Cybersecurity Firm - Hacks Hardware Wallet!

I

n an instant, crypto hardware wallet provider OneKey was infiltrated by cybersecurity startup Unciphered. Nevertheless, the company claims they have already resolved the vulnerability in their firmware that caused the breach.

On February 9, Unciphered uploaded a video to their YouTube channel that detailed how they were able to uncover "a massive critical vulnerability," quickly exploiting it in less than one second and crack OneKey.

Eric Michaud, a partner at Unciphered, went on to elucidate how the hack functions. He identified that within each device there is both a central processing unit (CPU) responsible for managing computations and also the "secure element" in which cryptographic keys are kept. It was noticed that communication between these two parts of the system is generally protected with encryption techniques.

However, Michaud said, "[It] turns out it wasn’t engineered to do so in this case. We figured that out. So, what you could do is put a tool in the middle that monitors the communications and intercepts them and then injects their own commands. We did that where it then tells the secure element it’s in factory mode and we can take your mnemonics out, which is your money in crypto."

In short, a malicious actor could bypass the security pin by disassembling and then re-configuring OneKey Mini to its factory mode. This would allow them access to the mnemonic phrase stored within.

Unciphered teamed up with OneKey to get their bug bounty program running and determinedly patched the vulnerability.

OneKey promptly responded to the video, affirming that no one is negatively impacted, and all reported vulnerabilities have already been remedied or are in process of being fixed.

According to the wallet provider, "Earlier this year, we received a responsible disclosure from cybersecurity startup Unciphered that validated a potential vulnerability in the OneKey firmware, and our hardware team has updated the security patch without anyone being affected."

The team emphasized that these attacks cannot be conducted remotely, as an attacker would need to physically dismantle the device and possess certain knowledge in order for them to have any chance of success. "Physical access through a dedicated FPGA device in the lab to be possible to execute."

Despite their ambition for comprehensive security, OneKey realized that achieving 100% is a near impossible feat; as such, they have sought assistance from white hackers and cybersecurity companies to detect vulnerabilities.

Furthermore, they stated that other wallet providers encounter similar issues - yet OneKey was the most prompt in remedying them.

Jonathan

An editor at Coincrop

View articles

Jonathan is a Coincrop staff writer based in the UK, covering the best rates for cryptocurrency earning and borrowing products. When not at work, he's likely sailing.