How To Compromise A Cryptocurrency Hardware Wallet - Security By Ignorance

A few years ago, I was speaking at an event related to crypto-tokens and the topic of security arose. One common theme I noticed immediately involved security. I heard the phrase "if it's not your keys, it's not your tokens" numerous times during that evening. When a few audience members asked for specifics about this phrase and what it meant, crypto-token fanatics suggested hardware wallets because they had "perfect security" to use their term. I cautioned everyone that nothing in the digital world was secure, including hardware wallets. Once we understand how the digital world works, we can immediately take action to start attacking it. Hackers have done this in numerous areas and will continue.

In How To Compromise A Cryptocurrency Hardware Wallet, I cover an example of how researchers at Kaspersky were able to compromise hardware wallets. These are only a few techniques. Privately, I know security researchers who have found other ways. Hackers, if they haven't already, will be next. What we can learn from this is that ignorance is not a security technique. Just because we don't know how something can be done doesn't mean it can't be done.

As a quick note on hardware wallets: just like there are newer and newer ways to attack air gapped machines (machines not connected to the internet), there will be newer and newer ways to attack hardware wallets. But this doesn't only apply to hardware wallets. Some security practices involve physical devices that can also be compromised when studied. As these grow in use, the rewards for attacking them grow.

Some important considerations in the discussion:

• With anything involving tech and security, what is a question that we should consider that I mention early in the video?
• How can we apply this question to topics which may make us feel uncomfortable or uncertain and what is it about our present behavior that makes us feel uncomfortable?
• What is wrong with the two lines of thinking - "It's safe because I don't know" and "It's safe because it hasn't been done before"? In what other areas of security are these lines of thinking dangerous?
• When it comes to security, how can we apply "what people want to know" versus "what is actually true" and what are some action steps we can take to ensure we're not doing the same thing?
• What is one counterparty risk of the digital world and how are your actions in the digital world taking this into account?

That last question is the most important question that you should consider. While we may not consider what others are doing in our actions, we have to understand that all actions that rely on others are subject to significant risks. In the context of security, an example of this may be providing companies with our data while we assume these companies are keeping our data safe. Yet, as we've seen very recently, both Facebook and LinkedIn had leaks of PII and linkability information and these occur regularly when we consider all the leaks of PII data in the last year.

This year in Automating ETL, we are talking about ETL in the context of cybersecurity. From design to specific techniques with data, stay tuned as material is added to the course throughout the year. For a coupon to the course, check out the trailer video on the channel SQL In Six Minutes.

Just like everyone else, we all tend to think that we're the exception (or that we'll be the exception) to the rule when the opposite is true. We're not exceptions and we're not exceptional. This thinking helps protect us because it helps us consider the risk that we may not be considering. In addition, when our security involves others, everything we do is not enough because our security involves the actions of others. This is the digital world in a nutshell, but on steroids as security in the digital world often involves multiple actors.

Take the actions of the Solar Winds compromise. Imagine that you were a database administrator who had managed to keep your environment perfectly secure, yet a tool that you used (Solar Winds in this case) was compromised. No matter how perfect your security was, the tool you used was compromised. Thus, it didn't matter that you practiced good security. However, most people will stop here and this isn't the place to stop. We have to consider that any weak point of a company, tools that the company uses, or talent of the company can be compromised (or worse, spoofed). Something as simple as a .NET or Python library or an electronic device that allows digital extraction of information may give a hacker all he needs to compromise our environment. Thus, even an individual's security in the digital world means nothing.

Are you considering a design that involves storing significant personal information? Given the increase in attacks and leaks, you would be best to avoid this. But this will involve creativity and re-considering how you develop an idea that succeeds. For alternative designs that are profitable, you can get in touch and we'll review your idea and how it can be architected to protect your customers, while also protecting your company from future liability. You can contact for assistance.

SQL In Six Minutes (YouTube) | SQL In Six Minutes (Odysee) | Automating ETL | T-SQL In 2 Hours | Consumer Guide To Digital Security