Read

A developer has acknowledged that a malicious firmware update can “exfiltrate” the seed and record the passphrase of a Trezor device. 
This revelation emerged during a discussion on Trezor’s official&nbsp;<a href="https://forum.trezor.io/t/under-any-circumstances-could-a-firmware-update-or-malware-posing-as-update-ever-extract-wallet-seed/12964" target="_blank" rel="noopener">forum</a>. It is weeks after the Ledger Recover feature suggestion that drew even more concern about the security of assets stored in popular hardware wallets. 
<h2 class="wp-block-heading" id="trezor-confirmation">Trezor confirmation</h2> 
The developer emphasized that although open-source software allows for global community scrutiny and the use of hashes and signatures to verify authenticity, these measures do not eliminate the possibility of harmful code being included in an official software release. 
He said: 
<blockquote class="wp-block-quote"> 
 “The firmware running on your Trezor must have access to private keys – otherwise, it could not sign your transactions. That means if the firmware turned malicious, it could exfiltrate the private keys. The only way to prevent that would be to freeze the device so that it could never be updated – and pray that there aren’t any problems in the frozen version already.” 
</blockquote> 
The concern raised by the official Trezor representative is that by the time the community identifies such malicious activity, it could already have caused significant damage to users. Additionally, uncertainties exist regarding potential future governmental actions and policies toward cryptocurrencies, which may impact companies in this space. 
 You might also like: <a href="https://crypto.news/trezor-partners-with-wasabi-wallet-to-enhance-bitcoin-transaction-privacy/"> Crypto Wallet Providers Ledger and Trezor Dismiss Claims of Database Hack </a> 
These comments have generated concerns among Trezor users, calling for increased transparency regarding the company’s security practices. Suggestions have been made for users to explore hardware wallets from alternative manufacturers. Trezor has asserted its commitment to security and expressed its willingness to collaborate with the community to address any potential risks. 
<h2 class="wp-block-heading" id="ledger-lambasted-for-suggesting-recover-feature">Ledger lambasted for suggesting “Recover” feature</h2> 
In May 2023, Ledger announced “<a href="https://crypto.news/ledger-ceo-explains-the-companys-path-to-regain-user-trust/" data-type="post" data-id="14162111">Ledger Recover</a>” for users to extract their private keys and store them on an external server. Ledger and a third-party custodian were tasked with keeping assets’ private keys.&nbsp; 
Despite the assurance from Ledger that private keys would be secure, critics said client assets could be compromised should the third-party server be compromised, placing billions of assets at risk. 
At the same time, critics pointed out the decision by Ledger to demand clients submit government-issued identities to access the feature. 
In 2020, Ledger experienced a security breach that resulted in the theft of over 270,000 physical addresses belonging to their clients. 
 Read more: <a href="https://crypto.news/ledger-enters-institutional-trading-space-with-launch-of-tradelink/"> Ledger enters institutional trading space with launch of Tradelink </a>

Trezor developer confirms private keys can be extracted if firmware is corrupt

Table of Contents

crypto.news

Other articles published on Jul 8, 2023

ADA and XRP Suffered the Most With Last Week’s Profit Taking

Solana (SOL) Sees Over $1 Billion Inflows in 24 Hours: Key Factors Behind the Pump

XRP, ADA Prices Have High Chances of Rebounding, Santiment Says, Here’s Why

CA-US Law Journal Explores SEC-Ripple Lawsuit, Offers Key Perspectives

FBI Raids Kraken Co-Founder Jesse Powell’s Home

Algorand in Crisis: Investor Evacuation Threatens ALGO Stability

Join our free newsletter for daily crypto updates!