A Chrome extension for Ledger crypto wallets that allegedly contains malware

By Selena 01/2/20 6:05 PM

Google’s decision to remove any software related to illegal cryptocurrency mining or scam users is not wrong. Recently, software architect WizardofAus warned cryptocurrency users to be wary of the Ledger crypto wallets malware extension on Chrome. According to him, it is highly likely that this Chrome extension contains malware.

The malware appears on Ledger crypto wallets on Chrome

In a tweet posted on January 2, WizardofAus stated that:

☠️ Malware Chrome extension alert ☠️

If you have “Ledger Secure” installed – REMOVE IT.

The @ChromeExtension “Ledger Secure” contains malware that passes your seed phrase back to the extension’s author.

This is *not* a @Ledger product.
Successfully used against @hackedzec ?

— WizardofAus ??⚡? [Jan3?] (@BTCSchellingPt) January 2, 2020

From his experience, WizardofAus seems to be able to identify what malware is. As a result, he spread his empirical awareness of malware to cryptocurrency users.

After WizardofAus’s warning, the official Ledger Support Twitter confirmed the detection of the extension malware on Jan. 2, using the header “PHISHING ALERT.”

⚠️PHISHING ALERT⚠️

A Chrome extension malware has been detected called “Ledger Secure”. This is NOT a legitimate Ledger application

DO NOT use it and contact us if you’ve installed it:https://t.co/bRaDjYHZbY

You can help by reporting the extension:https://t.co/oltHbtA8RR

— Ledger Support (@Ledger_Support) January 2, 2020

The former executive Trezor, Alena Vranova, tweeted the WizardofAus tweet with the following comment:

Another proof that the word “secure” does not imply security. https://t.co/kYWSPjXSsA

— Alena Satoshi (@AlenaSatoshi) January 2, 2020

Security vulnerabilities have the potential to cause tens of thousands of dollars in damage

To emphasize the importance of a security vulnerability, WizardofAus mentioned the 600 Zcash (ZEC) hacking incident – worth about $ 16,000 at press time – that was stolen from @hackedzec’s assets in his Ledger Nano. Reportedly, this Ledger Nano wallet is a Chrome extension. Therefore, if you have put your trust in a third party, you should ensure that their system is always running smoothly.

WizardofAus also mentioned the warning of Casa founder, Jeremy Welch, last year. At the time, Welch spoke out against the browser extension malware at the Bitcoin event Baltic HoneyBadger in Riga. WizardofAus outlines the risks posed by these products – and what users can do to protect themselves:

Firstly, be very careful what extensions you install. If you’re using the same computer for your crypto as you use generally, be extra diligent.

Better to have a separate minimal machine – or use a Virtual Machine that is the only place you do crypto activity. ?

— WizardofAus ??⚡? [Jan3?] (@BTCSchellingPt) January 2, 2020

Other positives include using only the wallet provider’s proprietary software – in this case, Ledger’s – and double-checking whether it comes from the provider’s website via a secure link or not.

Users can also verify the checksum of the downloaded file before running the software. The checksum, also known as the hash function, is the hexadecimal number unique to the installer’s .exe file created by the author. The downloaded file, assuming that it has not been tampered with by a third party, will match the checksum on the vendor’s website.

Just two days ago, an Ethereum (ETH) Chrome browser extension called Shitcoin Wallet, allegedly injected malicious javascript code from open browser windows to steal data from users.

⚠️ A browser crypto wallet is injecting malicious JS to steal secrets from @myetherwallet @idexio @binance @neotrackerio @SwitcheoNetwork

Extension-native wallet create also sends secrets to their backend!

Bad guys: erc20wallet[.]tk
ExtensionID: ckkgmccefffnbbalkmbbgebbojjogffn pic.twitter.com/TE2iw5d8Md

— harrydenley.eth ◊ (@sniko_) December 31, 2019