When there are millions of dollars to be stolen, someone can figure out how to remove the potting.
If need be, just grind and cut till you are back to the one silicon wafer that contains crypto keys, then rebuild the whole lot from scratch, add your evil parts, then re-pot it.
That would work on an already configured wallet that you stole but the skill level required is orders of magnitude higher than what's on display here. I know all of the theory on that one but I would probably not be able to pull that off.
The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip. You'd have definitely been able to spot the difference. This was at the millimeter level. Recently there was a post about a group doing this at the chip level, which I thought was extremely impressive, and again, even with the recipe out there duplicating it would still be very hard.
> The best I've done is to modify a potted chip by very careful thermal imaging to figure out where the part was that blocked the feature I wanted to unlock (market segmentation) and then drill through the case to a depth just higher than the chip.
Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.
With hardware wallets (aka substantial incentive), then the attackers could order a bunch of them for sacrificial zero-ing in the exact places to drill with a CNC/microscope/etc.
> Sounds like a good approach when you only have a single (or just a few) of the devices so you need to be careful.
Yes, initially I had just the one. But once I had it figured out there were lots of other people that wanted their device 'improved' so that jig got used plenty of times. Even so working on other people's hardware always felt very scary, especially poking around with a drill in a sensitive piece of hardware. Even so, they all worked, it was a neat little trick.
No, this was a couple of decades ago, I didn't have a blog back then and I have zero evidence. But I can tell you some of the details: the device was a Philips 'Marc' CB transceiver. They made only one model both for the US and the EU market so there were 22 channels available in the EU and 40 iirc in the United States. But the rotary channel selector did have all 40 positions. That made me wonder... what if? So I opened the device and there was this very large plastic blob in the middle of the circuit board with obviously a large (40 pin iirc) chip underneath it. I realized that if I tried to physically remove the blob that I would most likely break the chip so that wasn't going to work.
But it was clear what it did: as soon as the channel selector went to a forbidden channel the blob sprung into action to disable the chip underneath. I measured the effect on the pins underneath that were accessible from the other side of the board and noticed that a whole bunch of them got shorted to ground. That was the hint I needed. A friend ran a laser game company and they had a nice little IR camera with built in display, that was used for calibration of the IR beam collimators in the laser guns (the laser doesn't actually do any of the shooting, the thing is basically just a very powerful remote control with a lens that sends out a relatively narrow beam). I set it up above the the blob and set the channel selector to a good channel and let it warm up. Had a look with the camera. Then set the channel selector to a bad channel, let it warm up again and had another look with the camera. The difference was pretty obvious, there was a hotspot right in the middle of the blob. I marked the spot and made a drill jig, then it took me a few days to gather courage and stick the drill in, it worked on the first try. That gave 18 nearly empty channels to play with. Once I had it figured out the second one was a lot easier :)
This story is a case of someone tampering with devices in the supply chain, before the user first receives them.
What you’re describing is a different thing. It’s an “evil maid” attack, when you tamper with a wallet that is already set up by the user. Also, it would be ultra difficult and expensive.
What you’re saying is possible. But:
It would probably be cheaper to build a total fake Ledger Wallet, then just replace the new real wallet and deliver a fake with a weak entropy generator. Any case, that’s not what has happened this time.
Thanks. I believe you’re right a totally fake copy couldn’t verify. So that idea was wrong.
(The MITM supply chain attack which has happened succeeds because it preserves the original secure hardware but intercepts the secret data at the display interface. But a low-effort mimic of the entire device like I suggested? That wouldn’t work).
Ledger provides a 'Genuine Check' mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device's original Secure Element remains intact.
And as this workaround leaves the original Secure Element intact, good luck detecting the supply chain attack.
But it's specifically a potting epoxy designed to cause damage to the electronics if removed. And any destruction of the epoxy has to not significantly affect the outward appearance of the device. At worst it's defense-in-depth.
It's stupidly easy to open the device. I opened mine last night with a knife and a hairdryer. I left no perceptible marks either. I watched a few videos where the device was opened without a hairdryer. Apparently, those who did the implant put more glue than Ledger itself.
This could well be to help prevent sms pumping — where someone makes money by receiving smss to a particular set of numbers. Requiring the user to first send an sms breaks the economics that type of fraud.
I do like watching these comparisons however it reminds me of a conversation I had recently with my 10 year old.
Son: Why does the croissant cost €2.80 here while it's only €0.45 in Lidl? Who would buy that?
Me: You're not paying for the croissant, you're paying for the staff to give it to you, for the warm café, for the tables to be cleaned and for the seat to sit on.
So for enough people the price is not an issue. Someone else is paying.
