We do the research, you get the alpha!
New York-based entrepreneur and crypto enthusiast Dan Reich breathed a sigh of relief after a hardware hacker helped him recover over $2 million sitting in a Trezor One hardware wallet.
As reported by The Verge, in early 2018, Reich and his friend spent $50,000 in Bitcoin to purchase a batch of Theta Network tokens (THETA), worth about $0.21 at the time. Initially, the funds were held on a China-based crypto exchange and later moved to a Trezor One hardware wallet.
By the end of 2018, when the price of the token crashed nearly fourfold, the two friends decided to cash out their investment. They realized, however, that they had forgotten the security PIN to the wallet which contained the tokens.
After 12 failed attempts to guess the PIN, they gave up as the wallet would wipe itself clean after 16 unsuccessful tries.
However, after the price of Theta skyrocketed last year to hit an all-time high above $15 and their initial investment briefly rose above $3 million, Reich and his friend decided to renew their attempts to get access to the wallet.
Going through different avenues, the two friends reached out to Joe Grand, a Portland-based hardware hacker, who eventually managed to recover the PIN.
Sidestepping Trezor security
As Grand explained in his YouTube video, normally, Trezor One wallets temporarily move the PIN and key to the RAM during a firmware update.
Once the update is complete, the information is moved back to flash.
This wasn’t the case with Reich’s wallet—despite Trezor removing the PIN and key that got copied to RAM during a boot-up, the PIN and key appeared in the device’s RAM at later stages.
This meant that should Grand inadvertently wipe the RAM before he could read the data, he would be unable to recover the PIN.
To solve the problem, Grand used what is called a fault injection attack—a physical attack on the device that changes the amount of voltage going into the chip. This allowed him to bypass the wallet microcontrollers’ security that was put in place to prevent hackers from reading the RAM.
Once bypassed, Grand executed an automated script to obtain the lost PIN.
“I was sitting here watching the computer screen and saw that I was able to defeat the security, the private information, the recovery seed, and the PIN that I was going after popped up on the screen," said Grand.
Trezor responds to cracked wallet
It’s worth noting that SatoshiLabs, the Prague-based manufacturer of Trezor wallets, fixed the security issue found in Reich’s device some time ago, and all new devices are shipped with a fixed bootloader.
“We just want to add that this is an outdated exploit that is not a concern for current users and that we fixed in 2017 right after a report that we received through our responsible disclosure program,” Trezor tweeted on Wednesday.
The key issue with the chip that makes a fault injection attack possible still persists though, and can be fixed either by the chipmaker or by switching to a more secure chip.
However, as stressed by Trezor, this kind of attack requires full physical access to the device, and there is no record of any funds being compromised.