And various ways to protect yourself from other attacks.
Non-custodial wallets, particularly hardware wallets, have been the gold standard for safeguarding the private key used to access your Bitcoin and crypto assets.
Nonetheless, these products are still at risk of social engineering scams, a common one being convincing unsuspecting BTC/crypto holders to click on convincing phishing links or through similar instructions by unsolicited phone calls.
Today, we’ll examine a more sophisticated and covert scam. Most victims do not realise they’ve been scammed until too late.
Enter Dark Skippy (DS).
What is Dark Skippy?
DS is an exploit that tricks hardware wallet users into downloading a bogus firmware update that deploys malicious code. This extracts one’s recovery (seed) phrase —the 12 or 24-word set, sometimes 20 when using Shamir backup – used to re-access one’s wallets.
The corrupted firmware can be set up to display small amounts of the recovery seed in secret nonces (“numbers used once”) to then verify BTC transactions.
The hacker looks for signature irregularities in the mempool (a blockchain’s list of pending transactions) and deploys an algorithm such as Pollard’s Kangaroo Algorithm on the public nonces (allocated to a block in Bitcoin mining) to reveal the entire seed. In turn, this can then control a victim’s wallet.
This can be done with as few as two transactions from a wallet that has downloaded the compromised firmware.
I’ve provided a (somewhat) simplified summary, as it can get very abstract, especially if you don’t have a computer science background, which I don’t.
Before continuing, there’s no specific brand of hardware wallets at risk. This can affect any signing device (used to authorise a BTC transaction), per details by Dark Skippy Disclosure, written by Lloyd Fournier, Nick Farrow, and Robin Linus.
Their research focuses on Bitcoin but could also apply to other blockchains.
I also recommend reading ‘What is a Dark Skippy Attack’ by Che Kohler at The Bitcoin Manual website.
Ways to protect yourself
Always use genuine devices directly from the manufacturer
Even though it might cost an extra 5-15% versus a local authorised reseller listed on the manufacturer’s website, it’s the most secure way to get a trustworthy hardware wallet.
The more intermediaries are involved, the greater the probability of a device being undermined. I sympathise with trustworthy resellers who are doing the right thing. As a result, the good ones have to suffer due to a small bunch of f-wits who decide to act unscrupulously.
On the other hand, if you get cold storage options straight from a manufacturer, you are highly unlikely to get a defective device. Moreover, it would be incredibly stupid for a company to do this, as it would sabotage its business in an increasingly competitive market.
The next step offers an additional layer of security to confirm the authenticity of a hardware wallet.
Always look for a tamper-proof seal and Secure Element (SE) verification
Trezor’s latest models—the Safe 3 and Safe 5—now have SEs, tamper-resistant microprocessor chips that contain sensitive data.
Older units such as the Trezor One and Model T do not incorporate SEs.
All Ledger devices, including the now-defunct Nano S, have an SE chip. BitBox02 (and related products), the Keystone 3 Pro (which boasts three separate secure chips), Safepal products, and others have also integrated this chip or multiple ones.
Shift Crypto AG, which makes BitBox02 open-source Swiss-made hardware wallets, outlines the various security features embedded within their products (and ones commonly found in reputable alternatives).
Never use a hardware wallet with a pre-written seed phrase
This is rare if it’s an authentic device obtained directly from the hardware wallet’s official website.
However, there are instances where this has occurred by purchasing a unit through a reseller, and new (often unsuspecting) users have been scammed
The seed phrase (recovery seed) is generated once you set up your cold storage. You must write down these words, and it is essential to have them written in the correct order. Otherwise, accessing your funds won’t be easy if you lose your wallet or need a factory reset (which is rare).
An example of a recovery seed for the Trezor One. Photo by rc.xyz NFT gallery on Unsplash
As an additional security measure, I’d recommend getting a fireproof and waterproof metal capsule or tag to transcribe onto a more robust medium rather than relying on paper. There are designated devices for this.
If this occurs, report it directly to the producer’s website and do not use the hardware wallet as it has been compromised. An intermediary is most likely involved in the scam (whether it’s the reseller or someone else, it is hard to tell).
