pull down to refresh

what's the point of posting an unreadable screenshot and saying "confirmed vuln"? what's the vuln?

reply

afaik

  1. guaranteed entropy bug in mk3 with its available firmware
  2. entropy bug could be in mk4 also running the old firmware (it shipped before the bug was fixed according to NVK's version range)
  3. without more info, worth assuming entropy bug could be in all coldcard devices with any firmware
reply

I'm more just wondering what that screenshot is supposed to say. It looks like a diff but can't read any of it.

reply

afaict it's LLM output showing that the LLM recovered the seed from the xpub.

reply
974 sats \ 1 reply \ @Murch 31 Jul

Right. Instagibbs was able to regenerate an affected wallet’s seed by using a firmware-reset Coincard. The only necessary input was the number of button pushes on the device. I have seen someone state that the wallets were generated just with 17 bits of entropy and maybe the date, which is trivial to traverse programmatically.

reply

that's actually crazy

reply

This is a very very massive hack. But of course the stackers know that.
My guess is that the 'real' hacking is just beginning.

A low-entropy passphrase is not good enough because a '25th word' is a joke to brute force it's basically like not even having one. And a lot of people won't know about the hack, and now that the whole world is looking for it all the those seed phrases are toast. Next the hackers will be using low-entropy '25th words' with low-entropy seeds just GPUs to rainbow-tables.

A lot of cold card customers will be waking up confused as to what happened.

Not to mention a lot of people don't have access to the HWW or they are at work or traveling or whatever so they can't just move things. Plus they need a safe seed to move it to. Plus my guess is that anything in the mempool... will only draw attention to vulnerable seeds which will be brute-forced by hungry hackers.

Twitter is saying the bug potentially effects mk3 mk4 and Q devices.

reply

The main line there is that this may not be contained to just mk3. The Coinkite advisory says it does not affect mk4, but as the screenshot shows some people are not sure about that.

The vulnerability is that if you used a mk3 to generate your seed, it is likely not using very good entropy. And so someone else can deduce your private key.

reply

good summary. this should be higher

reply

mk4, mk5, and Q only use 32 bits of cryptographic entropy (when they should use 256) due to the same bug. they are crackable. not trivially crackable like the mk3, but relative to nonbugged entropy, very very very crackable.

reply

my big question is how did no one notice the weakness earlier?

one of my biggest security assumptions, that flaws will be exploited quickly ( so widely adopted and seasoned systems are safe) is being thrown into question

reply

very hard to spot bug: #1536646. also fewer people read the code than you'd think.

reply

i dunno man, if I'm a HW wallet maker.... this is like literally my #1 priority in terms of testing... the true entropy of the wallet

and because of a wrongly specified if then traversal?? this just looks bad

reply
reply

wha whaaaa??

reply
105 sats \ 0 replies \ @so7ow 30 Jul
what's the point of posting an unreadable screenshot and saying "confirmed vuln"? what's the vuln?

Blog post in OP

reply
reply