OneKey reproduces transaction replacement attack on outdated Ledger Ethereum app

OneKey's in-house security team managed to successfully reproduce an exploit targeting a specific version of Ledger’s on-device Ethereum application in a test environment. The wallet provider's founder and CEO, Yishi Wang, detailed their successful execution of a "transaction replacement attack" against Ledger Ethereum app 1.22.1.

The attack took advantage of a vulnerability that had previously been patched, allowing attackers to overwrite transactions that were still waiting to be signed by the user. Ledger, the French hardware wallet manufacturer, confirmed that the vulnerability required control over the communications between the device and its host. This could potentially be achieved through malware, compromised wallet software, or a hostile webpage.

Ledger addressed this issue by releasing app-level safeguards with the Ethereum app 1.22.2 on August 13, followed by a fix for the underlying issue in Secure SDK 26.6.1 on August 21. The company emphasized that no Ledger user was hacked as a result of this vulnerability, noting that they were simply reproducing it in their lab environment.

This security test comes after a similar exploit in July, when attackers took advantage of a firmware bug in some Coldcard wallets, weakening seed randomness and making private keys vulnerable to brute-force attacks. Ledger had previously stated that its devices were not affected by this vulnerability due to the use of a certified source of randomness built into the device's security chip.

The vulnerability revealed by OneKey is distinct from seed generation and instead impacts how transactions are handled during the signing process.