On other side. People are pretty bad at this sort of cost analysis. I fall on this issue, prefer to spend more time myself on something I should just recommend to buy.
Exactly. The whole promise behind cloud was "you don't need an ops team". Now go check for yourself if that's true: go to your favorite jobs portal and search for AWS, or to include Azure and Github sysadmins search for "devops engineer". And for laughs search for "IAM engineer", which is a job only about managing permissions for users (not deciding about permissions, JUST managing them and fixing problems, nothing more. And frankly, the cloud is to blame: figuring out correct permissions now requires teams of PhDs to do correctly on infuriating web interfaces. I used to think Active Directory permissions were bad. I was wrong. The job portals show: no corporate department should ever go without a team of IAM engineers who are totally not really sysadmins)
What do you get for this? A redundant database without support (because while AWS support really tries so hard to help that I feel bad saying this, they don't get time to debug stuff, and redundant databases are complicated whether or not you use the cloud). You also get S3 distributed storage, and serverless (which is kind of CGI, except using docker and AWS markups to make one of most efficient stateless ways to run code on the web really expensive). Btw: for all of these better open source versions are available as a helm chart, with effectively the same amount of support.
You can use vercel to get out from under this, but that only works for small companies' "I need a small website" needs. It cannot do the integration that any even medium sized company requires.
Oh, and you get Amazon TLA, which is another brilliant amazon invention: during the time it takes you to write a devops script Amazon TLA comes up with another three-letter AWS service that you now have to use, because one of the devs wants it on his resume, is 2x as expensive as anything else, doesn't solve any problem and you now have to learn. It's all about using AI for maximizing uselessness.
And you'll do all this on Amazon's patented 1994-styled webpages because even claude code doesn't understand the AWS CLI. And the GCP and Azure ones are somehow worse (their websites look a lot nicer though, I'll readily admit that. But they're not significantly more functional)
Conclusion: while cloud has changed the job of sysadmin somewhat, there is no real difference, other than a massive price increase. Cloud is now so expensive that, for a single month's cloud services, you can buy hardware and put it on your desk. As the youtube points out, even an 8GB M1 mac mini, even a chinese mini-pc with AMD, runs docker far better than the (now reduced to 2GB memory) standard cloud images.
More often than not, I’d rather avoid the self-focused staff who rarely give it to you with hygiene in mind and at this time of the year in the northern hemisphere are likely to be sick, the mediocre coffee (price surge in coffee beans), and the dirty tables at a café, and the uncomfortable seating. And it’s rather 5€ for the croissant alone, in many places these days. Lidl’s croissants aren’t very good but they’re only marginally less good than what you can hope for at a café. McDonald’s croissants in Italy are quite ok by the way.
Me too, but it's worth remembering that's not the case for everyone. Some people want to have a little chat with the person at the counter, sit down for 5 mins in the corner of the cafe and eat their croissant. 5 euro can be a good price if that's what you want, and it doesn't matter if the lidl croissant is free, it will still be disappointing to the person who wants the extras.
Absolutely. I believe what I wanted to convey is that there are trade-offs in every decision that you can make. Maybe that’s even the point of a decision in the first place.
This in turn means that you always have several options, and more importantly you can invent a new way to enjoy the experience you hope to get from that interaction at a café in your mind, maybe a scene from your past or from a movie, which you’re no longer as likely to experience on average.
That said, I’ve got a favorite café where I used to spend time frequently. But their service deteriorated. And the magic is gone. So I moved on with my expectations.
Back to the analogy with the hyperscalers. I had bad experience with Azure and GCP, I’ve experienced the trade-offs of DigitalOcean and Linode and Hetzner, and of running on-premises clusters. It turned out, I’m the most comfortable with the trade-offs that AWS imposes.
Exactly. AWS has its own quirks and frustrations, sure but at the end of the day, I’m not using AWS just for raw compute. I’m paying for the entire ecosystem around it: security and access management, S3, Lambda, networking, monitoring, reliability guarantees, and a hundred little things that quietly keep the lights on.
People can have different opinions on this, of course, but personally, if I have a choice, I'd rather not be juggling both product development and the infrastructure headaches that come with running everything myself. That trade-off isn’t worth it for me.
[edit: I retract my comment that it's bad advice to not cancel holidays to work hard. I misread the comment that I replied to -- I had thought the commenter was saying don't work extra hard in your role as it's never worth it. That's not what the commenter said though. In my experience, people who produce more value in the world are more valuable and get rewarded more than those who don't.]
I think this is poor and dangerous advice for anyone who wants to get ahead in life. If you are happy to coast by and not achieve much in life, sure, don’t work hard. But if you want to be one of the few who either rise to the top in your field or to create value in the world, then don’t feel bad about wanting to work hard. People generally learn by doing and those who do a lot learn a lot.
