Crypto

I flew to Paris to talk to Charles Guillemet
(@P3b7_ ), CTO at @Ledger

I was concerned that the Ledger implant attack could be a worldwide exploit hitting tens of thousands of devices potentially impacting all of us

I am happy to say, that does not seem to be the case

From my discussion with Charles I understood the following:

• It's a physical attack on the actual hardware. Every device has to be opened by hand and fitted with a hidden implant. Then repackaged seamlessly.

• Each implant needs a custom PCB, an LTE modem and dedicated manufacturing

• The tempered devices have to be sent to buyers unnoticed.

This operation is “easy” with one reseller in one region but extremely difficult and expensive to expand to other regions / resellers.

The estimated cost to temper with a few hundred devices in one region are estimated to be more than $1M

The above makes it extremely unlikely that this is a global scale issue impacting thousands of devices

This is a targeted, expensive supply-chain attack, not a backdoor in every Ledger.

Devices bought from Ledger directly are not impacted

@FefeDemeny @P3b7_ @Ledger Now this could happen to any hardware manufacturer, but i don't think on the evidence that is true. There have been confirmed tampered devices bought from resellers in 3 additional countries / stores including europe: Germany. their choice, but seems like ledger are downplaying.