Security Flaw Affects MediaTek Dimensity 7300 Chip
The Donjon research team at cryptocurrency security firm Ledger has discovered a critical vulnerability in a smartphone processor widely used in the Android ecosystem. This vulnerability puts users, particularly those using software-based Web3 wallets, at risk of having their digital assets compromised if their devices are physically compromised.
Ledger researchers, conducting research on the MediaTek Dimensity 7300 chip manufactured by TSMC, have demonstrated that the processor's secure boot process can be bypassed using electromagnetic fault injection (EMFI). The vulnerability allows attackers to gain full control over the processor by disabling the earliest security checks in the device's boot ROM.
Attack Method and Implications
Using open-source tools, the team fired electromagnetic pulses at the precise moment to access the boot ROM's operating system. The chip's write command filtering mechanism was then bypassed, altering the return address in the ROM stack. This method allowed arbitrary code execution at EL3, the processor's highest privilege level. According to Ledger, the attack can be replicated within minutes.
Hardware Wallets vs. Smartphone Security
The company emphasized that this finding does not affect Ledger hardware wallets. Ledger researchers argued that “even the most advanced smartphone chips are vulnerable to physical attacks.” Ledger stated that smartphones used as hot wallets are not suitable for storing private keys, and that true security can be achieved with hardware wallets that include secure elements.