Reverse Engineering a Ledger Nano X Hardware Implant

Reverse Engineering a Ledger Nano X Hardware Implant

Speakers: Joe Grand, Principal Engineer, Grand Idea Studio

Conference: Hardwear.io USA

YouTube: https://www.youtube.com/watch?v=WNpW52x-EWY

Overview

This talk, delivered by renowned hardware hacker Joe Grand, delves into the fascinating and concerning discovery of a sophisticated hardware implant embedded within a legitimate Ledger Nano X cryptocurrency wallet. Grand recounts the intricate process of reverse engineering this clandestine modification, revealing a multi-component system designed for covertly exfiltrating users' recovery seeds. The presentation highlights a real-world supply chain attack where authentic devices are purchased, tampered with, repackaged, and resold to unsuspecting consumers.

The significance of this discovery cannot be overstated. While theoretical discussions of hardware espionage are common, finding a fully functional, commercially deployed implant targeting consumer-grade security devices is rare. Grand's meticulous breakdown of the implant's architecture and operational mechanism serves as a critical case study for understanding advanced persistent threats in the hardware domain. It underscores the vulnerabilities inherent in trusting physical products, even from reputable manufacturers, once they leave controlled distribution channels.

This talk is particularly relevant to anyone involved in cybersecurity, hardware design, supply chain management, and, crucially, users of cryptocurrency wallets. It provides actionable insights into the methods adversaries employ to bypass software-based security, demonstrating that the physical integrity of a device is as paramount as its cryptographic strength. Grand's journey from initial discovery to uncovering the implant's cellular communication capabilities offers a compelling narrative of forensic hardware analysis.

Background

▶ Watch: User innocently discovers Ledger Nano X implant (2:20)

Joe Grand's journey into hardware security and cryptocurrency recovery began approximately five years prior to this talk, when he successfully recovered $2 million from a Trezor 1 hardware wallet using fault injection techniques against its STM32F2 microcontroller. This high-profile recovery, filmed live and widely publicized, established Grand as a go-to expert in the nascent field of hardware-based crypto asset recovery. However, the project discussed in this talk presented a different challenge: not recovering funds from a compromised wallet, but rather understanding how a wallet had been compromised in the wild.

The specific incident that triggered this investigation involved a user in Thailand who purchased a suspiciously cheap Ledger Nano X from Lazada, an online marketplace, with the sole intention of using its battery as a replacement. Upon opening the device, the user noticed the battery was smaller and, more alarmingly, discovered additional wires connected to a small green circuit board – an obvious deviation from a legitimate Ledger Nano X. After encountering skepticism on Reddit and disinterest from local police, the user contacted Grand, recognizing his expertise in cryptocurrency hardware. This marked the beginning of a unique hardware espionage investigation.

Grand prefaced his technical deep dive with a discussion on the broader landscape of hardware espionage. He emphasized that trust in hardware is often misplaced, as vulnerabilities can exist at every stage of a product's lifecycle, from chip design to distribution. While academic research often focuses on malicious functionality embedded during manufacturing, this case highlights a supply chain attack involving the modification of legitimate, off-the-shelf products after they have been manufactured and then resold. This is distinct from counterfeit devices; these are authentic products that have been secretly altered. Previous examples of hardware espionage in the cryptocurrency space include:

• Trezor 1 and Trezor Model T firmware attacks: Devices sold on Russian marketplaces contained modified firmware that generated pre-generated recovery seeds, allowing attackers to drain funds once users deposited cryptocurrency. These involved replacing the original microcontroller with a new chip containing malicious firmware, often with surprisingly clean soldering. Despite tamper-evident ultrasonic welding on the Model T, many users failed to notice the signs of compromise.
• Ledger's 2020 database breach follow-up: After a customer database leak, some Ledger users received unsolicited packages containing a seemingly new Ledger Nano X and a letter purportedly from the CEO. This device was a hardware-based phishing attack, featuring an additional USB thumb drive that, when plugged in, prompted the user to run an executable and enter their recovery seed, which was then exfiltrated to the attackers. This demonstrated a significant effort by adversaries to target specific individuals through physical means.

These prior incidents set the stage for the Ledger Nano X implant, showcasing a continued evolution in sophistication and a clear motivation for adversaries to target the physical integrity of cryptocurrency hardware wallets.

Key Findings

▶ Watch: Implant revealed as cellular 4G LTE module (29:30)

The investigation into the compromised Ledger Nano X yielded several critical findings that collectively painted a clear picture of a highly sophisticated and targeted hardware implant:

1. Physical Discovery of the Implant: The initial discovery by the user, confirmed by Grand, revealed a smaller battery and an additional green circuit board connected by numerous thin wires to the main Ledger PCB. This implant was secured with epoxy, and its critical components had their part numbers scraped off, indicating an intentional attempt at obfuscation. A small antenna was immediately visible, suggesting wireless communication capabilities.

