[Bug]: publish firmware hashes of the unsecured chip on Ledger Nano X / clarify JTAG / outdated FAQ

[adrelanos]

Impacted Library name

FAQ

Impacted Library version

2023

Describe the bug

Quote https://support.ledger.com/hc/en-us/articles/360015216913-Frequently-asked-questions

Advanced users

You can access the JTAG of the unsecured chip on Ledger Nano X, this allows you to verify the loaded firmware.

This seems outdated. Ledger saying in another place which I quote below that the JTAG interface has been disabled. This I reported already in 2021. (LedgerHQ/ledger-live-desktop#3672) Which lead to the following criticism:

Quote https://blog.kraken.com/post/5590/kraken-security-labs-supply-chain-attacks-against-ledger-nano-x/

This is misleading, because Ledger currently does not actually publish any hashes that would make it possible to check the memory contents against a known firmware image.

Quote https://www.ledger.com/enhancing-the-ledger-nano-xs-security

The new Ledger Nano X firmware update includes an MCU update where the JTAG/SWD debug protocol will be disabled by default instead.

Please update FAQ regarding:

• JTAG
• verification of firmware

Expected behavior

Up-to-date FAQ.

Additional context

No response

[gre]

Hi, thanks a lot for raising this issue.

I'm sorry but this still have nothing to do with Ledger Live frontend software (as far as I understand 🤔 )

Could you please contact our support team and mention this github issue? https://support.ledger.com/ 🙏

[adrelanos]

Could you please contact our support team and mention this github issue? https://support.ledger.com/

Not a good practice to redirect public security / documentation related issues to private.

Contacting https://support.ledger.com/ is a dead-end. In my experience, no useful answers ever or any meaningful follow-up. It doesn't result in anyone with permission and knowledge to make any changes having a ticket created and ever taking action. Hence, a waste of time.

If you're interested in actually ever fixing this, please provide a public issue tracker. Otherwise and most likely, I consider this a wontfix.

[gre]

I understand your point, i will definitely forward the feedback about having an official public discussion central point 👍

you can use https://github.com/LedgerHQ/ledger-secure-sdk for public issue tracker related to the BOLOS features or MCU/SE firmwares

on the other end, this repository is only about the frontend parts of our stack and is only watched by Ledger Live developers. (which we tried to make clearer on the template https://github.com/LedgerHQ/ledger-live/issues/new/choose )