MediaTek Android Boot-Chain Flaw Could Expose Encryption Keys and Wallet Seeds
Summary
Ledger researchers demonstrated that brief USB access could exploit a boot-chain flaw in some MediaTek Android devices using Trustonic TEE to recover PINs and wallet seeds. MediaTek sent a firmware fix to OEMs; device updates are still needed.
Key points
- Ledger’s Donjon team found a boot-chain weakness in certain MediaTek chipsets using Trustonic’s Trusted Execution Environment.
- Researchers said brief physical USB access could allow PIN guessing and recovery of encryption keys and wallet seed phrases, without installing malware.
- In a proof of concept, researchers recovered a PIN and seed phrases from six wallet apps on a Nothing CMF Phone 1 in 45 seconds.
- The article estimates MediaTek chipsets power about 25% of Android phones, but says not all devices using the hardware are vulnerable.
- MediaTek said it provided a firmware fix to OEMs in January; manufacturers must deliver updates to affected users.
Article Details
- Vulnerability Types
- Boot-chain weakness that allows security protections to be bypassed before Android loads
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Install the latest available security updates when the device manufacturer delivers them.
MITRE ATT&CK
People
Vendors
MediaTekSecurity researchers at Ledger’s Donjon team uncovered a bootâchain vulnerability in certain MediaTek Android chipsets using Trustonic’s Trusted Execution Environment that could expose encryption keys and wallet seedTrustonicLedger’s Donjon team uncovered a bootâchain vulnerability in certain MediaTek Android chipsets using Trustonic’s Trusted Execution Environment that could expose encryption keys and wallet seed phrases on roughly 25%
Products
AndroidSecurity researchers at Ledger’s Donjon team uncovered a bootâchain vulnerability in certain MediaTek Android chipsets using Trustonic’s Trusted Execution Environment that could expose encryption keys and wallet seedBaseSeed phrases were extracted from six wallet apps in the test: Trust Wallet, Base, Kraken Wallet, Rabby, Tangem, and Phantom.Kraken WalletSeed phrases were extracted from six wallet apps in the test: Trust Wallet, Base, Kraken Wallet, Rabby, Tangem, and Phantom.Nothing CMF Phone 1They demonstrated an attack that, with brief physical USB access and no malware, recovered PINs and seeds in 45 seconds on a Nothing CMF Phone 1, and MediaTek has issued a firmware fix that OEMs must deliver to users.PhantomSeed phrases were extracted from six wallet apps in the test: Trust Wallet, Base, Kraken Wallet, Rabby, Tangem, and Phantom.Rabby WalletSeed phrases were extracted from six wallet apps in the test: Trust Wallet, Base, Kraken Wallet, Rabby, Tangem, and Phantom.TangemSeed phrases were extracted from six wallet apps in the test: Trust Wallet, Base, Kraken Wallet, Rabby, Tangem, and Phantom.Trust WalletSeed phrases were extracted from six wallet apps in the test: Trust Wallet, Base, Kraken Wallet, Rabby, Tangem, and Phantom.