KeyBleed: Attacking The OneKey Mini

KeyBleed: Attacking The OneKey Mini

Speakers: Eric Michaud (Unciphered)

Conference: HITB Phuket

YouTube: https://www.youtube.com/watch?v=gMxtgoW0yx4

Overview

In the rapidly evolving, yet often immature, landscape of cryptocurrency, the security of digital assets remains a paramount concern. This talk, "KeyBleed: Attacking The OneKey Mini," delivered by Eric Michaud, co-founder of Unciphered, delves into a series of critical vulnerabilities across various cryptocurrency wallets, culminating in a detailed exposition of a novel attack against the OneKey Mini hardware wallet. Unciphered, the world's first institutional cryptocurrency rescue company, specializes in recovering lost or inaccessible crypto assets for clients, often encountering scenarios where individuals have lost their entire life savings due to forgotten pins or obscure technical flaws.

Michaud's presentation underscores a sobering reality: despite billions of dollars flowing through these systems, the underlying security often lags significantly. He highlights a severe shortage of skilled cryptographers capable of reviewing the vast number of crypto projects, leading to fundamental security oversights reminiscent of vulnerabilities seen decades ago. The talk not only exposes specific flaws in products like Cold Storage Coin, Ethereumwallet.com, Electrum, Trezor, and the OneKey Mini but also critically examines the industry's approach to responsible disclosure and bug bounties, often finding it lacking or even exploitative. The "KeyBleed" umbrella term signifies a broader initiative by Unciphered to track and address vulnerabilities related to cryptographic key generation.

This article provides a comprehensive breakdown of the attacks discussed, focusing on their technical underpinnings, the methods used to exploit them, and the broader implications for both users and developers in the cryptocurrency space. It serves as a stark reminder that physical access, combined with a deep understanding of hardware and firmware, can often bypass seemingly robust security measures, leading to the permanent compromise of digital assets.

Background

▶ Watch: Introduction and Unciphered's mission (0:00)

The cryptocurrency ecosystem, characterized by rapid innovation and decentralized development, frequently struggles with foundational security principles. Eric Michaud, drawing from decades of experience in lockpicking, red teaming, and darknet monitoring, observes that many vulnerabilities in crypto wallets mirror those found in traditional information security from the 1990s and 2000s. A core issue, as articulated by Unciphered advisor Chris Wi Weld Pond, is that "in a long enough time horizon, every crypto wallet becomes vulnerable." This isn't just due to evolving attack techniques but often stems from initial design flaws.

With over 10,000 unique crypto wallets (hardware, software, and web libraries) in existence, the sheer volume vastly outstrips the number of qualified cryptographers available to audit their code reliably. Michaud points out that most projects are developed by one or two engineers, often lacking a deep understanding of cryptographic best practices or attack chains. This environment fosters a proliferation of vulnerabilities, where even fundamental issues like insufficient entropy during key generation—similar to past problems with SSH key generation or Debian SSL keys—go unnoticed for years.

Unciphered's mission to rescue lost crypto for clients has led them to discover these "miracles," as they call exploits, which allow them to bypass security mechanisms. This work has revealed a pattern of developers underestimating the sophistication of physical and digital attacks, often dismissing vulnerabilities without a "super clean iOS zero-click remote SMS attack." The industry's reliance on "FUD" (fear, uncertainty, and doubt) to downplay security concerns, coupled with often inadequate or misleading bug bounty programs, further exacerbates the problem, creating an environment ripe for exploitation.

Key Findings

▶ Watch: Electrum Wallet Remote Code Execution (RCE) vulnerability (15:50)

The talk presented a series of "miracles" or exploits discovered by Unciphered, demonstrating a wide range of attack vectors against popular cryptocurrency storage solutions:

1. Cold Storage Coin Tamper Evidence Bypass: A physical attack on a collectible coin designed to store cryptocurrency. Despite claims of robust tamper evidence, the private key could be covertly extracted by manipulating the holographic seal using common chemicals or physical methods, allowing for supply chain interception and "rug pulls."

1. Ethereumwallet.com Key Extraction Vulnerability: A bug in the now-defunct Ethereumwallet.com beta site, which operated in 2017, locked out tens of thousands of users. If a password was set, a bug in the underlying CryptoKit library prevented key export. For non-password protected wallets, a unique URL fragment, previously undiscovered to be part of a hash, could be used to extract keys via JavaScript. The vulnerability was compounded by version 1 of CryptoKit having only 33 bits of entropy, making key generation predictable, with 142 funded keys found to be vulnerable. JavaScript buffer issues further reduced the key space.

