CVE-2019-18673 : Security Advisory and Response

A vulnerability has been discovered in SHIFT BitBox02 devices related to a side channel in the row-based OLED display, potentially allowing attackers to retrieve confidential information like PIN and BIP39 mnemonic.

Understanding CVE-2019-18673

What is CVE-2019-18673?

The vulnerability in SHIFT BitBox02 devices involves a side channel related to the row-based OLED display, where power consumption during display cycles can be exploited by attackers to retrieve sensitive information.

The Impact of CVE-2019-18673

The exploit may lead to the retrieval of confidential data like PIN and BIP39 mnemonic, posing a risk to the security and privacy of users.

Technical Details of CVE-2019-18673

Vulnerability Description

The power consumption of each display cycle on the OLED screen is dependent on the number of illuminated pixels, allowing attackers to potentially recover confidential information.

Affected Systems and Versions

Product: SHIFT BitBox02
Vendor: N/A
Versions: N/A

Exploitation Mechanism

Attackers can exploit the side channel vulnerability by implanting hardware in the USB cable to monitor power consumption while secret data is displayed.

Mitigation and Prevention

Immediate Steps to Take

Avoid using compromised or untrusted USB cables with the device.
Keep the device physically secure to prevent unauthorized access.

Long-Term Security Practices

Regularly update the device firmware to patch known vulnerabilities.
Implement strong access controls and encryption mechanisms to protect sensitive data.

Patching and Updates

Apply firmware updates provided by the vendor to address the side channel vulnerability and enhance device security.