Firmware update: a necessity or a danger?

Firmware updates present an opportunity for cyber criminals to access your secrets. All electronics companies are aware of this, yet sometimes they fail to protect their devices. A firmware update for Tangem Wallet is technically impossible. And unnecessary.

Why can firmware updates be dangerous?

In 2019, the ASUS firmware update server was hacked by unknown criminals. ASUS did not notice the issue for over a month, during which around 500,000 laptops received modified firmware containing a backdoor. ASUS customers received the malware directly from the manufacturer while updating their software.

In 2021, a similar incident occurred with the update server of Gigaset, a German rugged smartphone brand. Gigaset users began reporting suspicious app installations, rapid battery drain, and intrusive banner ads. In addition, infected Gigaset smartphones sent SMS and WhatsApp spam.

Firmware update servers are generally well protected, but they are valuable targets for hackers. Infected firmware can be used to make a device perform any action. For this reason, criminals invest significant time, effort, and money into hacking these servers.

The firmware of Tangem cold wallets is installed at the factory and cannot be updated later. However, it does not need to be updated, as all new features and support for new blockchains are added on the mobile app side. The firmware has a single purpose: fast and secure transaction signing.

Tangem has developed a unique technology to verify the authenticity of its cards by validating the cryptographic firmware embedded within them. This ensures that the card is genuine and has not been counterfeited. To do this, the Tangem validation server can authenticate the firmware: you simply need to tap the Tangem card on a smartphone. If the card firmware differs from the genuine version audited by Kudelski Security, the Tangem app will alert the user.