Android Phone Users Beware: Security Vulnerability Detected for Cryptocurrencies

The Donjon research team at cryptocurrency security firm Ledger has discovered a critical vulnerability in a smartphone processor widely used in the Android ecosystem.

The vulnerability puts users, particularly those using software-based Web3 wallets, at risk of having their digital assets compromised if their devices are physically compromised.

Ledger researchers, conducting research on the MediaTek Dimensity 7300 chip manufactured by TSMC, have demonstrated that the processor’s secure boot process can be bypassed using electromagnetic fault injection (EMFI). The vulnerability allows attackers to gain full control over the processor by disabling the earliest security checks in the device’s boot ROM.

Using open-source tools, the team fired electromagnetic pulses at the precise moment to access the boot ROM’s operating system. The chip’s write command filtering mechanism was then bypassed, altering the return address in the ROM stack. This method allowed arbitrary code execution at EL3, the processor’s highest privilege level. According to Ledger, the attack can be replicated within minutes.

The company emphasized that this finding doesn’t affect Ledger hardware wallets, arguing that “even the most advanced smartphone chips are vulnerable to physical attacks.” Ledger stated that smartphones used as hot wallets are not suitable for storing private keys, and that true security can be achieved with hardware wallets that include secure elements.

*This is not investment advice.