Read

/send

<div class="protos">
 <div>
 <div>
 <div> 
 Sleuths have discovered a vast data harvesting operation by the world’s largest hardware wallet manufacturer, Ledger. For reasons that are difficult to comprehend, Ledger Live software transmits information about clicks, page visits, redirects, crypto transactions, page scrolls, numbers of accounts, crypto asset names, session durations, hardware device types, and firmware versions to Ledger’s analytics provider. 
 Ledger Live is the official software for interfacing with any Ledger hardware wallet. The vast majority of PC users download this software in order to set up their hardware wallet and sign transactions. While inspecting its code, REKTbuildr found that user tracking is built into the entire software suite. He called it a “gigantic user tracking system.” 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 Cleaning user tracking code from <a rel="dofollow" title="Ledger" href="https://thebittimes.com/tag/ledger.html">Ledger</a> Live code and JFC the whole thing is a gigantic user tracking system There's analytics trackers for nearly all events, on most screens. <a rel="dofollow" title="Ledger" href="https://thebittimes.com/tag/ledger.html">Ledger</a> Live is a user data collection tool How is this system even accepted by the <a rel="dofollow" title="Crypto" href="https://thebittimes.com/tag/crypto.html">Crypto</a> community?— REKTBuildr (@rektbuildr) December 6, 2023
 </blockquote> 
 </div>
 </figure> 
 The application is sending tracking data to a service called segment.io. This data includes information on digital assets and NFTs stored on Ledger wallets. 
 <h2 class="wp-block-heading" id="a-risky-ledger-live-default-setting">A risky Ledger Live default setting</h2> 
 The Protos team did find that there is an option to turn off at least some of these analytics in <a rel="dofollow" title="Ledger" href="https://thebittimes.com/tag/ledger.html">Ledger</a> Live’s settings. The settings tab of <a rel="dofollow" title="Ledger" href="https://thebittimes.com/tag/ledger.html">Ledger</a> Live says enabling analytics will send data on “clicks, page visits, redirections, actions (send, receive, lock, etc), end of page scrolls, (un)installing and app version, number of accounts, <a rel="dofollow" title="Crypto" href="https://thebittimes.com/tag/crypto.html">Crypto</a> assets and operations, session durations, the <a rel="dofollow" title="Ledger" href="https://thebittimes.com/tag/ledger.html">Ledger</a> device type and firmware.” 
 <figure class="wp-block-image size-large">
 <img decoding="async" loading="lazy" width="1024" height="656" src="https://cdn.thebittimes.com/images/2023/12/11/f9e82e7153014d23dfa51cde006194b0.webp" alt class="wp-image-55982" srcset="https://cdn.thebittimes.com/images/2023/12/11/f9e82e7153014d23dfa51cde006194b0.webp 1024w, https://cdn.thebittimes.com/images/2023/12/11/f9e82e7153014d23dfa51cde006194b0.webp 300w, https://cdn.thebittimes.com/images/2023/12/11/f9e82e7153014d23dfa51cde006194b0.webp 768w, https://cdn.thebittimes.com/images/2023/12/11/f9e82e7153014d23dfa51cde006194b0.webp 1536w, https://cdn.thebittimes.com/images/2023/12/11/f9e82e7153014d23dfa51cde006194b0.webp 2048w" sizes="(max-width: 1024px) 100vw, 1024px">
 </figure> 
 Read more: Ledger dubs service ‘risk-free’ despite losing millions of user emails 
 Ledger Live’s data harvester is a JSON object with a properties key. It transmits user ID and a ‘writeKey,’ which can uniquely identify the PC. It can also send segment.io account information including names of digital assets owned and other information about users’ computers.&nbsp; 
 Although Ledger Live doesn’t send private keys or recovery phrases to segment.io, it sends plenty of information about a user that could subject users to extortion attacks. Any segment.io hacker, for example, could easily identify any user with substantial crypto holdings — including timestamps of crypto activities and other terrifyingly detailed information about assets. 
 <h2 class="wp-block-heading" id="h-aggregating-ledger-users-as-a-high-value-audience-package">Aggregating Ledger users as a high-value audience package</h2> 
 A likely commercial explanation for all the data harvesting, REKTbuildr speculated, is that Ledger wants to resell anonymized data to third-party advertisers. Prepackaged IP or cookie ‘audiences’ with thousands of users who have engaged in a recent digital action, such as clicking a button within a crypto app, for example — are commonly resold to advertisers by data aggregators like Google, Bluekai, or eXelate. 
 Alternatively, the data could be used internally for user experience (UX) and user interface (UI) workers at Ledger.&nbsp; 
 As a courtesy to the community, REKTbuildr forked Ledger Live software, removed its tracking codes, and uploaded the patched software to GitHub. 
 Naturally, <a rel="dofollow" title="Ledger" href="https://thebittimes.com/tag/ledger.html">Ledger</a> had very little to say about analytics <a rel="dofollow" title="harvesting" href="https://thebittimes.com/tag/harvesting.html">harvesting</a> on its social media. Its disinterest comes as little surprise to the digital asset community. 
 Ledger has already shocked the community’s trust in its hardware wallets. In May, it announced a controversial Recover service that shared abilities to remotely decipher the private keys on one’s hardware wallet. It unapologetically pushed that update live, eliminating years of perception that private keys never left a hardware wallet. 
 Another lowlight in Ledger’s history includes its email database. Hackers exposed millions of its users’ emails, which led to users receiving fake wallets in a likely phishing attack. Experts quickly posted warnings. 
 In summary, Ledger is tracking user data, possibly for its own UI/UX workers, or to profit from resale. Luckily, users have alternatives, including tracker-free forked versions of the software, or using the hardware wallet itself without installing Ledger Live software at all. 
 Got a tip? Send us an email or ProtonMail. For more informed news, follow us on X, Instagram, Bluesky, and Google News, or subscribe to our YouTube channel. 
 </div>
 </div> 
 </div> 
</div> 
Source: <a rel="dofollow" target="_blank" href="https://thebittimes.com/researcher-finds-data-harvesting-inside-ledger-live-app-tbt73298.html">https://thebittimes.com/researcher-finds-data-harvesting-inside-ledger-live-app-tbt73298.html</a>

Researcher finds data harvesting inside Ledger Live app

Table of Contents

TheBitTimes

Other articles published on Dec 11, 2023

Cathie Wood’s ARK Invest Sells $49.2M Coinbase: What’s Happening?

Tether freezes OFAC-listed wallets under new policy

Cryptocurrency Developments in Turkey: Banks Take Steps into Crypto

Crypto Trend Reversal On the Cards As Investors FOMO For Buying the Dips

Bitcoin, Ethereum, Solana, XRP Witness Sharp Declines: The New Era of Copy Trading with Coin Otag...

Bitcoin 145%YTD Rise Vs Ethereum’s Growth: Unraveling POOR COIN’s Excitement

Join our free newsletter for daily crypto updates!