15 year old pwns Ledger Nano wallet, update that firmware

in security •  9 months ago

Matthew Green Twitter Ledger
image from @matthew_d_green

Time to update that Nano

A few weeks ago Ledger issued firmware 1.4.1 to the Nano crypto hardware wallet which fixed some security issues.

At the time, there was speculation how serious this issues were, and if your data at risk for theft. The conclusion at the time was that your data was safe but it was still potentially serious.

Today, Ledger have updated their blog with some more key information as well as a nod to 15 year old security researcher Saleem Rashid who has published a very good writeup of his findings on his blog: https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/

And if that is too much, crypto professor Matthew Green has written a nice Twitter thread summarizing the implications of this vulnerability for Ledger and a whole class of these kind of secure devices. https://threadreaderapp.com/thread/976066416267939840.html

The most important conclusion is that you should update your Nano firmware to 1.4.1 ASAP if you have not done so already.

Authors get paid when people like you upvote their post.
If you enjoyed what you read here, create your account today and start earning FREE STEEM!
Sort Order:  

Good to hear this. Updates are always something to keep an eye on.

Scary...thanks for the heads up


indeed, hopefully 1.4.1 is safe for the moment
one big take away is don't buy second hand Nano devices

Best alternative is Trezor!


Perhaps, though Trezor has it's own security issues and doesn't use a secure chip


Damn! We are fucking exposed.

Just saw Brian Krebs weighed in on this as well and points out Rashid is 15 years old. Impressive !