Popular hardware wallet to be subject to hacking
Ledger, which provides hardware wallet, which is a type of cold wallet in virtual currency, that the receiving address of its own product Ledger Nano S is hacked and it is possible to switch to an address other than his own receiving address at the time of payment, The report shows.
https://www.docdroid.net/Jug5LX3/ledger-receive-address-attack.pdf
Characteristics of hacking "exploit the point where address changes every time"
Since the reception address of the hardware wallet changes every time, the user usually does not usually check the remittance reception address of his / her own. With respect to the vulnerability, it is this hacking that rewrites the reception address of the PC with Ledger Nano S and operates so that the sent virtual currency reaches the hacker.
Man In The Middle Attack
A "Man In The Middle Attack" is a situation in which a third party intervenes between two communicating users, spoofing both the sender and the recipient, and eavesdropping or controlling the communication without the user noticing It is to be. This is mainly done for the purpose of illegal acquisition of password and eavesdropping of data.
The other user does not notice the attacker, and encrypts the data with the public key prepared by the attacker and returns it. Here, the attacker intercepts the data and decrypts it with its own private key, encrypts it with the public key of the other user's own key as if it did nothing, and sends it. A user who receives data encrypted with his / her key decrypts data with his / her secret key.
How to deal with hardware theft of wallet
Check reception address each time
In order to prevent "Man In The Middle Attack", it is necessary to take measures such as verifying identity by digital certificate and checking whether it is altered by digital signature.