Gian

Free speech

Public Key

npub15yjnt69lfacjyydk3al7wvpaq0putnlgz4g3d42nle4c4kagt4qsskucmw

NIP-05 Address

gian@nostr.red

NIP-57 Address

gian@getalby.com

Profile Code

nprofile1qqs2zff4azl57ufzzxmg7ll8xq7s8s79el5p25gk64flu6u2mw596sgh094z2

Author Public Key

npub15yjnt69lfacjyydk3al7wvpaq0putnlgz4g3d42nle4c4kagt4qsskucmw

Show more details

Last Notes

2024-09-04 08:20:17

Building BOLT 12 into Strike
https://strike.me/blog/bolt12-offers/

2024-09-03 07:24:32

- reply

Jami app ....

2024-09-02 18:11:04

- reply

https://www.youtube.com/watch?v=3ZtkMmVDNEo

2024-09-02 18:08:21

https://www.youtube.com/watch?v=g6igTJXcqvo

2024-08-31 15:32:14

- reply

Super cool!

2024-08-31 11:09:52

Bypassing airport security via SQL injection
https://ian.sh/tsa

2024-08-31 11:07:45

- reply

https://darkskippy.com/

2024-08-31 11:06:56

Threat models and Dark Skippy
Source: @reardencode on X
The world of hardware signing device security was given a shake by the announcement of the Dark Skippy
method for a signing device to leak secrets. It has been known for years
that a malicious signing device could potentially exfiltrate secret data from the secure, offline device via the signatures it produces, but this new method improves on the state of the art in 2 important ways:
Dark Skippy enables the attacker to extract the secret data in just a few signatures rather than approximately 64.
Dark Skippy enables the attacker to extract any secret data, not only the secret key specifically being used in signing.
That sounds pretty bad. Surely this requires immediate attention of all hardware signing device makers! Not so fast. In order to decide how important this new attack is to us, we need to model the threat.
First, to use Dark Skippy, the attacker must have their code running on a user's signing device, in the portion of the device with access to the secret keys. All reputable signing device manufacturers (except SeedSigner) require signed firmware images, so an attacker would either have to compromise the device's signature verification or modify the hardware to install the attack code. The level of difficulty here varies widely from device to device, but in all cases, the attacker must compromise the supply chain to install the attack. This is not an attack that can be performed remotely either. The attacker has to physically intercept devices and reprogram or modify them.
Second, the sad reality of the bitcoin space is that attacks such as the one publicized by Junseth
are effective ways to steal people's bitcoin. These attacks do not require cryptography and do not require physically intercepting device shipments. Beyond these social engineering attacks, malware on a user's general purpose computer (laptop) is the next best way for attackers to steal users' bitcoin from the comfort of their own home. Even more sadly, the other likely way that a user will lose their bitcoin is through their own error in setting up their wallet or transferring bitcoin to that wallet.
Third, hardware signing device manufacturers employ a wide array of techniques to protect against exactly this category of supply chain compromise. From tamper evident packaging, to serialized chips that can be cryptographically verified with the vendor, to epoxy potting or ultrasonic welding, cross-component verification, and more.
The rewards of this category of attack must be much higher than easier attacks for the significantly higher costs and risks to be justified. This limits the applicability of this attack category to the likes of organized crime (both governmental and extra-governmental).
Next, we need to talk about the target, you. You have some bitcoin, and you secure it using some (or some combination of) hardware signing device. What is the likelihood that your specific device was compromised by this category of attack at the time that you bought it? How can you personally protect yourself from this attack?
Am I safe?
If your device is any of ColdCard, Trezor Safe 3/5, Ledger, BitBox02, Keystone Pro 3, BitKey; and it arrived directly from the manufacturer (or a trusted reseller) on time and in the expected condition, your device is not compromised.
There are 3 commonly used devices for whom this threat is more material:
Trezor devices without a secure element (SE)
Blockstream Jade
SeedSigner
These devices are more vulnerable because an attacker can install malicious firmware without physically modifying the device.
With any reputable device other than SeedSigner that was not physically modified, if you have installed upgraded firmware (whose signature you verified) since receiving your device and observed the expected change in behavior from the new firmware, your device is not compromised.
What about SeedSigner?
SeedSigner was used to demonstrate this attack (rather than Trezor w/o SE or Jade) because it requires no hacking of any sort to swap the firmware on the device. It is fair to say that SeedSigner is therefore the most vulnerable reputable device to this type of attack. However, even with SeedSigner: if you assembled the device yourself, and have installed firmware whose signature you verified, you are very likely safe.
I cannot make a confident assertion that you are not compromised even if you did assemble your SeedSigner yourself because SeedSigner uses more 3rd party software than others and (if you are targeted by organized crime) the SeedSigner board includes a sufficiently complex embedded firmware (that you do not replace when you install the SeedSigner software on the SD card) that the embedded firmware itself could implement this category of attack.
What do I do now?
If you are concerned that your device may have been compromised, my primary advice is to review the "Am I Safe?" section and put yourself into a posture that is safe from this attack before broadcasting your next transaction. As long as you do not publish any transactions produced from a potentially compromised device, your secrets remain safe.
However, there is one other way to gain near perfect confidence in your current device. Because all of the devices mentioned herein use RFC6979 for ECDSA signing and many of them use deterministic nonces for BIP340 signing as well (despite BIP340 recommending adding auxiliary randomness), you can compare signatures from your device with another implementation of their specified signature algorithm. Producing a random number of signatures for random sized fake UTXOs and various transaction topologies is recommended to overcome attempts to hide the exfiltration behavior. This should be considered an advanced mitigation, so do not attempt it if this sounds difficult.
Other risks from a compromised device
The other detail that was often omitted from the discussion of this vulnerability is that a malicious signing device has many other ways to attack its user. Some of these are pretty easy to mitigate, others are not.
A malicious device could produce weak seeds that the attacker is scanning for. This is harder to detect than Dark Skippy, but may not target as high value of wallets (as those wallets are more likely to bring their own seed). You can fully mitigate this type of attack by producing your own seed using some form of physical entropy and a verifiable algorithm (dice rolls, word picking, etc.).
A malicious device could leak secrets in other ways - it can emulate other USB devices and attempt to open a URL that includes the secret, it can post QR codes or NFC messages that include the secret and which host devices are likely to kindly offer to open for the user, it can include a wifi or cellular chip to directly transmit the secret, and probably more.
My point here is that Dark Skippy does not materially change the threat landscape. If you have a malicious device, you are in trouble. Find a way to ensure that you do not have a malicious device.
Conclusion
FUD sells - while this attack is exciting from a cryptography / security nerd point of view, it does not really shift the threat landscape for hardware signers. Everything I wrote about device safety applied equally before this attack.
The best hardware signing device for you is the one that you have and use. There are many different devices that can all be used to increase your security, especially when used in a multi-signature setup.
Using a Raspberry Pi based SeedSigner with high confidence is difficult. When ESP32-SeedSigner is available, it will be in the same security class as Jade (or possibly slightly higher due to supply chain risk mitigation).

