acstapleton

While secure boot and the other software features might not have defended against this attempt, it highlights the abject failure of the company to even make an attempt at security.

You bring up a good point about bypassing physical tamper detection, but those defenses increase the cost and complexity of the attack, making them harder to succeed undetected. As it is, this attack seemed quite trivial to implement.

Looking at the images here, there is zero attempt at security here from the ledger team. They’re using an MCU (ST MCU with Cortex M4 core) that doesn’t have any meaningful security features (ie, no secure boot, no differentiation between trusted and user mode operation - features the newer Cortex M33 core supports and newer ST parts implement). So there’s no way to guarantee that the software running on this has not been tampered with.

There is no physical tamper detection either. No tamper pads to detect case openings, no seal that gets broken when it’s opened that prevents operation. As others have mentioned, the most basic precaution would be to glue the whole thing together, which they didn’t do either.

Trusting Ledger with securing anything secret would be a very bad idea.

As a professional in the space, this echoes my experiences. I’m far more productive in Rust than C, despite having many more years programming embedded software in C. Cargo and the crate ecosystem are a dream compared to the lack of any easy-to-use build tooling and the difficulty of integrating third party libraries in C.

Furthermore, the code I’ve produced in Rust is generally as fast (or faster) than the code I’ve written in C for the same task, and it’s easier and faster to write.

And I also maintain an open source HAL for an STM32 family! Previously those have just been in house HALs in C because there were no such community efforts.

Nothing is really going to protect you from a direct lightning strike. Lightning strikes are on the order of millions of volts and thousands of amps. It will arc between circuits that are close enough and it will raise the ground voltage by thousands of volts too. You basically need a lighting rod buried deep into the earth to prevent it hitting your house directly and then you’re still probably going to deal with fried electronics (but your house will survive). Surge protectors are for faulty power supplies and much milder transient events on the grid and maybe a lightning strike a mile or so away.