1. Implant Architecture: Through meticulous reverse engineering, Grand identified the core components of the implant:

• A cellular module for data exfiltration.
• A microcontroller (later identified as an ARM Cortex M0) to control the implant's logic and interact with the Ledger device.
• An ESIM (embedded Subscriber Identity Module), acting as a programmable SIM card for cellular connectivity.

1. Attack Vector on Ledger Nano X: The implant was found to tap into the SPI (Serial Peripheral Interface) bus connecting the Ledger Nano X's secure element to its display. This was a crucial finding, as the Ledger Nano X's design routes all critical operations, including display and button interactions, through its secure element, making direct attacks on the general-purpose microcontroller less viable. The adversary's choice to monitor the display's SPI communication was an ingenious way to access user-entered data without compromising the secure element itself.

1. Covert Data Exfiltration: The implant leveraged a 4G LTE Cat 1 cellular module to transmit the captured recovery seed data. This method allowed for silent, long-range exfiltration of sensitive information, bypassing local network monitoring and making it difficult for users to detect. The ESIM's global roaming capabilities further facilitated this covert communication, with evidence of connections in the Netherlands, Philippines, and the USA.

1. Lack of Code Protection on Implant Microcontroller: Despite the scraped part numbers, Grand successfully identified the implant's microcontroller as an ARM Cortex M0 and, more importantly, found that its SWD (Serial Wire Debug) interface was completely unprotected. This allowed for full firmware extraction, which was instrumental in understanding the implant's operational logic.

1. Attack Mechanism Confirmation: Firmware analysis revealed a specific function designed to monitor for 26 characters (A-Z) being sent to the display. These characters, when combined, formed the user's recovery seed. The implant would capture these glyphs during the device setup process, store them in persistent flash memory, and then transmit them via the cellular module to the attacker.

These findings collectively demonstrated a sophisticated, multi-stage attack that combined physical tampering, clever exploitation of internal communication buses, and robust covert exfiltration, presenting a significant threat to the security of cryptocurrency wallets.

Technical Deep Dive

▶ Watch: ESIM data reveals adversary's global connections (38:00)

The technical investigation began with a thorough physical examination of the compromised Ledger Nano X. The initial observations included a non-standard, smaller battery and a green PCB (Printed Circuit Board) secured with epoxy. The adversary had meticulously scraped off part numbers from the main integrated circuits on the implant board, a common tactic to hinder identification. A small, unrolled wire antenna was also visible, suggesting an RF (Radio Frequency) component.

Upon careful removal of the epoxy using acetone, the implant board's details became clearer. It was connected to the Ledger's main board via numerous fine, coated wires. Critically, the implant board featured several conveniently labeled test points: CS, CLOCK, DI, GROUND (indicating an SPI interface), SWC, SWD (pointing to an ARM Serial Wire Debug interface), DP, DM, GROUND (for USB), and a BOOT pin. These labels proved invaluable for subsequent probing.

Analysis of the Ledger Nano X's legitimate architecture revealed a design focused on security. Unlike earlier Ledger models, the Nano X routes all critical functions, including button presses and display output, through its secure element, a specialized chip designed to protect cryptographic keys. This design choice significantly limits the attack surface for adversaries trying to extract sensitive information directly from the main microcontroller. This insight led Grand to focus on the SPI bus, which connects the secure element to the display, as a probable point of compromise.

The implant's power management involved some clever bypasses. The smaller, replacement battery lacked a thermistor (a temperature sensor), so the implant included a fixed resistor to emulate a constant room temperature reading. Similarly, the fuel gauge system was bypassed to always report a full battery, ensuring the Ledger device functioned normally despite the modified power source.

To understand the implant's interaction with the Ledger, Grand connected a logic analyzer to the identified SPI lines. By putting the Ledger into screen saver mode, which continuously updates the display, he was able to capture the data flow from the secure element to the display. This confirmed that the implant was indeed tapping into this communication, gaining access to the raw display data.

The antenna suggested RF capabilities, but initial attempts to detect transmissions using a HackRF and spectrum analyzer proved fruitless when the device was simply plugged in. This suggested that transmissions were not constant or were triggered by specific events.

Next, Grand investigated the USB test points on the implant. After soldering a USB Type-A connector, initial connection showed no device enumeration. However, manipulating the BOOT pin (pulling it high) revealed a temporary bootloader enumeration, followed by a composite USB device labeled "Air M2M" appearing after about 15 seconds. This composite device exposed three virtual COM ports. Monitoring these ports revealed diagnostic logging data on one, periodic binary data on another, and, crucially, ASCII text on a third. This ASCII output contained the string "EC716S" and an IMEI (International Mobile Equipment Identity) number.

