CVE-2019-14359

Vulnerability

The vulnerability is a side channel in the SSD1309 OLED controller used in BC Vault devices. The display updates one pixel row at a time, and the power consumption during each row cycle correlates with the number of illuminated pixels. This allows an attacker with power measurement capabilities to infer the pixel distribution of each row, potentially recovering displayed information. The affected devices are BC Vault hardware wallets using the SSD1309 controller. The vendor notes that BC Vault intentionally never displays confidential information beyond the number of characters in the PIN [1].

Exploitation

To exploit, an attacker must have physical access to the USB cable or port of the device. They install a shunt resistor to measure voltage with sufficient accuracy, using laboratory equipment like an oscilloscope or software-defined radio. The victim must then enter their credentials while connected to the attacker's setup. The attack cannot be carried out remotely or invisibly [1].

Impact

The attacker can partially recover the contents of the OLED display. According to the vendor, the only potentially leaked information is the number of characters in the PIN, not the PIN itself. This reduces the entropy of the PIN but does not directly reveal the full secret [1].

Mitigation

The vendor's position is that there is no security impact because BC Vault never displays secret data beyond the PIN length. No software or hardware fix has been released. Users concerned about physical attacks should ensure the device is not connected to untrusted USB ports during PIN entry. The vulnerability is not listed in CISA's KEV [1].