Quote from: Pmalek on February 05, 2025, 04:39:03 PM

Quote from: Lucius on February 05, 2025, 12:04:49 PM

Anyone storing tens or hundreds of BTC using FP should know that there is a serious vulnerability in the chip that is apparently found in an unspecified number of manufactured devices.

If we classified this vulnerability as a serious one, what would we then call it if a chip was vulnerable to remote attacks and if the wallet could be accessed via the internet and tricked into signing transactions without physical confirmation? That's a much more serious case. The problem with the 608A chip model should be a medium vulnerability at best.
~snip~

This should then be called a complete fail and everyone who uses that wallet should be advised not to use it anymore. The people who researched that chip called it a critical vulnerability (I refer to the link in one of my previous posts).

Quote

seems like a critical vulnerability to me:
"In 2020, we evaluated the Microchip ATECC508A Secure Memory circuit. We identified a vulnerability allowing an attacker to read a secret data slot using single Laser Fault Injection. Subsequently, the product life cycle of this chip turned to be deprecated, and the circuit has been superseded by the ATECC 608A, supposedly more secure. We present a new attack allowing retrieval of the same data slot secret for this new chip, using a double Laser Fault Injection to bypass two security tests during a single command execution. A particular hardware wallet is vulnerable to this attack, as it allows stealing the secret seed protected by the Secure Element. This work was conducted in a black box approach. We explain the attack path identification process, using help from power trace analysis and up to 4 faults in a single command, during an intermediate testing campaign. We construct a firmware implementation hypothesis based on our results to explain how the security and one double-check counter-measure are bypassed."
https://www.sstic.org/media/SSTIC2021/SSTIC-actes/defeating_a_secure_element_with_multiple_laser_fau/SSTIC2021-Article-defeating_a_secure_element_with_multiple_laser_fault_injections-heriveaux.pdf

Far from me thinking this is a bad wallet (quite the opposite), I just think everyone has the right to know that their device can be hacked in the wrong hands.

For those who are from the EU, info that I noticed that FP has become cheaper and now it costs a little less than EUR 210 at some resellers.