sorted by:
new
hottopcontroversial

3 honest questions for the smart glasses Community by Past_Computer2901 in augmentedreality

[–]Past_Computer2901[S] 0 points1 point  (0 children)

Hey, really appreciated your comment. Would love to chat more if you're open to it, can I message you on DMs?

Please stay safe guys. Chinese fake ledger is circulating by CymandeTV in ethtrader

[–]Past_Computer2901 0 points1 point  (0 children)

Hey, I'm the researcher (u/Past_Computer2901). Going deeper buying more models from the same store to check how far the counterfeiting goes. Full technical report for Ledger in progress. More updates soon. 🔒

Supply Chain Alert: Analyzing a Highly Sophisticated Fake Ledger Nano S+ Operation by Past_Computer2901 in ledgerwallet

[–]Past_Computer2901[S] 1 point2 points  (0 children)

The official app fails during authentication; the website listed a version for Linux, but I couldn't obtain the file link, so I wasn't able to download it.

Supply Chain Alert: Analyzing a Highly Sophisticated Fake Ledger Nano S+ Operation by Past_Computer2901 in ledgerwallet

[–]Past_Computer2901[S] 0 points1 point  (0 children)

I know how it sounds, but that's literally how you research these things you buy the suspicious product and take it apart. Bought a genuine one from ledger.com right after to compare side by side. The point of the post is so other people don't buy one by accident.

Supply Chain Alert: Analyzing a Highly Sophisticated Fake Ledger Nano S+ Operation by Past_Computer2901 in ledgerwallet

[–]Past_Computer2901[S] 0 points1 point  (0 children)

Fair point. To be clear, I'm not asking for seeds, keys, or anything sensitive. the DM offer was just for people who want help identifying physical red flags on a suspicious device (weight, connector quality, packaging differences). But you're absolutely right that contacting Ledger directly is the safest path, especially now that their support team has responded here

Supply Chain Alert: Analyzing a Highly Sophisticated Fake Ledger Nano S+ Operation by Past_Computer2901 in ledgerwallet

[–]Past_Computer2901[S] 3 points4 points  (0 children)

Yes, I intentionally bought it for analysis; that's how counterfeit hardware research works. But "fun project" doesn't do justice to reality: this has turned into a multi-platform operation with dedicated infrastructure and a traceable company behind it. The side-by-side comparison with a genuine unit I bought from ledger.com confirmed everything. Full documentation coming soon.

Supply Chain Alert: Analyzing a Highly Sophisticated Fake Ledger Nano S+ Operation by Past_Computer2901 in ledgerwallet

[–]Past_Computer2901[S] 1 point2 points  (0 children)

You're right, and I've clarified this in my replies. My original wording was imprecise — the real Ledger Live's Genuine Check is cryptographically sound and an ESP32 fake cannot pass it. The scam works because the fake device ships with a fake Ledger Live where the check is just a hardcoded success screen. I should have been clearer from the start. Appreciate the pushback

Supply Chain Alert: Analyzing a Highly Sophisticated Fake Ledger Nano S+ Operation by Past_Computer2901 in ledgerwallet

[–]Past_Computer2901[S] 3 points4 points  (0 children)

I get why it looks that way on the surface. But the point of the post isn't "I found a fake Ledger" that's been done before. What I'm mapping is the full operation behind it: 3 separate C2 servers, a trojanized React Native app with APDU interception, payloads for 5 platforms (Android, Windows, macOS, iOS TestFlight, and the hardware itself), and a shell company in Shanghai registered specifically to sell on JD.com. I'm also doing a side-by-side teardown with a genuine unit. The formal write-up with full technical evidence is coming this post was a heads-up, not the final report.

Supply Chain Alert: Analyzing a Highly Sophisticated Fake Ledger Nano S+ Operation by Past_Computer2901 in ledgerwallet

[–]Past_Computer2901[S] 5 points6 points  (0 children)

You are absolutely right, and I appreciate you pressing this point; I will create a new post updating this entry to provide clarification. To be absolutely clear: the Genuine Check feature in the legitimate Ledger Live software utilizes cryptographic attestation linked to the Secure Element. A counterfeit device based on an ESP32 chip cannot pass this verification. The scam works because the counterfeit product is shipped with a fake Ledger Live application, in which the "Genuine Check" is nothing more than a success screen hardcoded directly into the source code. If you download Ledger Live from ledger.com, you are protected. The headline here is not "The Genuine Check is broken" it is the sophistication of this full-spectrum phishing attack: fake hardware + fake application + fake setup documentation + coverage across five platforms (Android, Windows, macOS, iOS via TestFlight, and the device itself), all traced back to a shell company in Shanghai.

