The lack of security on these devices is shocking as someone who has worked in the hardware security space, but I guess it shouldn't be surprising that this like everything else involving crypto is some sort of elaborate scam done by non-experts and bad actors.

▲

hackermailman 2 hours ago | parent | next [-]

I like the fancy security theatre display that the Trezor device has but turns out it initializes with a copy of the legitimate firmware then saboteurs simply overwrite the random seed generator with a predetermined seed after all the startup security checks. https://www.zetter-zeroday.com/trezor-wallets-also-compromis...

▲

lxgr 2 hours ago | parent | prev [-]

What would you be doing differently? There are many hardware wallet vendors out there, and I consider Ledger to be relatively sophisticated. This attack was extremely sophisticated as well.

	▲	tristor an hour ago \| parent [-]
		The attack was sophisticated, but Ledger appears to have taken almost zero precautions against hardware attacks, which made this attack simpler and cheaper to pull off. There are very few precautions that would have completely eliminated the possibility of this attack, but it would have been straightforward to make it more expensive, primarily by investing in tamper proofing and tamper evident design. There are several other comments in this thread that go into fair detail about some examples of these techniques.