Carry out official firmware updates released directly from the manufacturer
Those familiar with Ledger Live and Trezor Suite will know you are periodically prompted to update your device’s firmware. You should be fine if you go through official channels, such as these desktop apps downloaded directly from company websites.
“As long you are using a genuine device with honest firmware then it should not be carrying out this attack. Ideally verifying open-source firmware against your vendor’s public keys, many devices verify firmware signatures automatically.”
For best practice, you should incorporate numerous layers of protection (as discussed throughout this piece) in case you unwittingly fall victim to this or another scam.
Use a passphrase (a.k.a., The “25th word)
You can create a phrase to access your device’s Bitcoin or Ethereum/altcoin wallet. You will be prompted to type in this customised word/phrase when accessing your wallet,
Each passphrase is unique to a specific wallet, so I’d refrain from creating many wallets with unique passphrases in case it gets too confusing. Then again, the more steps you take, the more protection you’ll have.
“Passphrases are used to create unique hidden wallets and control access to them, without requiring a second hardware wallet or recovery seed. This means your funds are safe, even if your recovery seed is compromised.”
Trezor > Passphrases and hidden wallets
As a reminder, the additional protection offered by a passphrase – which is not stored on your device – means extra responsibility to keep it safe. You’ll be locked out of your wallet if you can’t remember this phrase.
Multisig
Some would say I’ve saved the best until last, greatly boosting wallet security.
So far, I’ve discussed a BTC wallet with only one private key.
Why just one? Can’t we have multiple private keys to manage a wallet?
Fortunately, this concept exists. Enter multi-signature technology, commonly known as multisig.
You can split the risk across various keys instead of maintaining control over a single key. This is highly recommended for people with many BTC in one wallet, alongside creating separate wallets.
A popular setup is a 2/3 system, whereby you hold two keys in separate locations (e.g., one on a smartphone, the other in a safe), and a multisig service holds the third one.
In this instance, a standalone private key is useless because you need at least two of the three to authorise a transaction from the associated BTC wallet.
There’s always a risk that both you and the multisig provider could get hacked (or someone discovers a secret vault and retrieves the other private key). Still, this combination is highly unlikely unless you’re negligent with (cyber) security.
It’s also in the company’s best interest to safeguard the third key on your behalf. Otherwise, they’ll be liable and suffer reputational damage.
Tying it into DS, it’s improbable that two separate private keys on different devices will be leaked unless you’re clueless, which I doubt is true, particularly if you’re undertaking multisig.
What do you do if you believe you’ve fallen victim to this scam?
I would immediately create a new wallet with the unique passphrase and move all BTC/crypto to that wallet ASAP.
– I would also temporarily send some funds to a reputable exchange (ideally split between two), but only a small portion. The majority should be managed with non-custodial wallets.
– In reality, it is possible that, by this point, hackers have already copied your seed phrase onto a new cold storage option and stolen your digital assets.
– Report losses (let alone cybercrimes) to the FBI’s Internet Crime Complaint Center (IC3).
This will also assist other BTC holders in understanding the need to follow best practices when using cold storage.
Final thoughts
By implementing a combination of security procedures, it’s almost impossible for someone to hack your wallets.
As the adage goes, “Never put all your eggs in one basket.” The same applies to BTC and altcoins: Never keep all your assets in one place.
As tech rapidly evolves and scammers become increasingly sophisticated, we mustn’t rest on our laurels. We must keep informed about the latest cyber security issues, at least those relevant to everyday users of crypto wallets, let alone tech.
Acknowledgements
I want to thank Cyber Scrilla for bringing this issue to the public. While others have also discussed it, CS’s YouTube video first made me aware of this vulnerability.
Frostnap also released his video covering this topic, titled DARK SKIPPY DEMO.
Disclaimers
- N.B. None of this is financial or cyber security advice; I am not a financial advisor. You are ultimately responsible for crypto investments, let alone in any asset class.
- The opinions expressed within this piece are my own and might not reflect those behind any news outlet, person, organisation, or otherwise listed here.
- Please do your research before investing in any crypto assets, staking, NFTs or other products affiliated with this space.
Image: AI-generated by Freepik Pikaso