how can the implant send the seed words to an attacker? doesn't a crypto wallet have to talk an application on the host computer? wouldn't the communication between the wallet and the host computer never allow for the seed words to be sent from the wallet to the outside world? in other words how could an "implant" tampering of the wallet make the host computer suddenly start sending seed phrases to third parties?

▲

littlecranky67 6 hours ago | parent | next [-]

They sniffed the LCD interface and OCR'ed the seed words when they were displayed using an implanted tiny CPU. This is a very sophisticated attack.

▲

donkey_brains 5 hours ago | parent [-]

They were almost certainly not doing the OCR on the device. Such a CPU would be too power-hungry and the process would still be too error-prone given the limited compute. They would just send the raw data to the C2, which could send it to an emulator, snapshot the output and send it to an LLM.

▲

dezgeg 5 hours ago | parent | next [-]

Well it doesn't need to be a generic purpose OCR, just one that works for this single UI layout and font.

▲

thousand_nights 5 hours ago | parent | prev | next [-]

i don't think OCRing a bitmap font is very expensive or power hungry, if you know the exact pixel configurations of the glyphs ahead of time

▲

foobarbecue 5 hours ago | parent [-]

Exactly. No O, just CR.

	▲	usrusr 5 hours ago \| parent [-]
		Wire character recognition

▲

moduspol 5 hours ago | parent | prev [-]

Streaming the raw data would also be more flexible for other use cases. From what I've read, it was streaming off the generated recovery passphrase, but users aren't required to generate one--they can input one. That'd require a much more sophisticated algorithm than simply reading from the screen, since users are using two buttons to pick from hundreds of words in a randomized menu.

And besides, Ledger firmware can be updated to change fonts and such so it'd be long-term safer to just stream the raw data.

▲

lxgr 6 hours ago | parent | prev | next [-]

The attackers added their own tiny 4G or 5G board.

▲

trillic 6 hours ago | parent | prev | next [-]

They put an eSIM in the device…

▲

karel-3d 6 hours ago | parent | prev | next [-]

There is an eSIM with worldwide data in the device.

▲

kg 6 hours ago | parent | prev | next [-]

Though it's not what happened in this case, you could tamper with a crypto wallet to make it emulate a USB keyboard and once connected, send a series of keystrokes to download and run an exploit.

	▲	lxgr 2 hours ago \| parent [-]
		That's fairly risky, though, as it's very visible to users if it goes wrong, who could then alert the manufacturer, who could in turn warn other users. I suspect that the attackers here have been waiting for enough funds to land on compromised wallets to be worth their efforts and then withdrew everything at once, with comparably little chance to get caught.

▲

ovi256 6 hours ago | parent | prev [-]

The implant could fabricate a reason to connect to a host computer. Like "Cannot display seed words, connect to a computer to debug"