1. Electrum Wallet Remote Code Execution (RCE): A critical vulnerability found in one of the most popular open-source wallet libraries, Electrum, and its 3500+ forks (including Ravencoin and BSV). The flaw, present for over seven years (since version 2.1 in 2017), involved dangling Python open() statements related to the BIP70 payment request standard. By modifying a payment request URL to a URI (adding a slash), an attacker could trigger a LANMAN responder attack on a Windows machine, leading to a Metasploit shell with read/write/execute privileges and wallet file theft.

1. Trezor Hardware Wallets "Evergreen" Attack: Unciphered developed a permanent, "evergreen" attack against both the Trezor One and Trezor T devices. This attack enables the extraction of mnemonic seeds and bypasses PIN authentication. Using a custom-built tool called treasurebreaker on a powerful GPU setup (e.g., a 10 A4000), a 4-digit PIN (0-9999) can be cracked in approximately 20 minutes. While Trezor promotes the use of a 25th word passphrase (BIP39) as a security measure, the underlying hardware vulnerability allows for seed extraction. Unciphered is withholding the full disclosure of the attack methodology to prevent widespread abuse, urging Satoshi Labs to release their promised new secure hardware.

1. OneKey Mini Secure Element Provisioning Bypass (KeyBleed): The flagship vulnerability of the talk, targeting the OneKey Mini, a leading hardware wallet in China. An Unciphered engineer discovered over 20 firmware vulnerabilities, with the most critical being an authentication bypass between the ATCA (secure element) and the STM (CPU). The attack exploits the fact that the factory fuse, which should prevent further provisioning, is not blown upon device shipment. This allows an attacker with physical access to perform a man-in-the-middle (MitM) attack during boot-up to trick the CPU into believing the secure element has not been provisioned, thereby stealing the protect key and subsequently decrypting the mnemonic seed without requiring the user's PIN.

1. Trust Wallet Mersenne Twister Flaw: A low-entropy vulnerability in Binance's Trust Wallet, specifically affecting its Chrome plugin, Android, and iOS versions. A Mersenne Twister flaw resulted in only 32 bits of entropy for key generation. This led to approximately 3,000 vulnerable wallets being generated, which Unciphered detected using its proprietary VC tools (Virtual Currency tools). The keybleed.com project was launched to allow users to check if their public keys were generated with known low-entropy methods, including those from Brain Wallet, Profanity, and the Trust Wallet flaw.

Technical Deep Dive

▶ Watch: Demo: OneKey Mini mnemonic extraction (physical attack) (35:00)

The vulnerabilities presented by Unciphered showcase a blend of physical, logical, and cryptographic weaknesses.

For the Cold Storage Coin, the attack was purely physical. The "tamper-evident" holographic sticker on the coin, intended to protect the private key printed underneath, could be carefully lifted using common household chemicals (like Goan) or a sharp knife. Once lifted, the private key could be copied, and the sticker reapplied, leaving no visible trace of tampering. This allows an attacker to intercept the coin in the supply chain, record the private key, and wait for the owner to load funds onto it before performing a rug pull.

The Ethereumwallet.com issue stemmed from a flawed implementation of the CryptoKit JavaScript library. For users who did not set a password, their unique URL contained a fragment of a hash, which, when inserted into the application's JavaScript code, allowed key extraction. More critically, if a password was set, a bug prevented key export entirely. The most severe aspect was in version 1 of CryptoKit, which generated keys with only 33 bits of entropy. This extremely small key space meant that all possible keys could be pre-calculated and checked, revealing 142 funded wallets that had seen over 10,000 Ethereum pass through them. Further analysis revealed that specific prefixes (c, p, rd, q) in the generated strings hinted at password usage, and issues with JavaScript buffers adding zeros further reduced the effective key space.

The Electrum Wallet RCE exploited a seemingly innocuous feature: the BIP70 payment request standard. This standard uses URLs to convey payment information. Unciphered discovered that a dangling Python open() statement in Electrum's code would attempt to process these URLs. By crafting a malicious URL and simply adding a slash (/) at the end, it was transformed into a URI, which on Windows machines, could trigger a local file path resolution. This allowed an attacker to force the victim's machine to connect to a remote server controlled by the attacker (e.g., on the same LAN at a coffee shop). The attacker could then perform a LANMAN responder attack to capture the victim's NTLM hash, which could then be brute-forced offline. Once the hash was cracked, an attacker could establish a Metasploit shell, gaining read, write, and execute privileges at the user level of the Electrum application, or directly steal the wallet file. This vulnerability was particularly widespread, affecting Electrum and its 3500+ forks across multiple operating systems for over seven years.

