The problem is that an attacker who compromises a machine that has access to the HSM will have the privilege to drain the wallet. Unless there is some rate limit or some higher access control the attacker will be able to initiate a bunch of BTC transactions that will dump the wallet. Also if they are intelligent about it they will batch the signatures and release them to the network in one hit.
If Amazon is a bad actor they trivially have access to the HSM because they could just write some software that pretends to be the HSM. However, this is probably not in the threat model because the amount Amazon loses by fucking a client like this is much more than the amount they would gain by fucking a client. The real thread is rogue Amazon employees and I guess it would be be hard for them to MITM the HSM from the start.
Your only protection for the hot wallet is to obscure the credentials you use to connect to HSM. Good luck with that against and a determined adversary that has a lot to gain from dumping the HSM key. (if it is not clear this 'only protection' thing is when the adversary has root access to your machine)
Oh.. and if you are a gemini dev. Obscure your code encrypt your HSM credentials in memory. :) Security through obscurity is actually a useful thing against attackers.
I don't know enough about the SafeNet HSMs to elaborate on that, but they claim:
> This manufacturer-validated devicee identification mechanism enables a strong trust model whereby customers can be assured that they are communicating with specific SafeNet hardware units in a way that cannot be spoofed.
If Amazon is a bad actor they trivially have access to the HSM because they could just write some software that pretends to be the HSM. However, this is probably not in the threat model because the amount Amazon loses by fucking a client like this is much more than the amount they would gain by fucking a client. The real thread is rogue Amazon employees and I guess it would be be hard for them to MITM the HSM from the start.
Your only protection for the hot wallet is to obscure the credentials you use to connect to HSM. Good luck with that against and a determined adversary that has a lot to gain from dumping the HSM key. (if it is not clear this 'only protection' thing is when the adversary has root access to your machine)
Oh.. and if you are a gemini dev. Obscure your code encrypt your HSM credentials in memory. :) Security through obscurity is actually a useful thing against attackers.