Of course, don’t prioritize it over things that are important to you (physical health, family etc) but don’t feel it’s wrong to prioritize it above stuff isn’t important to you (eg Netflix and YouTube shorts).
I think the difference between someone who "gets ahead in life" and someone who doesn't usually isn't the number of hours spent in the office. Usually its more related to how well you make decisions in your career, and the relationships you build along the way.
Go to therapy. Learn about yourself. Work on your communication skills. Figure out what matters to you and invest in it. (For most people, family and friends are high on that list).
By all means work hard, but be strategic about it. Martyring yourself for your company won't make people respect you.
Agreed but there is a big energetic difference between a future ceo personality working long hours vs a supporting staffer who is just sacrificing themselves inefficiently thinking someone will care. People care about results and the appearance of some effort. Long hours are a basic requirement but healthy emotional boundaries are what get someone to the top.
There's several game studios out there whose last two tweets were "we've just won an industry award for our game!" / "our studio is being shut down immediately".
It's worthwhile working for yourself if you do think you're learning, but in today's corporate environment loyalty is just showing your willingness to be exploited.
What do you mean by "getting ahead in life"? That you pass more time doing stuff at work so you are closer to your death without having done the things you like, spent time with the people you love and visiting the places that fill you with joy? Or do you mean money? I am pretty sure if you are good at your job and you are not in a dying profession there will be enough places that show you the respect you would extend to them.
Shilling for work place abuse and unpaid overtime isn't getting you ahead in life the same way begging for forgivness with an abuser will make your life better.
If your corp can't manage people's time realistically, why would you expect them to manage anything realistically? Get out and go to a real place that knows how to run projects.
Don’t ruin your health for someone else. People who throw themselves on this fire in BigCo don’t get recognition or reward, they get abused by the political animals that will take advantage.
Work hard for yourself to build your own. But don’t think for one moment that death marches will result in a swift rise to the top.
Nothing wrong with working hard, but make sure you get something about of it.
If you’re being asked to cancel a holiday because some clown can’t get anything done without setting realistic timelines, don’t do it.
But if you take a job where your boss says “we need to get this done by this date and we need people who are willing to get it done even if that means sacrificing work-life balance” and you get paid like you should for a job like that, then do it.
I've been the person working stupidly long hours for many years. Eventually I stopped doing it, and I started to set boundaries around my downtime, and I found out something really valuable: Nobody noticed a difference in my productivity. I was doing far less, but nobody noticed. They all assumed I was still as busy, and doing as much, and it's because the things we all do to be super busy and productive ARN'T productive. You might ship some things faster, but the quality suffers, changes are harder to make later and everyone's tired all the time.
So no, "working hard" won't get you ahead. The people who really get that far ahead in life are the ones networking and learning the political games, not really working. And why do you need to "get ahead" to be successful? I'm ambitious, and I love growing in my career. I'm not someone who is happy with the bog standard things, but I've also learned that when all you value is being ahead of your peers, you miss out on more than you gain. And on top of it, you all end up in similar roles anyway.
One can work hard and still not cancel holidays for work. Plenty of people work through holidays and don't "achieve much in life". I've known many people in higher positions who use all of their time off.
> one of the few who either rise to the top in your field or to create value in the world
"rising to the top" is pure ego-inflation
"create value in the world" -- you'd better make sure that you're creating value for the world in something that's important and meaningful to you, not just "create value for shareholders" (who don't give a f about you) which is what "creating value" means 90% of the time if you're in industry
Achieving a lot in life is not necessary about working hard. Its more about working smart or having a bit of luck. None of the successful (money wise) people arround me worked really hard. The working hard sentence is really nonsense.
I don't think it's nonsense but it's incomplete. A lot of people work really hard and achieve nothing notable. A lot of people sort of phone it in and do alright just by shrewd positioning (or luck). There is no substitute for combining both though: work smart and hard.
The trick is to make sure you're always investing in yourself. Even when you're working for others you be either "learning or earning", ideally both.
>I think this is poor and dangerous advice for anyone who wants to get ahead in life.
Oh yeah, every new-comer to the tech world thinks like this, and 99.99% of them don't get any further "ahead" in life than the rest of us. In fact, many end up further behind.
Unicorn tech founder here.
Google — if you are reading, it’s stories like this and examples where you c.10x the price of products overnight like Google Maps that I would never let our team use GCP. Your reputation is losing you business here.
Thanks arnon.
This makes lots of sense for software. Did you change SKUs based on changing pricing for hardware? If so, did this confuse or annoy 3rd party logistics providers who were asked to change labelling on boxes and have different SKUs for the same product?