The Trezor "Evergreen" attack targeted the hardware directly. While the full technical details are being withheld due to responsible disclosure concerns (to avoid facilitating kidnappings and ransoms), the talk revealed that Unciphered developed custom hardware (dubbed "The Beast," involving picoscopes, IC waves, and other specialized equipment totaling around $50,000) and firmware tools like treasurebreaker. This setup allows them to bypass the PIN authentication and extract the mnemonic seed. The treasurebreaker tool specifically targets the PIN hashing implementation, capable of brute-forcing a 4-digit PIN (0-9999) in just 20 minutes using a 10 A4000 GPU cluster. This demonstrates that even with a user-defined PIN and the optional BIP39 25th word passphrase (promoted by Trezor as an additional security layer), the underlying hardware can be compromised through side-channel or fault injection techniques, leading to full seed extraction.

The primary focus, the OneKey Mini attack, involved a sophisticated man-in-the-middle (MitM) technique between the device's STM32 microcontroller (CPU) and its ATECC608 secure element (ATCA). The attack leverages two key behaviors:

1. Extracting the Protect Key: The protect key is crucial for pairing and encrypting the mnemonic seed within a key slot on the ATCA. During the device's boot process, the CPU checks if the secure element has been "provisioned" (i.e., mated with the CPU at the factory). Unciphered's engineer discovered that the factory fuse, which should permanently lock the ATCA's configuration after provisioning, was not blown. This allowed an attacker to physically intercept the communication lines between the CPU and ATCA (using custom-soldered boards and an FPGA). By modifying the response from the secure element, the CPU could be tricked into believing the protect key had not been provisioned. Specifically, the attacker needs to change the atca configuration lock value such that it does not equal locked and set the slot IO protect key bit in the ATCA configuration to zero. When these conditions are met, the CPU, attempting to complete the provisioning process, writes the protect key to the secure element, at which point the attacker intercepts and steals it.
2. Decrypting the Seed: With the stolen protect key, and the device's serial number (also obtainable from the ATCA configuration), the attacker has all the necessary components. The CPU normally verifies the user's PIN before accessing the seed. However, with the protect key, the attacker can send a command to the secure element to read out the encrypted seed. Using the stolen protect key and serial number, the encrypted seed can then be decrypted, revealing the mnemonic phrase of the wallet. This entire process, from power-on to mnemonic extraction, can be completed in less than a second during a single boot cycle, completely bypassing any PIN.

Finally, the Trust Wallet Mersenne Twister flaw highlighted a critical failure in cryptographic randomness. The Mersenne Twister algorithm, while a good general-purpose pseudo-random number generator, is known to have weaknesses when used for cryptographic purposes, especially if not seeded with sufficient entropy. In this case, the implementation yielded only 32 bits of entropy, making the generated keys highly predictable. Unciphered's VC tools (Virtual Currency tools), specifically their key generation suite test tools, were able to identify approximately 3,000 vulnerable wallets generated with this flaw. The subsequent launch of keybleed.com aims to provide a public service for users to check if their public keys match known low-entropy generation patterns, including those from Brain Wallet and Profanity.

Demo / Proof of Concept

▶ Watch: OneKey's controversial bug bounty program changes (37:00)

Eric Michaud presented several compelling demonstrations and proof-of-concept videos to illustrate the practical feasibility of the discussed attacks.

For the Cold Storage Coin attack, a video showed how a seemingly sealed coin could be compromised. Under a microscope, the presenter demonstrated that by simply rubbing a finger around the edge of the coin, previously invisible letters and numbers of the private key would begin to appear through the holographic tamper-evident seal. This subtle physical manipulation revealed the underlying secret, highlighting the fragility of such physical security measures and the potential for surreptitious compromise within the supply chain.

The Electrum Wallet RCE was demonstrated with a video showing a fully patched Windows machine. The top-left window displayed the attacker's remote machine on the same local area network (LAN). The victim's Electrum wallet was shown, and the attacker initiated a scan of a malicious QR code (containing the specially crafted URI). Immediately upon scanning, the remote machine (attacker's) received the victim's NTLM hash, which was then shown being brute-forced. The demo concluded by showing a Metasploit shell established on the victim's machine, followed by the exfiltration of the wallet file, verifying that the private key was successfully obtained by matching the ends of the string on the remote box. This illustrated the real-time nature and effectiveness of the LANMAN responder attack.

