Researcher Reports USB and NFC Flaws in Hardware Wallet, Criticizes Bug Bounty Response

Summary

Sergei Volokitin says a USB buffer overflow in a Cyper rock hardware wallet let him extract a PIN and 24-word root seed. He says the vendor fixed the bug two days after his report, but took 186 days to respond; he also found an unchecked NFC APDU overflow.

Key points

• Volokitin says the wallet accepted USB packets before PIN entry and insufficient length checks let crafted packets overflow a 6 KB buffer.
• In his demonstration, the USB flaw let him read device memory, recover the user's PIN, and extract the 24-word root seed used to derive private keys.
• He reports the device lacked mitigations such as ASLR and stack cookies.
• Volokitin says the vendor's code showed the USB overflow fixed on November 5, two days after his November 3 report; he inferred the vendor had viewed his unlisted demonstration from its view analytics.
• He says the vendor responded after 186 days, called the issue a duplicate, and offered $1,000 and a two-year warranty, which he declined.
• At the time of the talk, he found a separate unchecked NFC APDU length that could overflow a 32-byte stack buffer.
• His takeaways include securing complex USB attack surfaces, ensuring audits have adequate scope and expertise, and recognizing that bug bounty programs can result in fixes.

People

Vendors

Industries