Security researchers have uncovered a critical vulnerability in Bitcoin hardware wallets, dubbed “Dark Skippy,” which enables hackers to extract private keys with unprecedented ease. Unlike previous methods that required numerous transactions, this new flaw allows extraction using only two signed transactions.
The findings were outlined in a report released on August 5 by experts Lloyd Fournier, Nick Farrow, and Robin Linus.
The “Dark Skippy” attack exploits a security weakness by tricking users into installing compromised firmware on their hardware wallets. This malicious firmware embeds fragments of the user’s seed words into “low entropy secret nonces” within transaction signatures. Once these signatures are recorded on the blockchain, attackers can use Pollard’s Kangaroo Algorithm to decode the seed words by analyzing the public signatures.
This vulnerability impacts all models of hardware wallets, contingent on the victim installing the malicious firmware. Unlike prior methods that necessitated multiple blockchain transactions, “Dark Skippy” achieves its goals with just two, even if the seed words originate from a separate device.
To address this threat, the researchers advocate for enhanced security measures from hardware wallet manufacturers, including improved secure boot mechanisms and rigorous firmware validation processes. Users are also advised to take extra precautions to safeguard their devices, though implementing some of these recommendations may be challenging.
Related topics:
Bitcoin’s Permanent Holders Accumulate $23 Billion in a Single Month
RippleX Announces XRPL Testnet Reset for Aug 19 to Boost Performance and Security
Bitcoin Whales Accumulate 84,000 BTC in July 2024: A Decade-High Surge
