Ledger's Nano S 1.5.5 Firmware Update Causes Troubles

The Ledger Nano S’ firmware has been recently updated to 1.5.5, while this update brings several features like the support of Groestl and Blake2b as new hashes, Schnorr with Zilliqa as a new signature scheme, Bip32-ed25519 as a new derivation scheme and several other major security updates.

It also caused troubles for its owners wanting to update. As this firmware is slightly larger in size than old ones, HSM servers hosting this update became unresponsive as many users were simultaneously trying to update their device, causing access to the Manager and installing apps to be slower than usual, a significant amount of users reported their device getting stuck during the update which would be later addressed with another update and an apology from Ledger.

Annonymous Researcher Demonstrates Antminer S15 Exploit

Recently developer James Hilliard, known for his BIP91 proposal (segwit upgrade), discovered a vulnerability in Bitmain’s Antminer S15 firmware, this was then turned into an exploit by independent security researcher under the twitter handle of @00whiterabbit.

The vulnerability allows a malicious hacker to remotely access the miner with SSH, allowing the attacker to flash a custom firmware without ever being in physical presence with the device. Flashing a firmware could cause an array of problems like decreasing its hash rate by underclocking its processors, shutting it down or even modifying the payout address of the miner, leaving thousands of miners vulnerable to basically anything the attacker desires under certain circumstances.

Electrum Fishing Scheme Warning

A fishing malware scheme has been spotted targeting electrum wallet users. Electrum users are advised to read the warning explainer that has been setup here.

A malicious notification popup with a clickable link.

Users of many versions of Electrum released may see messages as pictured when attempting to send a transaction with their wallet. The message, or some variation of, purports that a security update is required to continue.

This is not the case.

The message is generated by the server you are connected to, and contains a link to a malicious modification of the wallet which, if installed, will result in the immediate theft of all of your money. If you install any software shown in a message such as this you have no recourse to recover your funds.

Card Shuffle to Bitcoin Seed
Bitcoin seed generation is the most important event for any Bitcoin holder, as without this seed your wallet and ultimately your money is lost. We as users trust hardware and air gapped wallets to be correct and honest in their seed generation, which is hard to verify. A new bring-your-own-entropy method was proposed on the Bitcoin dev mailing list by developer Ryan Havar to allow users to create randomness they trust.
Simple Proof of Reserves Transactions

Proof-of-reserve transactions are transactions provided by a certain custodian to prove ownership for an amount of funds. For example, lets say an Exchange currently holds 30 thousand Bitcoins on behalf of its users, if anything happens to the exchange, say a hack, the exchange might need to prove to its customers that their Bitcoin is in safe hands, currently any company that wants to perform a proof-of-reserve must do it in its own way and accordingly, their users have to understand the construction to be able to verify it, this makes the process not very common among custodian companies as it’s both tiresome and would require educating their users on technical terms.

A new BIP was proposed as a way to formalize a standard format for constructing these proofs, making it easier for custodians and users with existing wallet infrastructures to understand these proofs. Proofs are formatted as a regular Bitcoin transaction with small differences. This transaction must be unspendable as its sole purpose is to demonstrate the availability of the funds, not spending them. The proof must be linked to the issuer, preventing custodians from just copying other custodians’ proofs.

Proof of Stake Bitcoin Sidechains
Proof of stake is another consensus protocol that has been used on multiple block chains for quite some time now, there was a proposal on the Bitcoin-dev mailing list to attach proof of stake sidechains to the original Bitcoin blockchain. This allows for the development of decentralized networks which aim to manage reserves of Bitcoin, using custom application code and smart contracts that use Bitcoin as the native currency.
Summary for December 2018
We’ve been taking a break for the past two months while working on a website upgrade. Since we did not cover news in that time, we decided to make a series of recap articles covering the last two months, starting with news related Bitcoin Core and going through Lightning Network and its related updates.