2024-08-27 10:50:06

https://bitcan.world/
https://bitcan.world/img/img_4.jpg

2024-05-14 15:03:43

- reply

They are retarded...

2024-01-15 14:20:23

https://nostrfiles.dev/uploads/eyOBNIxxNUG4A1jj4aAP.jpg

2023-10-18 16:45:11

- reply

But no rain, right?

2023-10-03 09:06:29

- reply

Which one?

2023-03-21 22:04:24

#nostrica is very very important moment for our community

2023-03-21 21:44:47

GM @fiatjaf

2023-03-16 14:15:01

- reply

https://twitter.com/ElectrumWallet/status/1636031420102574083

2023-03-16 14:14:14

- reply

Electrum twitter account....

2023-03-15 16:22:56

#Electrum wallet will include UTXO privacy analysis tool
https://nostr.build/i/nostr.build_96ee8e45421106541a7a1b14ac47e3e6c153a40c4f7aa63e9dd08b3fdd3e66de.png

2023-03-07 14:12:01

- reply

mmmmm, I think 50% yes and 50% no....but the price will massive change in that days imo, very fast....

2023-03-07 14:07:00

What do you think about #MtGox #bitcoin giveaway? What's about the price? Sell or #hodl?

2023-03-07 14:05:13

https://bitcoinmagazine.com/business/stratum-v2-will-save-bitcoin-mining

2023-02-28 15:09:44

Luke Dashjr #bitcoin dev calls out NFT auction for using his credentials https://stacker.news/items/145093/r/Gian

2023-02-27 18:43:26

#BTCPay server adds Coinjoin Plugin
https://bitcoinmagazine.com/business/btcpay-server-adds-coinjoin-plugin

2023-02-23 14:53:06

#[0] https://twitter.com/bluewalletio/status/1628733798438281216?cxt=HHwWgICxmdSwtpotAAAA

2023-02-21 22:45:32

#zap

2023-02-20 18:20:31

Customers of FTX Japan will be able to withdraw deposits of crypto and fiat currency tomorrow #FTX https://decrypt.co/121759/ftx-japan-withdrawal-funds

2023-02-19 14:48:46

- reply

You know sugar is poison....

2023-02-19 14:25:03

https://www.cryptobuzz.it/best-2023-hardware-wallet/

2023-02-19 14:05:36

A Nostr cloudflare worker proxy relay that publishes to all known relays: https://github.com/MutinyWallet/blastr

2023-02-19 14:02:40

What is in your opinion the best Nostr client?

2023-02-19 14:00:50

https://tokenhell.com/binance-engages-in-talks-with-us-authorities-to-address-regulatory-shortcomings/

2023-02-18 15:47:14

- reply

lnbc1u1p3lpuwrpp54vgf0pyh8lvju6n4ww5tec0frcj64jsxwwcrx99s3nu3na5h8gnsdp8g3yxgut5x34hvs6yda9yu6rn2uu553ehvfr4zvgcqzpgxqyz5vqsp5rxq2vrvg78vrjzk8hzekhcw0nmgmq59ge30u453pu8t9ujj7ss7q9qyyssqy4tfv9uxywgfdka82prw6scenkrz0levucuywe2sml7vcwadufgkl2cgkmv6wm8w6m4yevs4fzechk84h3ps5qm3fhwh8vwutspaj6sq9rz5sx

2023-02-18 15:43:49

What is in your opinion the best Nostr client?

2023-02-06 18:27:30

- reply

Hello!!!! Welcome!

2023-01-08 15:19:25

#[0] Verifying My Public Key: "Fruzto"

2023-01-06 09:59:55

#[0] @5e7ae588d7d11eac4c25906e6da807e68c6498f49a38e4692be5a089616ceb18 Verifying My Public Key: "Fruzto"

2023-01-06 09:46:19

Thanks #[0] Verifying My Public Key: "Fruzto"

2023-01-04 17:00:52