Ledger Hardware Wallet Customers Should Be Worried

Ledger, one of the most prominent hardware crypto wallet vendors, has infuriated its customer base by introducing an optional monthly service that requires a firmware update which enables the exportation of users' private keys. Now, the primary purpose of hardware-based crypto wallets is to protect users' private keys from being exposed to others, including cyber criminals, hackers, and, well, just anybody else. In fact, Ledger itself had previously stated their product would never expose users' secrets. That was part of the marketing message. But this, this new recurring revenue business plan is changing all of that, and the user base has gone ballistic. So did many other notable cryptocurrency, cybersecurity, and technology luminaries who have also been quite vocal about their disapproval. Then there's more, a lot more. This service requires full identification of the user, and again, this is an opt-in service, right, as part of the whole registration process. With the crypto community being a largely privacy-focused group, this was an outrage in of itself. They like anonymity, they like privacy. Now, my biggest concern are the security ramifications. Adding a new firmware function that allows users' secrets to be exported from the hardware secure element is risky. Imagine, if you will, for a moment, a child's piggy bank that only has a slot in the top to deposit the money. The money is safe in the bank unless smashed, of course, but overall it's pretty safe from little hands and, and others trying to get to the money. Now imagine if a vendor installed a door in the bottom of all the customers' piggy banks and said, "This is optional to use." Well, the mere fact that you've installed the capability to open the bank weakens the overall security. The very best hardware security has no functions to allow secrets to exit That should be part of the architecture and design. If the functions exist, then they will be targeted or potentially misused. Now, I wanted to understand what Ledger was doing here, so I joined their live AMA, ask me anything, session today, and I was shocked Every customer was upset and did not want to be subjugated to this new feature or potentially victimized by updated firmware. And the customers have been communicating in many different ways, most of which are on social media, uh, in Twitter and on Discord, but There's been a lot of talk about this. It has been a marketing nightmare for Ledger because so much of the community has risen up in unison and said, we don't want this. What I learned today is the company doesn't care. I was keenly listening to the chief technology officer, but it became obvious that although he is savvy in developing products and implementing things like encryption, he is not really a cybersecurity expert. And I've talked about this duality, this conflict for many years, how even a brilliant developer working on a security tool may not actually be a cybersecurity risk professional. It's kind of like the equipment in a hospital emergency room. Yes, a healthcare engineer designed and built the machine that goes beep, but you would not want him to be working on you in an actual emergency. You would really want a doctor or a surgeon to provide you medical care in the event of emergency. A security technologist is far different from a cybersecurity risk expert, and we have to understand that. So during this AMA, I was listening and there was many, actually far too many examples, but I've cherry-picked a handful of ways that I could tell that Ledger does not possess, or at least listen to A cybersecurity risk professional. So first off, when the CTO stated that encrypted data is zero information, implying that it's completely secure, no! I about fell out of my chair. Encryption gets undermined all the time, and even the best algorithms today will be broken like twigs in the future. Now I get that from a perspective of an encryption engineer. Yeah, you're going to employ the very best tools and tactics of today, but you're not seeing the big picture. In another statement, he said that the new firmware that would enable exportation of users' secrets would not increase the risk to the device. Yes, it absolutely does. The new code that enables exfiltration of data is a new attack point. Obviously there was not a real cybersecurity risk assessment done for this project, and if it was, they're either ignoring it or choosing not to talk about it because for the chief security officer, Who's also their chief technology officer to claim that putting in code like that to intentionally offload, exfiltrate sensitive data doesn't increase the risk. They don't know what they're talking about. They simply don't. And either that or they're just bold-faced lying to you. The third thing that I heard is they stated that this service was optional and therefore non-users of this service, the people that did not opt in, would not be affected by this at all. Well, that's wrong too because the firmware upgrade goes to everyone even though they've been asked not to send it to everyone, only to be used, you know, the customers have asked for this firmware only to be used for those that opt in? No. The plan is the firmware goes to everyone, and that means everyone then has to deal with an elevated risk of that code function being used in malicious, unexpected, or non-approved ways. The next cringe moment, and I did cringe, is when, and I believe it was the CEO, was throwing out just a handful of cybersecurity terms, but was using them in the wrong context. His adaptation of security theater, which is a term we use in the industry, was completely off base. Okay, if you don't understand security, please don't act like you do. Don't throw out the terminology and try and use it in an example. Because he used it wrong. The last example I'll bring up is a user, uh, was allowed to give a question, and they raised a question about hackers potentially intercepting exported secrets, right, for those who have opted in and they send their secrets to go get stored. And the Ledger thought leaders immediately jumped on this and said that is a phishing attack and began to incorrectly discuss in detail how they were protected from phishing. Except the question was actually about man-in-the-middle impersonation attacks, not about phishing, which can be leveraged in many different types of attacks. They couldn't even recognize the difference. Again, That is something that I have seen firsthand with engineers working on security. But a cybersecurity risk professional would never make such a mistake. The reality is the moment you build a door, it becomes a target. Attackers can pick locks, hack systems, undermine infrastructure, abuse processes, and manipulate vendors. Every cyberattack you see in the news is a victim of this type of shallow thinking. And even after countless asks during this, before it, and after by their customer base, by the community that they serve to make this firmware either optional or to create an entirely separate product for this service independent from the current devices that are out there on the market, or to simply outright stop the insanity by ending this initiative. The CEO did not care. The CTO seemed a little strained in having to answer these questions, but both pushed forward and said it was going to happen. They were going to do a little open source code review and some other things, but this was going to impact them. My advice: if you are a Ledger customer, I would seriously evaluate how much additional risk you are willing to endure from this vendor's business decisions and indifference to security. Also keep in mind this company had a data breach of customer data as recently as 2020. In my mind, the security of the Ledger hardware wallet has been weakened through this entire initiative, potentially to a level of a software-based wallet, which then makes you ask the question, why would I go out of my way to spend a lot more money on a hardware wallet if it's no better than a software one? The CEO is willing to undermine the security of his products in pursuit of new revenue. And I now realize the CTO is not a cybersecurity expert. Now, if you are a Ledger competitor, well, this is an opportunity. This is your chance to swoop in and take market share by showcasing how you will not make these mistakes. And how you will listen to the cryptocurrency customer base and the cybersecurity professional community, I think much of their customer base will be looking for new options.