CVE-2019-18672
📋 TL;DR
This vulnerability in ShapeShift KeepKey hardware wallets allows attackers to partially reset cryptographic secrets to known values via crafted messages, breaking U2F security for new server registrations and invalidating existing ones. Unauthenticated attackers can exploit this through WebUSB, affecting all KeepKey users with firmware before 6.2.2.
💻 Affected Systems
- ShapeShift KeepKey hardware wallet
📦 What is this software?
Keepkey Firmware by Shapeshift
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of U2F authentication for new server registrations, allowing attackers to register malicious U2F devices and potentially bypass multi-factor authentication on services using KeepKey for U2F.
Likely Case
Invalidation of existing U2F registrations requiring users to re-register their devices, and potential U2F security bypass for new registrations if exploited during device setup.
If Mitigated
No impact if firmware is updated to 6.2.2 or later before any exploitation attempts.
🎯 Exploit Status
Exploitation requires physical access or ability to send crafted messages via WebUSB interface. Public proof-of-concept exists in the referenced blog posts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.2 and later
Vendor Advisory: https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3
Restart Required: Yes
Instructions:
1. Connect KeepKey to computer via USB. 2. Open KeepKey client software. 3. Check for firmware updates. 4. Install firmware version 6.2.2 or later. 5. Device will restart automatically after update.
🔧 Temporary Workarounds
Disable WebUSB access
allPrevent browser-based attacks by disabling WebUSB access to the KeepKey device
Browser-specific: In Chrome, disable 'WebUSB' flag in chrome://flags
Physical isolation
allOnly connect KeepKey to trusted computers and disconnect when not in use
🧯 If You Can't Patch
- Do not use KeepKey for U2F authentication until patched
- Consider using alternative hardware wallet or U2F device for critical authentication
🔍 How to Verify
Check if Vulnerable:
Check firmware version in KeepKey client software. If version is below 6.2.2, device is vulnerable.Check Version:
Use KeepKey client software to view device information and firmware versionVerify Fix Applied:
After updating, verify firmware version shows 6.2.2 or higher in KeepKey client.📡 Detection & Monitoring
Log Indicators:
- Unexpected device resets
- Multiple U2F registration attempts
- WebUSB connection attempts to KeepKey device
Network Indicators:
- WebUSB protocol traffic to KeepKey device from untrusted sources
SIEM Query:
device.vendor:"KeepKey" AND event.action:"firmware_update" OR event.action:"device_reset"🔗 References
- https://blog.inhq.net/posts/keepkey-CVE-2019-18672/
- https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680
- https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065
- https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3
- https://blog.inhq.net/posts/keepkey-CVE-2019-18672/
- https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680
- https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065
- https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3