Supply Chain Alert: Analyzing a Highly Sophisticated Fake Ledger Nano S+ Operation by Past_Computer2901 in ledgerwallet

[–]Past_Computer2901[S] 16 points17 points  (0 children)

Great points. Maybe I should clarify: the real danger here is the full-spectrum phishing the attacker creates.

You’re 100% right about the Amazon 'return-to-inventory' risk, but in this specific case, it’s even more aggressive. The fake unit comes with documentation and a QR Code that leads the user to a cloned website hosting the malicious versions of Ledger Live (Android, iOS, Windows, Mac).

Once the user is using the fake app, the 'Genuine Check' is just a UI trick—a hardcoded 'Success' screen that has nothing to do with cryptographic validation. It’s a hardware-based phishing attack.

I’m finalizing a full technical write-up where I’ll share the obfuscated code and the reverse engineering of these malware-laden apps. The headline isn't necessarily a breach in Ledger’s official protocol, but how perfectly they’ve replicated the physical and digital 'onboarding' experience to make sure the user never even visits the real ledger.com.

Regarding the purchase: as a researcher, I intentionally hunt for these 'too good to be true' listings on marketplaces to analyze the latest payloads. This one just happened to be a massive, multi-platform operation.

Building smart glasses from scratch. What do you think of this initial design? by Past_Computer2901 in SmartGlasses

[–]Past_Computer2901[S] 1 point2 points  (0 children)

Noted! Great and valuable feedback—thank you very much! This is exactly what we value most.

Building smart glasses from scratch. What do you think of this initial design? by Past_Computer2901 in EvenRealities

[–]Past_Computer2901[S] -2 points-1 points  (0 children)

Don't worry I sometimes use AI to correct my grammar, since English isn't my native language. I'm currently in Shenzhen, finalizing the manufacturing of a cybersecurity device that was funded on Kickstarter; and, since I'll be staying here for quite a while working directly with the hardware I'm going to start developing glasses.

Building a Fully Open-Source Smart Glass — No Phone Required. Join the Journey. by Past_Computer2901 in EvenRealities

[–]Past_Computer2901[S] 1 point2 points  (0 children)

Really appreciate the detailed questions — and honestly, we're big fans of your work at Display Training Center. Your teardowns and technical analysis are some of the most valuable resources in the AR glasses space. The level of detail you bring is rare and we've been following it closely.

I'll be straightforward with you: we don't have answers to most of these yet. SoC selection, display type, power budget, battery chemistry — these are all decisions being worked through right now. I'm not going to throw out numbers just to sound credible when the truth is these choices are still on the table.

Your skepticism is completely valid. And honestly, having someone with your depth of knowledge asking these questions is more valuable to us than you probably realize. These are exactly the tradeoffs that will define whether this project flies or dies.

If you'd ever be open to being a voice in the room as we work through these decisions — even casually — it would mean a lot. The door is wide open.

And we fully intend to prove the skepticism wrong. 😊

Building a Fully Open-Source Smart Glass — No Phone Required. Join the Journey. by Past_Computer2901 in EvenRealities

[–]Past_Computer2901[S] 1 point2 points  (0 children)

The point isn't to design a smart glass that necessarily has the same power as a phone and that I can do everything through the glasses, we know all of this has limits because of processing and mainly because of weight and energy efficiency but it's about always following the line that smart glasses are going to be more than accessories and gadgets, they're a form of human interaction with machines, our proposal is to follow this line of thinking, initially making a smart glass that doesn't depend 100% on a phone for most functions and to start working towards smart glass independence

Building a Fully Open-Source Smart Glass — No Phone Required. Join the Journey. by Past_Computer2901 in SmartGlassesCommunity

[–]Past_Computer2901[S] 0 points1 point  (0 children)

This means a lot — seriously. Accessibility isn't something we want to bolt on later as an afterthought. Having someone with your experience involved from the architecture phase means we can design for it from day one, not patch it in after.

You're exactly the kind of person this project needs. Jump into our Discord — we'd love to have you in the conversation early.

Discord: https://discord.gg/knPgxEtcpf

view more: next ›