Pinned
Donjon is the Security Research team at @Ledger. Follow us to get the the latest news from our research.
More info on our blog: ledger-donjon.github.io
Ledger Donjon
187 posts
Ledger Donjon
@DonjonLedger
The security research at Ledger.
- All the passwords generated by Kaspersky Password Manager were predictable (CVE-2020-27020)! Here is why. donjon.ledger.com/kaspersky-pass…
- Coinkite presented the results on their blog blog.coinkite.com/donjon-faults-… To give a precision, the seed can be practically extracted if an attacker combines our two attacks in SE2, SE1, and the MCU. You can find the two attacks: fdtc.deib.polimi.it/FDTC23/slides/… fdtc.deib.polimi.it/FDTC22/slides/…
- Our laser attack to extract all secrets from a Coldcard Mk2 hardware wallet. Details of the attack will be presented at the @SSTIC security conference on June 3 (100% online this year), stay tuned! donjon.ledger.com/coldcard-pin-c…
- Extracting Private Keys from Ellipal Wallet. ledger-donjon.github.io/Ellipal-Securi… Ellipal is a hardware wallet based on air-gapped Android device. Our study also showed that communication interfaces could be re-enabled
- Slides of our @BlackHatEvents talk "Black-Box Laser Fault Injection on a Secure Memory" are now available! Disclaimer: images of a chip attacked by laser shots inside. i.blackhat.com/USA-20/Thursda…
- Ghostbuster is the sole challenge of the Donjon CTF which remained unsolved, but not unexplained. The exploit and the writeup are now public: donjon.ledger.com/ghostbuster. Lesson learned: CPUs are tricky! 👻 #spectre
- We recently designed a new PIN-entry interface for our Ledger Nano X and S Plus. This new interface offers a strong security improvement against advanced targeted hardware spying attacks. Discover the rationales behind this design on
- Breaking white-box implementations of public key cryptographic algorithms is rarely difficult. In this article, we explain how to break them automatically, with a full black-box approach. Open source tool is also provided.
- Last week, we presented our research on Intel Wi-Fi chips at @sstic. Our talk and our slides are now available: sstic.org/2022/presentat…. It features a demo of a DMA attack from the Wi-Fi chip! We also published our tools to interact with some Intel chips: github.com/Ledger-Donjon/…
- Ledger Donjon CTF is back! Cryptography, hardware security, exploitation, reverse engineering, embedded security, side channel attacks... Show your skills and win a limited edition of Ledger Nano X and cryptocurrencies! CTF starts on Nov 30. Register now: donjon-ctf.io
- Dear Twitterverse, does anyone know of a security contact from @booba's crew? We found a vulnerability in BOOBA TN NFTs but our DMs remain unanswered. We would prefer to avoid full disclosure if possible. (Please RT for visibility)
- Double fun with double fault attacks! Today at #BHUSA, Olivier Hériveaux will show how to defeat a secure element (ATECC608A) using multiple laser fault injections. blackhat.com/us-21/briefing…
- Olivier’s talk on Triple Exploit Chain With Laser Fault Injection on the ATECC608B is available! Check it out: youtube.com/watch?v=Hd_K2y… #hw_ioNL2023 @hardwear_io
