When there are millions of dollars to be stolen, someone can figure out how to remove the potting.

If need be, just grind and cut till you are back to the one silicon wafer that contains crypto keys, then rebuild the whole lot from scratch, add your evil parts, then re-pot it.

▲

jacquesm 3 hours ago | parent | next [-]

That would work on an already configured wallet that you stole but the skill level required is orders of magnitude higher than what's on display here. I know all of the theory on that one but I would probably not be able to pull that off.

The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip. You'd have definitely been able to spot the difference. This was at the millimeter level. Recently there was a post about a group doing this at the chip level, which I thought was extremely impressive, and again, even with the recipe out there duplicating it would still be very hard.

▲

justinclift an hour ago | parent | next [-]

> The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip.

Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.

With hardware wallets (aka substantial incentive), then the attackers could order a bunch of them for sacrificial zero-ing in the exact places to drill with a CNC/microscope/etc.

	▲	jacquesm 6 minutes ago \| parent [-]
		> Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful. Yes, initially I had just the one. But once I had it figured out there were lots of other people that wanted their device 'improved' so that jig got used plenty of times. Even so working on other people's hardware always felt very scary, especially poking around with a drill in a sensitive piece of hardware. Even so, they all worked, it was a neat little trick.

▲

bcraven 2 hours ago | parent | prev [-]

Xbox Kamikaze hack (How a drill defeated the Xbox 360’s console security)

https://www.xda-developers.com/how-drill-defeated-the-xbox-3...

	▲	jacquesm 2 hours ago \| parent [-]
		Hah! Very similar, they even made a jig like I did.

▲

curiousObject 3 hours ago | parent | prev | next [-]

This story is a case of someone tampering with devices in the supply chain, before the user first receives them.

What you’re describing is a different thing. It’s an “evil maid” attack, when you tamper with a wallet that is already set up by the user. Also, it would be ultra difficult and expensive.

What you’re saying is possible. But:

It would probably be cheaper to build a total fake Ledger Wallet, then just replace the new real wallet and deliver a fake with a weak entropy generator. Any case, that’s not what has happened this time.

▲

j-bos 3 hours ago | parent | prev [-]

millions out of thousands of wallets. Epoxy potting raises the lottery ticket and odds of getting caught by a great deal.