The Trezor "Evergreen" attack was introduced with a video showcasing Unciphered's specialized lab setup, referred to as "The Beast." This machine, a Windows laptop augmented with a picoscope, IC wave, and other custom hardware components, was shown in operation with custom breakout boards and specialized tools. While the full methodology was not disclosed, the video emphasized the use of proprietary tools like treasurebreaker to extract seeds and crack PINs in minutes, demonstrating the profound impact of their "evergreen" vulnerability on Trezor devices. The complex hardware setup, estimated at $50,000, underscored the specialized nature of these attacks.

The most detailed demo focused on the OneKey Mini attack. A video depicted a custom-soldered OneKey Mini device, with wires connecting to an FPGA (Field-Programmable Gate Array). The setup showed the FPGA acting as a man-in-the-middle between the OneKey Mini's CPU and its secure element. A live Ubuntu USB stick was used to run Unciphered's custom code. The demonstration involved powering on the FPGA first to begin monitoring and injecting commands, then powering on the OneKey Mini. The FPGA's blinking lights indicated successful man-in-the-middling. Within a single boot cycle, the mnemonic was extracted, and the PIN bypassed in "less than a second." The speaker apologized for not bringing the physical hardware to the conference due to legal and logistical complexities, but the video clearly conveyed the attack's speed and efficacy.

These demonstrations collectively served to underscore the tangible risks associated with these vulnerabilities, moving beyond theoretical discussions to concrete, reproducible proof-of-concept exploits.

Defensive Implications

▶ Watch: Q&A: Post-quantum cryptography challenges in the industry (52:00)

The vulnerabilities highlighted in this talk offer crucial lessons for users, developers, and the broader cryptocurrency industry regarding defensive strategies.

For Hardware Wallet Manufacturers (Trezor, OneKey, etc.):

• Secure Provisioning: The OneKey Mini attack underscores the critical importance of properly securing the device during manufacturing. Blowing factory fuses on secure elements (like the ATCA) is essential to prevent post-factory configuration changes or provisioning bypasses.
• Robust Secure Element Communication: Implement strong cryptographic authentication and integrity checks for all communications between the CPU (STM) and the secure element (ATCA) to prevent man-in-the-middle attacks. Any negotiation or state change (e.g., "factory mode") should be cryptographically signed and verified.
• True Tamper Evidence: For physical devices like the Cold Storage Coin, superficial tamper-evident stickers are insufficient. More robust physical security measures, potentially involving resin encapsulation, hardware fuses that trigger data erasure, or highly sensitive sensors, are necessary to detect and deter physical manipulation.
• Transparency and Timely Patches: When vulnerabilities are found, full transparency with users about the nature and impact of the flaw is crucial. Rapid development and deployment of firmware patches (as OneKey did for their specific vulnerability) are vital. However, marketing claims should accurately reflect current security postures, not outdated assurances.
• Invest in Cryptographic Expertise: Employing experienced cryptographers for rigorous code review and design validation, rather than relying solely on general software engineers, is paramount. This can prevent fundamental flaws like insufficient entropy or incorrect cryptographic primitive usage.

For Software Wallet Developers (Electrum, Trust Wallet, Ethereumwallet.com):

• Input Sanitization and Validation: The Electrum RCE demonstrates the danger of unsanitized external inputs. All data, especially from external protocols like BIP70, must be rigorously validated and sanitized to prevent path traversal, code injection, or other command execution vulnerabilities.
• Strong Entropy Sources: The Ethereumwallet.com and Trust Wallet Mersenne Twister flaws highlight the catastrophic impact of poor entropy. Developers must use cryptographically secure pseudo-random number generators (CSPRNGs) seeded with high-quality, unpredictable entropy sources for all key generation. Libraries like CryptoKit must be thoroughly vetted for these issues.
• Regular Security Audits: Continuous, independent security audits by experts are essential, especially for projects with large user bases or significant asset holdings.
• Robust Password and Key Management: Implement secure password handling, storage, and recovery mechanisms. Ensure that key export functionalities are robust and free of bugs.

