SRAM dump via glitching the firmware update

[tsusanka]

Impact: Seed Exposure
Scalability: Local (Destructive)
Severity: Moderate
Fixed in: Firmware 1.8.0
Reported by: wallet.fail
Date reported: 2018-12-27

Details

Using a special glitching hardware an attacker could trick the device processor into Read Protection level 1 which allows readout of RAM. The issue was fixed by not storing sensitive data in RAM during the firmware update.

Fix

trezor/trezor-firmware@07231d9

Read more

Official blogpost