The "EC716S" identified an Igencom chipset, and an IMEI lookup confirmed the module as an "Air 700E" from Luat, a Chinese manufacturer. This module was identified as an LTE Cat 1 device, designed for IoT (Internet of Things) or M2M (Machine-to-Machine) communication – a full cellular modem, not a simple RF transmitter. This was a pivotal discovery, revealing the sophisticated nature of the data exfiltration.

The microcontroller, a 3x3mm QFN20 package, had its part markings scraped. Despite this, Grand used a JTAGulator to identify its SWD interface, confirming the clock and data pins. The JTAGulator returned a generic device ID of "BC11477," characteristic of an ARM Cortex M0 core. Crucially, there was no code protection enabled, allowing full debug access. Using OpenOCD and a Segger JLink, Grand connected to the microcontroller, halted execution, and successfully dumped its 32KB flash memory and 8KB RAM. Initial strings analysis of the firmware dump was unrevealing, indicating a need for deeper analysis.

Further probing identified a UART (Universal Asynchronous Receiver-Transmitter) interface on the cellular module, with one line connecting to the microcontroller and another providing debug output. This confirmed how the microcontroller and cellular module communicated.

An 8-pin device on the implant board was initially suspected to be SPI flash due to its proximity to the microcontroller. However, pinout analysis revealed it did not match typical SPI flash footprints. With the discovery of the cellular module, Grand re-evaluated and correctly identified it as an ESIM in an MFF2 DFN8 package – essentially a SIM card on a chip. To interact with it, Grand carefully desoldered the ESIM using hot air and mounted it onto a custom adapter, utilizing an old smart card reader and a satellite TV extension board. Using the Pyim tool, he successfully queried the ESIM, extracting its data. This data revealed the SIM was originally registered with Vodafone in the Netherlands, configured for "data only" service, and had connected to networks in the Philippines and, notably, T-Mobile in the USA (during Grand's testing).

Finally, the extracted firmware was loaded into Ghidra for static analysis. With some assistance from ChatGPT (used for generating ideas, not direct solutions), Grand identified a function that meticulously checked for 26 specific characters (A-Z). Another section of memory at 0x7000 was found to contain these characters, resembling a storage area. Piecing together these clues, Grand concluded that the implant's microcontroller monitors the SPI communication to the display. When the user enters their recovery seed (which typically involves typing individual letters), the implant captures these specific glyphs, stores them in RAM, then moves them to persistent flash memory, and finally transmits the complete recovery seed via the LTE Cat 1 cellular module to the attacker.

Demo / Proof of Concept

▶ Watch: How the implant steals recovery seeds from screen (40:30)

While the talk did not feature a live exploitation of the implant to steal funds, Joe Grand effectively demonstrated the reverse engineering process and the capabilities of the implant through several key technical segments. These demonstrations served as concrete proof of the findings and illustrated the practical steps involved in uncovering such a sophisticated attack.

The demonstration began with Grand connecting a logic analyzer to the SPI lines of the Ledger Nano X, specifically between the secure element and the display. He showed how the logic analyzer captured a continuous stream of data when the Ledger was in screen saver mode, visualizing the exact information the implant was intercepting. This visually confirmed the implant's ability to "see" what was being displayed on the Ledger's screen.

Next, Grand demonstrated the discovery of the implant's hidden USB interface. After soldering a custom USB Type-A connector to the implant's test points, he showed that pulling the BOOT pin high on the implant board caused the system to enumerate a temporary bootloader, followed by a persistent "Air M2M" composite device. He then opened three virtual COM ports connected to this device, showcasing the raw data streams: one port showing periodic blocks of data, another displaying continuous binary data, and a third, crucial port, revealing the ASCII text that contained the "EC716S" chipset identifier and the IMEI number. This live interaction with the implant's internal diagnostics was a powerful reveal of its cellular capabilities.

Finally, Grand illustrated the process of extracting and analyzing the ESIM. He showed the physical removal of the DFN8 ESIM chip using hot air, its placement into a custom adapter connected to a PCSC-compliant smart card reader, and the subsequent use of the Pyim tool. The Pyim demonstration displayed the successful querying of the ESIM, revealing its Vodafone Netherlands origin, "data only" service configuration, and historical network connections in the Philippines and the USA (T-Mobile). This provided undeniable evidence of the implant's global cellular exfiltration capability.

These demonstrations, though focused on the investigative process rather than a live hack, were compelling proof-of-concept for the implant's design and functionality, showcasing the detailed technical steps undertaken to understand this real-world threat.

