2024

Bitcoin

Dark

Security

Robin

Security experts have identified a new and concerning flaw in Bitcoin hardware wallets, known as “Dark Skippy” that allows hackers to easily extract private keys from a wallet using only two signed transactions, countering the previous methods that required many more transactions. 
The discovery was detailed in a report published on August 5 by Lloyd Fournier, Nick Farrow, and Robin Linus.&nbsp; 
According to the <a href="https://darkskippy.com/" target="_blank" rel="noreferrer noopener nofollow">report</a>, the Dark Skippy attack works by tricking the victim into installing malicious firmware on their hardware wallet. This compromised firmware embeds parts of the user’s seed words into “low entropy secret nonces” used in transaction signatures.&nbsp; 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 If an attacker manages to corrupt a signing device, Dark Skippy can deliberately use weak &amp; low entropy secret nonces to embed chunks of the seed words into transaction signatures. It takes just two input signatures to leak a 12 word seedphrase on-chain.<a href="https://t.co/SpTLfzvyqa" target="_blank">https://t.co/SpTLfzvyqa</a>— nick ☃️ (@utxoclub) <a href="https://twitter.com/utxoclub/status/1820520963454480517?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">August 5, 2024</a>
 </blockquote> 
 </div>
</figure> 
When these signatures are recorded on the blockchain, attackers can analyze them to derive the original seed words using Pollard’s Kangaroo Algorithm, which allows the extraction of secret nonces from its public counterparts. 
The vulnerability affects all hardware wallet models, but only if the hacker successfully gets the victim to install the fake firmware. Unlike earlier methods that required many transactions to be posted to the blockchain, Dark Skippy can be executed with just two transactions, even if the seed words are generated on a separate device. 
To mitigate this risk, the researchers suggest that hardware wallet makers improve their security features, such as secure boot systems and firmware checks. They also recommend that users keep their devices safe, though some suggested methods might be difficult to follow. 
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 
 Also Read: <a href="https://www.cryptotimes.io/2024/08/09/cftc-awards-1m-to-crypto-whistleblower/" target="_blank" rel="noreferrer noopener">CFTC Awards $1M to Crypto Whistleblower</a> 
</blockquote>

Researchers Uncover “Dark Skippy” Flaw in Bitcoin Hardware Wallets

The Crypto Times

Other articles published on Aug 9, 2024

Trump-Themed Cryptocurrency Crashes 95% After Misleading Rumors

California partners with NVIDIA to expand AI education and workforce training

Why is Cryptocurrency Still Not Regulated in Vietnam?

SUI Open Interest Explodes 92%, Pump Incoming?

The Meme Games Presale Raises $350K as Traders Cash in on Olympic Games

CBOE Submits New Application for Bitcoin ETF Options Trading

Join our free newsletter for daily crypto updates!