What is the risk of a Side-channel Attack on Trezor and how can it be mitigated?

In early 2022, a video was released by Ledger, a competitor to Trezor. This video discussed a Side-channel Attack that could extract the PIN from a Trezor Hardware Wallet if physical access was gained. If the PIN is obtained, it's game over. Although the video didn't specify which brand of hardware wallet was being attacked, anyone who watches the video would know that Ledger created it to highlight Trezor's vulnerabilities, as the Trezor logo is prominently displayed. More importantly, Ledger's article on Side-channel Attacks explicitly states that this attack cannot be used on Ledger devices.

What is a Side-channel Attack?

A Side-channel Attack is a relatively simple method where attackers monitor power consumption and timing in microprocessors or other microelectronic devices. By observing how these devices behave when performing specific operations, they can infer patterns from the signal characteristics to extract confidential information.

For example, by analyzing the electromagnetic radiation patterns from a computer screen or hard drive, it's possible to determine the type of information displayed. Or, in the case of a CD or DVD tray ejecting, observing the amount of power consumed for that action.

Hacking a Hardware Wallet PIN is Easier

From a hacker's perspective, they try to gather information by observing the behavior of electronic devices. The easiest target, if they can access a Trezor Hardware Wallet and have its PIN, is to gain full control. Hacking the PIN is the simplest approach and can be achieved by observing power consumption patterns. This is why Ledger used this method to attack Trezor.

As explained above, a hacker can monitor power consumption patterns, such as when entering a PIN. They can differentiate between pressing '1' and '9' by comparing the power usage. It's like in movies where thieves use a stethoscope to listen to safe locks, comparing sounds to figure out the numbers. The principle is the same.

Setting up the Trezor Hack

If you understand the method, it doesn't seem that difficult. As shown in the video, the case is opened, and equipment to measure electricity consumption is connected. On the circuit board, the microcontroller, which is the heart of the Hardware Wallet, must be located. This is the point of attack. The power consumption of the circuit board is then measured with an oscilloscope to establish a normal baseline. After that, PINs are randomly entered and the values recorded. The hacker gradually builds a database of power consumption, categorizing which inputs use less power and which use more.

In the final step, the hacker writes a script to assist with statistical calculations, allowing them to guess numbers faster. In the video, the PIN "1-3-3-7" is guessed, and boom! The Bitcoin is now the hacker's.

Trezor's Response to Side-channel Attacks

Trezor stated in their Trezor Common Security Threats that the Side-channel Attack issue has been resolved. Jochen Hoenicke was instrumental in this, addressing almost all security and non-security related aspects. He virtually rewrote Trezor's cryptographic functions. For those interested, you can read Jochen's article: Extracting the Private Key from a Trezor. The article mentions that for $70, one could buy an oscilloscope to observe signals and hack it with relative ease. This article was written in 2015, and Trezor subsequently addressed the issue in Firmware 1.3.3, following Jochen's recommendations.

Passphrase emerged to mitigate this risk

Jochen's article concludes that no protection is 100% effective if a Trezor device is physically accessed. This means if a hacker gets their hands on your Trezor, it's incredibly easy without a passphrase. If the passphrase is weak, it's also easily guessed. If you realize your device is lost or stolen, it's best to quickly restore your seed and transfer all your funds. There are many other attack methods to access critical data, such as Fault Injection, which exploits the fact that microprocessors perform certain actions when encountering unexpected events like power fluctuations or clock signal interruptions. Although difficult to execute, it's possible and cheaper than using an Electron Microscope to read the seed from a chip, or exploiting microprocessor vulnerabilities to read these values.

Ledger constantly emphasizes the Secure Element Chip

The Secure Element Chip utilizes the same technology found in credit cards, passports, and SIM cards, designed to protect highly sensitive data from malicious access. Ledger claims that their devices are designed with this chip to add an extra layer of security. Without a Secure Element Chip, hackers could easily bypass defenses and access critical information, allowing them to control everything on your Hardware Wallet.

Ledger's Contradiction with the Secure Element Chip and Ledger Recovery

Ledger launched a service called Ledger Recovery, to the bewilderment of many users who asked, "What the heck are you doing?" They claimed it was secure, so how could the Master Private Key (Seed Phrase) be extracted? Ledger responded by saying it would be split into three parts and stored separately, not by Ledger alone, ensuring security. Why should we trust others when the cost of self-trust is much lower? The crucial point is: does this mean Ledger can access this information? When can they access it? And will hackers know what Ledger knows? These are the concerns many people have, leading them to demand that Ledger open source their code. Previously, I didn't fully understand why open source was so important. It was only after hearing Professor Piriyat, a Bitcoin expert, speak about it for so long that I finally understood after this incident. The world of security requires understanding, not just trust. Open source allows us to see the developer's intentions in their code, revealing strengths and weaknesses to the public, and enabling further development.

Open Source reveals the creator's underlying thought process.

Open Source not only allows us to see the code but also helps us understand the fundamental thinking of the creators. This includes understanding their intentions behind specific code implementations and the sincerity demonstrated by their willingness to open-source. A good example is Jochen's article on Side-channel Attacks. Jochen is not a Trezor employee or a competitor; he has the freedom to point out Trezor's weaknesses simply because he owns two Trezor One devices. Open source signifies that the creator knows that being transparent and allowing others to help find vulnerabilities is the best way to achieve the highest level of security, rather than hiding flaws from everyone.

Conclusion

Regarding the content of this article, I still believe that having a Hardware Wallet is a very secure method in the world of Bitcoin and Cryptocurrency. However, we should understand the limitations of each tool and figure out how to mitigate those risks. Regardless of which device you use, if you understand its limitations, you can find ways to reduce the risks. In the case of Side-channel Attacks, a hacker must have physical access to your Hardware Wallet. If they cannot access it, this technique cannot be used.

Currently, Trezor has released its latest Hardware Wallet, the Trezor Safe 3, which comes with a Secure Element Chip, further enhancing Trezor's security. There is also another model equivalent to the Trezor Safe 3, called the OneKey Mini. Their specifications are identical; neither has a battery or Bluetooth like its big brother, the OneKey Classic. Comparing the specs, the OneKey Mini is comparable to the Trezor Safe 3 (if you want to use it with a mobile phone, you need the OneKey Classic). OneKey has further developed Trezor's code. I am an official distributor for OneKey, so if you're interested, you can check out the products in my store.

Finally, I want everyone to always remember that we cannot eliminate all risks; we can only reduce them to the lowest possible level.

Ref:
https://seguranca-informatica.pt/what-is-a-side-channel-attack/
https://www.ledger.com/academy/series/enter-the-donjon/episode-2-side-channel-attacks
https://trezor.io/learn/a/common-security-threats
https://jochen-hoenicke.de/crypto/trezor-power-analysis/