Defensive Implications

▶ Watch: Ledger's response and future hardware hardening (43:00)

The discovery and detailed reverse engineering of this Ledger Nano X hardware implant provide critical insights and actionable recommendations for both device manufacturers and end-users to enhance security against sophisticated supply chain attacks.

For consumers of cryptocurrency wallets and other sensitive hardware, the primary defensive implication is heightened vigilance regarding the purchase and physical inspection of devices:

1. Purchase from Authorized Resellers ONLY: This is the most crucial recommendation. Adversaries often infiltrate distribution channels or create deceptive online storefronts. Buying directly from the manufacturer or a verified, authorized reseller significantly reduces the risk of receiving a pre-compromised device. The user in this case obtained the implant by seeking the "cheapest possible" device on an unofficial online marketplace.
2. Inspect Physical Devices Thoroughly: Users should always compare their newly acquired device against known-good images provided by the manufacturer. Ledger, in response to these types of attacks, now provides detailed images of legitimate hardware, highlighting what the internal components and packaging should look like. Any anomalies – unusual wires, smaller batteries, scraped part numbers, or signs of tampering on the casing or shrink wrap – should be immediate red flags.
3. Beware of Unsolicited Packages and Phishing Attempts: Recalling the 2020 Ledger attack, users should be extremely suspicious of any unexpected "replacement" devices or communications that instruct them to run software or enter sensitive information like recovery seeds. Manufacturers typically do not send unrequested hardware replacements.
4. Understand the Device's Security Model: While complex, having a basic understanding of how a device like a Ledger Nano X is designed (e.g., the role of the secure element) can help users identify when an attack deviates from expected functionality.

For manufacturers like Ledger, these findings reinforce the need for continuous security hardening:

1. Tamper-Evident Packaging and Device Design: Ledger has already begun implementing measures such as unibody devices and improved tamper-evident packaging to make physical modification more difficult to conceal. Further innovations in this area are crucial.
2. Supply Chain Security: Manufacturers must continuously audit and secure their entire supply chain, from component sourcing to final distribution, to minimize opportunities for malicious insertion or modification.
3. User Education: Clear and continuous communication with users about security best practices, how to identify legitimate products, and what to do if tampering is suspected is vital.
4. Proactive Monitoring and Collaboration: Collaboration with security researchers like Joe Grand is essential for staying ahead of evolving threats. Sharing information about observed attacks helps the entire industry develop better defenses.

The talk highlights that even devices with robust software and cryptographic security, like the Ledger Nano X, can be targeted through physical manipulation and clever exploitation of external interfaces. The "cat-and-mouse game" between attackers and defenders continues, emphasizing that security is a continuous process requiring vigilance at all levels.

Key Takeaways

• Real-world hardware implants are a tangible and sophisticated threat: This case demonstrates that well-resourced adversaries are designing and deploying complex hardware modifications to compromise secure devices in the wild.
• Supply chain attacks bypass traditional software security: Modifying legitimate products before they reach the end-user is an effective way to circumvent strong cryptographic and firmware protections, shifting the attack surface to the physical domain.
• Even secure hardware has exploitable external interfaces: The implant's ability to tap into the SPI bus between the secure element and the display on the Ledger Nano X shows that adversaries will find creative ways to extract data without directly compromising the core security chip.
• Meticulous reverse engineering is crucial for uncovering hidden threats: Joe Grand's detailed process, from physical inspection and logic analysis to microcontroller firmware extraction and ESIM analysis, was essential to fully understand the implant's functionality and attack mechanism.
• Cellular modules enable covert and global data exfiltration: The use of an LTE Cat 1 cellular module and ESIM provides a silent, long-range mechanism for attackers to exfiltrate sensitive data, making detection extremely difficult for the average user.
• User vigilance and authorized purchasing are paramount: The most effective defenses against such attacks for consumers involve strict adherence to purchasing from authorized resellers and performing thorough physical inspections of new devices for any signs of tampering.

About the Speaker(s)

Joe Grand is a highly respected hardware hacker, known for his deep expertise in electronics and security vulnerabilities. As the Principal Engineer at Grand Idea Studio, he dedicates his time to exploring the intricacies of electronic devices, uncovering security flaws, and educating others on the methodologies of hardware hacking. Grand is particularly recognized for his work in cryptocurrency recovery, having successfully helped individuals retrieve funds from compromised or inaccessible hardware wallets, a skill he demonstrated live in a viral YouTube video. He approaches his work with a strong sense of curiosity and a commitment to understanding the "how" behind hardware attacks, often "eating his own dog food" by applying the same rigorous processes he teaches in his classes. His fascination with the technological and motivational aspects of hardware espionage drives his investigations, making him a leading voice in the field.