Cryptocurrency security company Ledger has warned users about a rogue Chrome extension that dupes its victims into giving up the keys to their crypto wallets.
Cryptocurrency owners need a wallet just like users of regular cash do. Instead of cash, however, crypto wallets hold digital keys – which grant users access to the blockchain addresses to unlock their funds. Some people write those addresses down on a piece of paper, while others might store them in a file on their computer or in a software application that doubles as a wallet. A hardware wallet is a device dedicated to storing the addresses, and they are built to be as difficult to hack as possible.
Launched in 2014, Ledger claims to have sold over 1.5m hardware wallets. There are two available: the Nano S and the Nano X. Both of them connect to an app called Ledger Live that lets users check balances and send and receive coins and tokens.
The app doesn’t contain a user’s private key. Instead, it accesses it from the hardware wallet when the owner wants to manage their crypto assets. To do this, the user connects the hardware wallet device to the app, which is available on Android and iOS, and also as desktop software.
This week, it emerged that a rogue developer published what they said was a Chrome extension version of Ledger Live on the Chrome store. The extension claimed to let Ledger owners use their hardware wallets to access Ledger Live’s functionality directly within Google’s Chrome browser. All they had to do was enter their Ledger wallet’s seed phrase – a string of 24 words that is the only way to recover their private keys if their wallet is damaged or lost.
The Chrome extension was a scam that copied the seed phrase to a Google form. The author could use it to access all the victim’s private keys and take control of their crypto assets using another Ledger wallet.
Ledger warned people of the scam through its support Twitter account yesterday:
🚨PHISHING ALERT🚨
— Ledger Support (@Ledger_Support) March 5, 2020
A fake Chrome extension has been found, asking to enter your 24 word recover phrase
⚠️NEVER share your 24 words
⚠️NEVER enter your 24 words into any internet-connected device
⚠️Ledger will NEVER ask for your 24 words
Read more: https://t.co/QNoSwptn3U https://t.co/QZKMmT6TMf
This isn’t Ledger’s fault. It’s the app equivalent of phishing, where someone creates a malicious site in a legitimate company’s name and uses it to gather sensitive customer information without the real company having anything to do with it.
On its security support page, Ledger explicitly advises customers not to give up their recovery phrase:
Anyone who gets your recovery phrase can take your crypto assets. Ledger does not store your private keys, nor ever asks for it.
According to ZDNet, over 120 Ledger Live users apparently took the bait. The offending app had been taken down by yesterday afternoon, but this reinforces the need for proper user education about cryptocurrency security and the importance of never giving up your seed phrase.
Companies can produce slick hardware solutions that do everything possible to protect customers, but if users are gullible and willingly enter sensitive information into malicious software from a third party, there’s very little the company can do about it.
Latest Naked Security podcast
LISTEN NOW
Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.
Mahhn
If google you trust, while bitcoin you lust, your crypto seed will leave, your wallet indeed, the real Ledger was never, free. (close enough)
Darren Chaker
Bitcoin is great, but I have come to learn a secure wallet takes more than just trusting how safe the company offering the wallet to the consumer says it is. People who use Bitcoin need to scrutinize the security of his/her wallet and take extra precautions on keeping digital currency safe. Thank you for the great post and look forward to seeing more from NakedSecurity!