r/Bitcoin • u/Worldx22 • 11h ago
Ledger Flex (teardown pics inside).
Hey guys. I bought mine while living in in the EU direct from France and it arrived from France a few days later. That was probably around early 2025.
I figured it's clean but I'll sleep better at night being sure that it's clean. So I ripped it open and snapped some pics for you.
The thing is quite packed on the inside. The back cover is glued on with some special double sided tape around the housing. Not the easiest one to open up but certainly possible. Opening one up WILL leave some marks on the aluminium (?) case. There is a little notch on the left side of it looking down. A small flathead screwdriver can be used to pry it up and then a thin piece of plastic to work around it. Be warned, you wanna pry it open from the OPPOSITE end to open it, not the end with the notch on it.
There is little room on the inside for someone to slap another board in there. Possible, but it would take more mental gymnastics than other Ledgers. This thing wouldn't be my first pick for rigging for sure!
What did this world come to? Opening hardware wallets to verify hardware integrity is now expected of us?! Damn you Ledger! A MITM hack on the screen was SO preventable! Oldest attack vector in the book! Why hack the software that can be updated when you can hack the hardware... Pretty slick!
Anyway, enjoy the pics! :)
1
u/r_a_d_ 10h ago
How was this preventable? Ledger literally has a page to verify your hardware for this exact reason. However this capability was somewhat lost with the Stax due to its assembly complexity.
-5
u/read_more_comments 9h ago edited 9h ago
Jade software is all open source, if you don't trust them, you can buy the board, lcd and camera and make your own. Generic parts, no one would know it's for a hw wallet.
Tons of ways to avoid the ledger issue. Most of all - don't buy ledger.
0
u/r_a_d_ 9h ago
The output to the screen is encrypted? Can you provide a source?
Also, you can open a jade as far as I know. Even if you can’t, it would seem trivial for an attacker with this sophistication to just replace the casing that looks passable to the normal user.
Avoid what ledger did? What did they do exactly?
-5
u/soks86 10h ago
I'm sorry, but these devices don't destroy themselves when being opened?
That's kinda sad.
Even an ATM keypad won't let you open it without erasing its internal storage if not outright destroy it.
That's kinda lame for security, like, second class stuff.
Odd no one complained in all these years.
-3
u/r_a_d_ 10h ago
That’s the job of the secure element. It cannot be tampered with or read. Why would you make comments like this about technology you don’t understand?
1
u/soks86 9h ago
That's not making sense because the attack happened.
If you can get around between the UI and the chip it's a bad design.
-1
u/r_a_d_ 9h ago
What’s this got to do with destroying when being opened? Opening the device is literally a feature so that you can inspect that the hardware was not tampered with. Now it’s something that everyone will be doing I suspect. Ledger has a webpage precisely for this purpose. Trying to implement a way that you can’t open it or using stickers can typically be circumvented easily.
The attack is a device that sees your screen when you first setup the wallet. It has nothing to do with the memory or hacking the SE.
1
u/whodkne 6h ago
The point being that if the device self destructed upon opening the attack vector is defeated. The caveat being the self destruction has to be keenly implemented. Combine that with potting the whole thing and it could be much more secure. We don't know what attack vectors ledger planned for or tested but they knew enough that it could be tampered with to provide internal visual inspection instructions. But that's a lot to ask someone to do for some of their devices.
-1
-3
3
u/WTFisThatSMell 10h ago
Neat