet – either the Nano S or Nano X – contains a critical vulnerability that needs to be addressed. The website makes mention of a secure RNG chip vulnerability, that can only be resolved through a software-based check of the device."
"Today I received an email that appears as though it’s from Ledger. The header claims “IMPORTANT: Ledger Nano S and Ledger Nano X SECURE RNG CHIP CRITICAL VULNERABILITY”. This however, is not true."
"Inside Ledger hardware wallet, we use a Secure Element chip to generated and store the private keys for your crypto assets. Unfortunately, some chips, a limited number, were found to be defective by the external company commissioned by Ledger for the production. The problem identified concerns the lack of a correct source of entropy for use by the random number generator may lead the the generation of predictable sequences of numbers and therefore of private keys by malicious users. Ledger is actively working on the problem to replace all defective devices. Please check now if your device is defective with the Ledger SE tool. We apologize for the inconvenience."
"The email claims that a small batch of Ledgers have a compromised secure enclave chip and that you can download a tool to check if your Ledger was from this bad batch. Unfortunately, this tool is malware and it seems as though the purpose is to try and get your wallet’s seed." "For novice users without much technical knowledge, that may appear to be a plausible explanation." "Something that is actually probably possible to some extent, certainly somewhat believable."
"In the real world, however, it is a blatant scam designed to make users lose their cryptocurrency balances." "When you run the tool, it asks you to input your 24 word phrase to check your Ledger chip. Anyone trained well enough should have extreme alarm bells ringing at this point."
"Looks like one of the dropped executables in this phishing campaign - "Ledger SE.exe" uses the telegram bots listed in this code snippet as C2. Possible to takedown these telegram bots? @telegram @Ledger." "Likely a compiled AutoIT Script communicates to api.telegram.com - probably sends your 24 words to them through telegram. [D]ownloads a updates.rar file, and extracts it with downloaded rar.exe to %APPDATA%\Ledger\ to launch a passphrase stealer. [M]akes POST request with usernames: gksn7bot & jmnl17bot (likely to telegram)."
"And it probably sends the 24 words off to a remote address the moment return is pressed. It's sad to say that some will probably fall for this regardless of how many times they read in official Ledger documentation that the 24 words must be entered on the device and not the computer."
Further Analysis
Multiple Ledger users reported receiving a phishing email which attempted to convince them that their Ledger device might not be secure. It specifically provided a reasonably plausible hypothesis that the Secure Element might be defective in generating the random numbers, something which could possibly happen with sophisticated tampering in the supply chain, but has not yet been observed as a practical and economic attack vector.
In reality, users who downloaded the application would be then prompted to enter their seed phrase. The seed phrase would be transmitted to the hacker through Telegram. Hence, it was rather easy to shut down the Telegram channels where the information was to be transmitted and unlikely that anyone actually lost funds. Another limitation here is that the email addresses used by the scammers were believed to be from slack groups, so there is only a minimal overlap with actual Ledger users. No reports of actual loss appear to have come up in this case.
How Could This Have Been Prevented?
Always double check news of vulnerabilities against the official websites of the product or service. Never download an application in an email or enter the seed phrase anywhere except the Ledger hardware wallet.
More Cryptocurrency Exchange Hacks/Scams/Frauds
Trezor abruceky Google Search Phishing > > < < OvexTrade Withdrawal Fraud Platform
Sources/Further Reading
Emails Claiming Your Ledger Hardware Wallet is Faulty are Part of a Scam - CryptoGuru (Mar 19)
@Ledger_Support Twitter (Mar 27)
Received email: Security Vulnerability: Ledger Nano X and Ledger Nano S : ledgerwallet (Mar 27)
https://i.imgur.com/GiRNknL.png (Mar 27)
@m0zar7 Twitter (Mar 27)
Malicious ledger live autoIt code snippet - Pastebin.com (Mar 27)
A Closer Look Into Ledger Security: the Secure Element | Ledger (Mar 27)
@BTChip Twitter (Mar 27)
Beware Of Well Executed Ledger Phishing Email (Mar 27)
Ledger Live : Most trusted & secure crypto wallet | Ledger (Feb 13)
Ledger Refuses Refunds, Tells Clients “Bank Vault Is More Secure” | Financegates (Mar 19)
Physical Addresses of 270K Ledger Owners Leaked On Hacker Forum - Slashdot (Mar 19)
Scammers Are Using Fake Devices to Steal Cryptocurrency Wallets | PCMag (Mar 6)
{Warning}: Phishing attempt Ledger Nano S/X (Mar 27)
Ledger users, don't be fooled by phishing : CryptoCurrency (Mar 27)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|