Quote from: dkbit98 on January 26, 2022, 04:51:57 PM

Quote from: n0nce on January 25, 2022, 09:34:53 PM

It's worth noting this Trezor model is one of the few wallets which has no dedicated secure element.

Yeah, this is the last days of hardware wallets without secure elements, or maybe not.

To be completely honest, I'd say: it depends. If you trust your ability to keep the device mostly safe and the bigger risk for you is a backdoor in the secure element (also circumstantial: potential of bad actors, legality of BTC in your home country, ...) - then an open source device without such closed element would be beneficial.
On the other hand, if you need to bring your wallet into insecure places like shared offices or something and there is a risk of an 'evil maid' attack, and a comparatively lower risk of backdoors or flaws in the secure element, then this solution is for you.

I'd even go as far as saying that you may actually want to have both types for two very different, very specific applications. Cold storage = no S.E., daily driver = with S.E.? Just a thought.

Quote from: dkbit98 on January 26, 2022, 04:51:57 PM

Bonus task, try to find Kingin in this image (click to enlarge)

Easy, third one. Grin

Quote from: dkbit98 on January 26, 2022, 04:51:57 PM

Quote from: PX-Z on January 26, 2022, 01:46:25 AM

I wonder if he get bounty bug reward from trezor considering this is a great find. I see their bounty bug page ^[1] but seems still outdated https://trezor.io/security/

He was certainly paid by the guy who hired him for this job, and it's possible that Trezor compensated him related with this flaw.
All this happened several months ago and Trezor was well aware of this problem and fixed it right away.

Wasn't the issue even fixed already, but possible due to outdated firmware? Like at the time of attack, he mentions about firmware v1.6.0 and that the attack wasn't gonna be possible in v1.6.1 etc., so he was exploiting the fact that the device was running old software in a way.

Quote from: dkbit98 on January 26, 2022, 04:51:57 PM

Quote from: SFR10 on January 26, 2022, 10:53:38 AM

It appears that in addition to the pin, he hacked the seed phrases as well ^{[blurred part]}.

I guess once you have the PIN, you will have the full access to everything including seed words, but this was the case before fix was applied in firmware.

To me it sounded like the PIN and seed were both loaded into RAM at boot, which is also shown in the video where he reads out the RAM to the host machine, then just performs strings. Therefore, he's not using the PIN to retrieve the seed (as you're describing).