Looking at the images here, there is zero attempt at security here from the ledger team. They’re using an MCU (ST MCU with Cortex M4 core) that doesn’t have any meaningful security features (ie, no secure boot, no differentiation between trusted and user mode operation - features the newer Cortex M33 core supports and newer ST parts implement). So there’s no way to guarantee that the software running on this has not been tampered with.

There is no physical tamper detection either. No tamper pads to detect case openings, no seal that gets broken when it’s opened that prevents operation. As others have mentioned, the most basic precaution would be to glue the whole thing together, which they didn’t do either.

Trusting Ledger with securing anything secret would be a very bad idea.

> Looking at the images here, there is zero attempt at security here from the ledger team. They’re using an MCU (ST MCU with Cortex M4 core) that doesn’t have any meaningful security features (ie, no secure boot, no differentiation between trusted and user mode operation - features the newer Cortex M33 core supports and newer ST parts implement).

That MCU is explicitly not assumed to be critical in their security model [1]. It handles Bluetooth and USB communication, both of which are assumed to be insecure transport layers. Securing the MCU would not have helped in this particular incident, and I can't think of a scenario in which it would be critical.

Button input and screen output, which are critical, are handled by a secure element. Unfortunately, at some point even the most hardened secure element will have to output data to be displayed on a screen; that's what was attacked here. Electronic shoulder surfing, basically.

[1] https://www.ledger.com/ledger-nano-x-bluetooth-security-mode...

This is a great observation! I regularly end up with M33 devices I program as they make sense for reasons other than security. (E.g. an Atmosic one, and St ones like L5/U5/H5). I look at the secure flash functionality and think "This is annoying and I have no current or projected use for this."

I ponder "What applications would I want this security stuff for?" Crypto wallets are a great example... and the crypto wallets in the wild aren't using them, as you point out!

Yes to all that, and, why not use a clear plastic housing? Make it way harder to hide the tampering.

It's just amazing to me sometimes that people get so far with so little sense of professional responsibility. I have no particular expertise in hardware security and even I would have made put more effort in. And this company has been around since 2014! What excuse can there be?

Edit: For folks down voting me, please explain. I'm genuinely curious about your perspective.

Ironically, there have been several crypto wallets that use much better hardware security, but they can't beat Ledger on marketing.

> They’re using an MCU (ST MCU with Cortex M4 core) that doesn’t have any meaningful security features (ie, no secure boot, no differentiation between trusted and user mode operation - features the newer Cortex M33 core supports and newer ST parts implement).

This doesn't help any bit against the hardware implant we're discussing here.

> So there’s no way to guarantee that the software running on this has not been tampered with.

While true, I don't think it matters too much, other than the possibility of turning the device into something like a rubberducky.

> There is no physical tamper detection either. No tamper pads to detect case openings, no seal that gets broken when it’s opened that prevents operation. As others have mentioned, the most basic precaution would be to glue the whole thing together, which they didn’t do either.

Now that is the real meat. Unfortunately, for any given attack it's possible to bypass it. Tamper pads, if you know where they are, you can drill through the housing and, depending what it is, keep the button pressed by a jig, or solder wires if it's a sense trace to bridge it. The housing itself can easily be fully replicated, it's just a matter of coughing up some money for custom molds.

The only way to make something relatively tamper proof is to use injection molding over the full housing with something like glitter as part of the plastic, that will distribute randomly - and most importantly: not replicable! - across the housing, and then take high quality photographs and store them on your website together with the serial number.

That way the customer can photograph the device they have, and compare the random glitter specks with those on the website.

Tamper proofing hardware is among the hardest things there are, especially if you are up against nation-state actors like North Korea (that has been known to engage in cryptocurrency theft in the past).

That's bad. The HSM in a typical laptop has some of these features.