| KEY TAKEAWAYS: |
| — The screen of the device you use for crypto transactions is a potential attack vector. — Screens rely on the security of the computer chip that controls them, and not all chips or devices are built with security in mind. —Ledger devices use a secure screen that connects directly to the Secure Element chip, meaning that what you see is what you sign. |
Blockchain transactions, once processed, are immutable and irreversible. If you want to sign a transaction, you want to know the outcome before you steam ahead. If you make a mistake, your funds could be gone forever. While some lost funds can be attributed to copying down addresses carelessly or inputting incorrect information, they are often the result of hacking.
A common attack vector is the screen of your device. Without a secure screen, a malicious transaction wouldn’t look nefarious at all. That’s because screens we use for everyday work, study, and entertainment aren’t designed for security, they are built for performance. And when it comes to protecting and managing digital assets, these devices fall short.
Simply, you can’t trust the screen on your laptop or smartphone. But how can we mitigate this risk?
The answer lies in a secure screen that guarantees the legitimacy of the information it shows. That’s exactly why Ledger devices have a secure screen driven directly by the Secure Element chip. It’s designed with security in mind, ensuring that what you see is what you sign.
But what is a secure screen and why is it so important? Let’s dive in.
The Screen of Your Laptop or Smartphone Can’t Be Trusted
Behind every screen is a chip. That chip is responsible for the information the screen shows. For your laptop or smartphone to work, the screen must be able to access information from the chip. The type of chip it uses and how it communicates with the screen is integral to the security of any device.
The problem arises with trusting the details of a transaction on a device connected to the internet. When you use a crypto wallet on your laptop or smartphone, you rely solely on the security of that device. Since they typically connect to the internet they are vulnerable to online threats.
Once exploited, hackers can change details on the screen of an infected device—even remotely. For example, if you were trying to initiate a crypto transaction on your laptop, a hacker could change transaction details on its screen, such as the recipient address or the total number of assets you want to send. Essentially, you can’t sign any transaction on an internet-connected device without risking your assets.
This is exactly why hardware wallets exist: they keep your private keys stored in a chip isolated from the internet-connected device and any potential malware it hosts. By storing your private keys in a chip in a separate device that doesn’t connect to the internet, they are immune to online threats.
Some Hardware Wallet Screens Are More Secure Than Others
At this point, you might think that using any hardware wallet is enough. After all, the chip that controls the screen is completely separate from the internet-connected device initiating the transaction. That must be safe, right?
Unfortunately, it’s not as simple as it seems. Any screen is a potential attack vector, and not all hardware wallets have the same level of security. It’s not just about keeping the chip containing private keys separate from internet connectivity, you also have to ensure that all of the device’s components are protected from physical hacks.
Typically, hardware wallets use MCU chips to control their screens, and this is where the issue lies. It’s reasonably easy and inexpensive for a hacker to replace the firmware of an MCU chip. If a hacker gains access to the MCU that controls your hardware wallet’s screen, they wouldn’t need to gain access to your private keys. Simply with access to your screen, a hacker can tamper with the details of a transaction to trick you into signing away your assets.
To mitigate this risk, some hardware wallet providers have opted to remove the feature of a screen entirely. But without a screen, how can you know a transaction is legitimate? The answer is, you can’t.
Luckily, the Ledger security model offers a different and more practical answer: a secure screen. But how does this work exactly?
Understanding Ledger’s Secure Screen
The security of a Ledger device’s secure screen starts with its internal components. Ledger devices store private keys on a Secure Element chip, an industry-leading computer chip often used in bank cards and passports since it can withstand common attack vectors like side-channel attacks and glitching.
Today, several hardware wallet providers use a Secure Element to generate and store private keys, but they typically drive their screens with MCU chips, which are vulnerable to physical hacking. Ledger devices are unique for using the Secure Element to drive their secure screens. Since the Secure Element chip drives the secure screen directly, no hacker can intercept this information or tamper with the transaction details it shows.
The screen benefits from the Secure Element’s ability to withstand attacks, meaning “what you see is what you sign”. If the details on the screen of your Ledger device match what you see in Ledger Live, you can sign with confidence. This allows you to double-check the accuracy of your internet-connected device too. If the details on your Ledger device don’t match those on your internet-connected device, your laptop or smartphone is likely infected with malware.
Finally, driving a screen with the Secure Element also introduces the ability to carry out cryptographic attestations; allowing you to verify your Ledger device is running the genuine BOLOS operating system. These are just a few ways a secure screen makes interacting with the blockchain more secure and intuitive.
What Does The Secure Screen Protect Me From
So now you know why having a secure screen is important, but what about the work it’s doing? Let’s dive into some of the most common attacks the screen of your device may face and how Ledger’s secure screen approaches them.
Address Poisoning
Ledger’s secure screen protects you from address poisoning. To explain, address poisoning is when an attacker sends you a small amount of crypto to appear in your transaction history. The transaction is designed to look like you initiated it, for example, the attacker will use an address with only a few characters different from your own. The scammer simply hopes you mistakenly copy their address from your transaction history, confusing their address for one you are familiar with.
This incredibly common scam catches out even the most experienced crypto users. However, with Ledger’s secure screen, you don’t have to worry about address poisoning: you can see the full details of a transaction, including the entire wallet address directly on your Ledger device.
Address Switcher Malware
Another way scammers may attack your screen is through address switcher malware. With this scam, the attacker takes control of your computer or smartphone’s clipboard. With access to your clipboard, a hacker can use your own transactions against you.
For example, say you were trying to send funds to a friend, when initiating the transaction, the scammer copies their address onto your clipboard. When you sign the transaction, the funds end up in the hacker’s account instead of your friend’s. They can also replicate this attack when you plan to receive funds from a friend. The attacker replaces your address with their own, and when you share the address with your friend, the funds end up in the hacker’s account.
Ledger’s secure screen is controlled by a Secure Element chip, completely separate from your internet-connected device. Your Ledger device’s secure screen will always show the correct transaction details, even if your internet-connected device is compromised.
Clickjacking Malware
Finally, hackers will attempt to trick you into revealing potentially sensitive information or unknowingly consent to malicious actions via clickjacking. This attack uses your clicks against you, modifying your device’s screen to convince you to hand over your login credentials, download more malware, or sign malicious transactions or smart contract approvals.
In these cases, a bad actor may take control of your screen to convince you to sign away your assets. All they need to do is make the approval look legitimate, i.e. from a familiar app you use, and your assets are theirs.
Ledger’s secure screen cannot be targeted with clickjacking malware, as the Secure Element is tamper-proof and drives the secure screen directly.
All you need to do to protect yourself is double-check that the receiving address on your Ledger device’s secure screen matches the one on your internet-connected device before signing any transaction. Your Ledger device will handle the rest!
A Secure Screen: Just One Piece of Ledger’s Security Model
In conclusion, it’s clear that a secure screen is one of the most important aspects of managing crypto transactions. Without a secure screen, you don’t know what you’re signing. Remember, using a screen with vulnerabilities to send transactions could end in losing your funds. In the very worst-case scenario, you could lose everything by sending your assets to a spoofed address.
No matter how big or small your portfolio is, understanding the results of signing a transaction is paramount. But a secure screen is just one piece of Ledger’s security model. So don’t stop here! Check out the full article on Ledger’s Security model to learn more about the different aspects of the Ledger ecosystem keeping you, your assets, and your devices safe.
