Replying to Avatar unknown

Yes. The person would need physical access to your CC from what I read. Then they could deploy the hack to the secure element. So as long as that fits your risk model and it hasn’t been plugged into a computer (eg you’re using is truly air gaped) you’re probably fine.
Avatar
semisol 5mo ago

There are ways to exfiltrate data through a QR or SD card airgap. SD card is easiest; write to hidden blocks.

QRs can be modulated in other ways such as delay time, intentional error faults, or other choices.

There is also the fact that anything that exists emits EMI, and the Coldcard is no exception. This can be abused to create signals that contain your seed + can be detected at quite a distance using a box the size of a Pi.

Reply to this note

Please Login to reply.

Discussion