Security researchers have uncovered a critical vulnerability in Tangem’s crypto wallet cards, revealing that a precisely timed laser pulse can reset the card’s password without the original code or backup card. This flaw allows an attacker to gain full control over the wallet and its contents.
The attack, demonstrated by Ledger’s Donjon security team, involves directing a laser at the Samsung S3D232A secure element chip within the Tangem card. By targeting the chip at a specific moment during the password reset process, the attacker can trick the card into accepting a new password, effectively bypassing existing security measures.
Understanding the Vulnerability
Tangem wallets are designed to resemble standard bank cards, utilizing near-field communication (NFC) to interact with a companion app. The embedded secure element chip is intended to safeguard the user’s private keys, ensuring that sensitive information remains protected. Typically, accessing the wallet requires both physical possession of the card and knowledge of the password.
The vulnerability lies in the card’s password recovery feature. Tangem offers cards in sets, allowing users to reset a forgotten password by pairing two cards together. During this process, the card checks if it is in recovery mode. The laser attack disrupts this specific check, causing the card to erroneously enter recovery mode and accept a new password without verification.
Challenges and Implications
Executing this attack is complex and resource-intensive. It necessitates specialized equipment, including a laser rig and precise measurement tools, as well as advanced technical expertise. Additionally, the process requires physically opening the card to access the chip, resulting in noticeable damage. Consequently, the attack cannot be performed remotely or without leaving evidence.
A significant concern is the inability to patch this vulnerability. Tangem’s design philosophy emphasizes immutability, meaning the firmware cannot be updated post-production. While this approach prevents remote tampering, it also means that existing cards cannot be fixed to address this flaw.
Tangem’s Response
In response to the findings, Tangem emphasized that the attack is highly specialized, requiring physical access and substantial resources. The company also highlighted that the vulnerability is not unique to their products but is a known issue with secure element chips in general. Furthermore, Tangem pointed out that the attack’s cost and complexity make it impractical for targeting individual users, especially since the value stored on a stolen card is not externally visible.
While the likelihood of this attack being executed in real-world scenarios is low due to its complexity and cost, it underscores the importance of continuous security assessments in the crypto hardware industry. Users should remain vigilant, especially if their Tangem card is lost or stolen, and consider additional security measures to protect their assets.
