In a recent development that has shaken the crypto community, a critical vulnerability in Tangem's wallet cards has come to light, raising serious concerns about the security of these devices. This revelation, made by Ledger Donjon, the research arm of hardware wallet giant Ledger, has sparked a debate about the true meaning of security certifications and the potential risks faced by users.
The Vulnerability Unveiled
The vulnerability, discovered by Ledger Donjon, is a sophisticated laser fault injection attack. By physically exposing the secure element chip on a Tangem card and using a precise nanosecond laser pulse, researchers were able to bypass the card's firmware recovery-state check. This allowed them to reset the card's password without the original PIN or a backup card, essentially gaining full control over the associated wallet.
What makes this attack particularly concerning is its repeatability. Ledger Donjon successfully reproduced the exploit on multiple cards, indicating a systemic flaw in Tangem's security measures. The process, while not quick, is a cause for alarm as it highlights a potential weakness that could be exploited by determined attackers.
Impact and Scope
The impact of this vulnerability is far-reaching. Every Tangem card currently in circulation is affected, and the lack of a firmware update mechanism means there is no way to patch this flaw. This leaves existing users vulnerable, as any post-manufacture vulnerabilities become permanent features of the hardware.
The attack path is straightforward once physical access is gained, and the potential consequences are severe. An attacker can freely sign transactions and move funds associated with the compromised wallet. The fact that the attack is physically invasive and leaves visible signs of tampering is a small consolation, as it limits the scenarios in which this vulnerability can be exploited covertly.
Beyond Tangem: The Broader Implications
This incident has implications that extend far beyond Tangem's wallet brand. Ledger Donjon's researchers have highlighted a critical issue with EAL6+ certification, one of the highest security evaluation levels in hardware. The disclosure challenges the assumption that EAL6+ certification guarantees robustness against all potential attack vectors.
The researchers recommend that secure element firmware employ multiple independent checks for sensitive operations and strengthen state validation methods. This incident serves as a reminder that certification evaluates what was tested and does not account for every possible attack surface. A logic flaw in firmware can slip through the certification process undetected, leaving users vulnerable.
Tangem's Response and the Conflict of Interest
Tangem's response to the disclosure was swift and multi-pronged. The company argued that the practical risk to everyday users is minimal due to the attack's complexity and the high cost of the required equipment. This is a valid point, as the scenario of a random Tangem card being targeted by a $250,000 laser rig is indeed unlikely for most users.
However, Tangem also raised a conflict of interest question, pointing out that Ledger Donjon operates within Ledger, a direct competitor. While this observation is factually accurate, it does not invalidate the technical findings. The vulnerability was disclosed to Tangem months before the public announcement, and the company itself acknowledged the potential for reverse-engineering and exploitation given enough time and resources.
Ledger Donjon's researchers have a track record of uncovering security issues in Tangem's ecosystem, including a genuine check bypass on the Tangem Android app and a brute-force attack on the card's authentication protocol. This suggests a pattern of vulnerabilities that Tangem must address to restore user confidence.
What Users Should Consider
For existing Tangem users, the risk described here is largely theoretical at present attacker capability levels. The attack cannot be performed remotely or covertly, and physical security remains the primary defense. However, the lack of a firmware update mechanism for cards already in circulation is a cause for concern, as it leaves users with limited options for mitigation.
The future of Tangem's hardware and whether it will incorporate firmware update mechanisms or additional security checks remains to be seen. This disclosure has certainly put the issue of long-lived embedded security in the spotlight, and it will be interesting to see how Tangem responds to address these concerns.
Conclusion
The discovery of this vulnerability serves as a stark reminder that security is an ongoing battle, and even the most certified hardware is not immune to attack. As the crypto industry continues to evolve, it is crucial for users to remain vigilant and for companies to prioritize security measures that can adapt to emerging threats. This incident highlights the importance of transparency and ongoing research to ensure the safety of users' assets.
