SlowMist CISO Speculates on Ledger Attack Path Involving Screen Recording of Seed Phrase

SlowMist Chief Information Security Officer 23pds said that if the Ledger modification described by former Mt. Gox CEO Mark Karpelès occurred on the PCB, it would indicate a highly sophisticated attack. He outlined a possible sequence in which the seed is generated inside the secure element, the recovery phrase is shown on the screen, and a malicious module taps the screen data line, such as SPI, to record the displayed words before sending them out through LTE or eSIM.According to Foresight News, 23pds said attackers could then obtain the recovery phrase and transfer the assets. He added that the module could be used to analyze characters shown to the user and transmit the related data after the phrase setup is completed.Karpelès previously said he received a Ledger hardware wallet that appeared to contain a spy module. He said the device came from Malaysia, the outer shrink wrap was intact, and no anomaly was immediately visible after opening it. He said the implant was hidden where the screen’s original cushioning pad should have been and included LTE communication components, an antenna, an eSIM, and a microcontroller connected to the Ledger SPI bus.Karpelès said the attacker may have monitored the victim’s wallet address and chosen a time to move the assets.