For Users:

• Understand Threat Models: Be aware that physical access to a device often implies compromise, especially against sophisticated attackers. Do not leave hardware wallets unattended or in insecure locations.
• Use Strong Passphrases: While not a panacea, a strong BIP39 25th word passphrase on hardware wallets like Trezor can add an additional layer of security, making key recovery more difficult even if the device itself is compromised. However, users should understand it's not foolproof against every attack.
• Beware of Supply Chain Attacks: When purchasing hardware wallets, buy directly from reputable manufacturers or authorized resellers. Be wary of suspicious packaging or signs of tampering.
• Verify Wallet Software: Only download wallet software from official sources. Be cautious of cloned or backdoored versions distributed in different geographic markets.
• Utilize Keybleed.com: Users can check if their public keys align with known low-entropy generation vulnerabilities on keybleed.com. This provides a proactive measure to assess risk.
• Diversify and Practice OpSec: Do not put all assets in one wallet. Diversify holdings across different wallet types and practice good operational security.

For the Industry as a Whole:

• Ethical Responsible Disclosure: The "responsible disclosure washing" practiced by some companies, where bug bounty programs are unilaterally altered after an exploit is reported, is detrimental. Industry standards for fair compensation, clear scope, and transparent communication are needed to encourage security researchers.
• CVE for Crypto Hardware: Advocate for widespread adoption and recognition of CVEs (Common Vulnerabilities and Exposures) for crypto hardware vulnerabilities to ensure proper tracking and public awareness.
• Address the "Bad Key Generation" Dilemma: The ethical dilemma of discovering vulnerable keys with funds but no clear owner needs an industry-wide discussion and potential solutions, as traditional disclosure mechanisms are insufficient.
• Invest in Education: Support initiatives that educate developers on secure coding practices, cryptography, and common attack vectors relevant to the blockchain space.

Key Takeaways

• Widespread Vulnerabilities: The cryptocurrency ecosystem is plagued by a significant number of security vulnerabilities, often stemming from immature development practices, insufficient cryptographic expertise, and a lack of rigorous security auditing.
• Physical Access is Critical: Physical access to a hardware wallet or even a cold storage coin can lead to a complete compromise of funds, often bypassing PINs and other software-based protections through sophisticated hardware attacks like man-in-the-middle or fault injection.
• Entropy is Paramount: Fundamental cryptographic flaws, particularly insufficient entropy during key generation (e.g., 32 or 33 bits), create predictable key spaces that can be brute-forced, leading to the loss of millions of dollars in assets.
• "Responsible Disclosure Washing" Hinders Security: Many crypto companies engage in deceptive bug bounty practices, altering terms post-disclosure or dismissing critical vulnerabilities, which discourages ethical researchers and leaves users exposed.
• Keybleed.com for User Vigilance: The launch of keybleed.com provides a vital public resource, allowing users to check if their public keys are associated with known low-entropy generation flaws, fostering a proactive approach to personal security.
• Urgent Need for Expertise: There is an acute shortage of skilled cryptographers and security engineers in the crypto space, underscoring the need for greater investment in talent and adherence to established information security best practices.

About the Speaker(s)

Eric Michaud is a co-founder of Unciphered, a pioneering company specializing in the recovery of lost or inaccessible cryptocurrency assets. His extensive background in the security community spans several decades, beginning notably in 2007 when he helped bring lockpicking events to Hack in the Box conferences, an experience he credits with shaping his career in cybersecurity. Michaud is widely recognized as "the lockpicking guy," having picked locks and taught for money.

Beyond physical security, his expertise extends deeply into digital offense and intelligence. He previously founded Riff Recon, a red team company that developed offensive tools for both physical and digital security. He also established Darksum, a darknet monitoring company where he famously enumerated every Tor hidden service address at the time, undertaking projects with entities like DARPA. Michaud describes himself as an "armchair cryptographer," bringing a pragmatic, attack-oriented mindset to the complex world of crypto security.

More recently, he co-founded Off The Chain, the world's first blockchain security conference. His work at Unciphered focuses on developing "miracles"—exploits that enable the recovery of client funds, often for individuals who have lost their life savings. He is passionate about bringing robust security practices to the often-immature cryptocurrency industry.

Tom, Eric Michaud's co-founder at Unciphered, is a highly experienced professional with over 20 years in cyber and hardware security. His expertise in FPGAs (Field-Programmable Gate Arrays) is particularly instrumental in Unciphered's hardware-focused research and exploit development, as demonstrated in the OneKey Mini attack. While not extensively detailed in the public presentation, Tom's deep technical knowledge is a critical component of Unciphered's research capabilities.