Trezor hardware wallets are vulnerable to physical hacking

The information security unit Ledger Donjon checked hardware wallets from various manufacturers and it turned out that Trezor devices can be hacked in just 5 minutes.

It is reported that when gaining physical access to the device, attackers can hack it in just 5 minutes and get a “wallet” of the wallet. Trezor One, Trezor T, Keepkey and other hardware purse data clones are vulnerable to this vulnerability. At the same time, the vulnerability cannot be eliminated using software patches.

Information security specialists emphasized that Trezor devices are especially interesting because they use open source firmware. True, the chip itself is proprietary, and the low-level functions are hidden in the firmware.

To get a Sid, attackers need physical access to a hardware wallet and tools worth about $ 100. In this case, you can hack the device on any version of the firmware, and success is achieved in 100% of cases. Experts checked this method of hacking on 20 devices and in all cases were able to get a “sid.”

Interestingly, the representatives of Donjon told Trezor about the vulnerability back in December 2018, but so far have not received any reward for its detection. Information security experts believe that the developers most likely were already aware of the possibility of hacking wallets.

Recall that in March of this year, the manufacturer of hardware wallets Ledger also discovered a vulnerability in hardware wallets Trezor. Then, information security specialists were able to reveal the PIN-code in the devices, but the vulnerability was fixed after updating the firmware to version 1.8.0.