Breaking the Ethereum Phone - From BootROM to Wallet Signing Keys

This talk uses the Ethereum phone (dGEN1) as a case study of "crypto phones", devices that promise to keep wallet keys in hardware-backed storage. The speaker frames the trade-off between browser wallets, which are convenient but exposed to any privileged attacker, and hardware wallets, which are secure but awkward to use. Airdrop incentives make these phones attractive targets. Because root access is not available, the research starts with the MediaTek download mode, where the authentication fuses were found unblown, so a modified preloader could be loaded over USB.

The middle of the talk covers the boot chain. The speaker describes a technique called Loader-of-the-Loader, which patches each later stage in memory so that flash is never written and a failed attempt can be retried. The chain reaches the secure-world hypervisor, ARM trusted firmware and a little kernel, where the image-loading path was replaced and signature checks were bypassed. On the Android side, the screen-lock check runs in a software gatekeeper that reports itself as hardware-backed. Its inputs sit in the password file, so the PIN can be brute-forced offline. The wallet's signing key is a P256 key that controls an on-chain smart account, and the speaker verified that the recovered key matches that account.

The final part looks at the airdrop claim, which relies on a hash of the IMEI and serial number. The speaker showed that two identifiers printed on the retail box were enough to claim rewards for a sealed, unactivated device. The practical lesson is that hardware-backed claims need real secure-element verification, and identifiers printed on packaging should never serve as secrets.