Vulnerability unnoticed for 14 years affects cryptocurrency wallets
Perpetrifying an EUCLEACK attack requires physical access to the microcontrollers of new Trezor wallets and other wallets.
Ninjalab claims not to have verified that EUCLEACK can be perpetrated on the affected wallets.
The Infineon microcontrollers that run this cryptographic library are vulnerable.
NinjaLab, a team of security researchers, detected a vulnerability that went unnoticed for 14 years. It lies in the secure element hardware microcontrollers used by many cryptocurrency wallets.
The vulnerability affects, for example, the new Trezor (safe 4 and safe 5) and the entire YubiKey 5 series with firmware version lower than 5.7. The EUCLEACK attack requires physical access to the hardware wallet. According to NinjaLab, this vulnerability went unnoticed for 14 years and around 80 Common Criteria certification assessments of the highest level.
According to NinjaLab's research summary, the vulnerability affects all devices running the library from Infineon Technologies, one of the largest manufacturers of secure elements.
What is the vulnerability found in wallets?
The discovery was made by Thomas Roche, co-founder of NinjaLab, who claims to have found a "side channel vulnerability." Having found it, he designed a lateral attack (EUCLEACK) that demonstrates that it is possible to breach the secure element microcontrollers carried by some cryptocurrency wallets.
The feasibility of this physical attack was demonstrated by NinjaLab on a YubiKey 5Ci, a security key model that uses the FIDO protocol, which is usually composed of a secure element.
In general, this lateral insecurity affects even more recently designed microcontrollers, such as those carried by the Trezor Safe series. Therefore, it does not affect the Nano or T models.
#billetera #BilleteraCripto #wallet #Hacker #Hackeo