Sergei Volokitin Demonstrates USB-over-SPI Exploit That Extracts an HSM Private Key

Summary

Sergei Volokitin describes a USB-over-SPI out-of-bounds write in an HSM based on Ledger hardware. With physical JTAG access to its MCU, the exploit chain enables code execution and private-key extraction; Ledger fixed the bugs.

Key points

• The HSM uses an STM32 microcontroller to relay USB data over SPI to a secure element; the researcher treats the MCU and USB input as untrusted.
• Volokitin found an attacker-controlled SPI buffer index that allows out-of-bounds writes to global USB endpoint data in both the UI and signer applications.
• Physical access to the device's JTAG port lets an attacker run code on the MCU and send crafted SPI data to the secure element.
• The proof of concept corrupts callback data and uses persistent flash writes to alter code, then changes the public-key response path to return the private key.
• Volokitin says he reported the proof of concept to the vendor and that the bugs were fixed by porting missing patches from the Ledger SDK.
• The talk highlights limited mitigations in low-level devices and the risk of patches not propagating across products.

Vendors

Products