How can Trezor update firmware but never receive malware?

Question

I understood from What is it about a Trezor that means it can't be infected by malware? that a Trezor would only interpret data as transaction details, but the Trezor also updates firmware. How is it that an attacker can't hack the firmware update to somehow install malware?

Answer 1

You actually can't update all the firmware. In particular, the portion of the firmware that implements the security logic cannot be modified, it's burned in for good.

If you want to take full control over a Trezor, which would even let you load malware onto it, you can. However, the internal security logic would still wipe all the data in the unit when you did and display a warning each time the unit was started. So you can't use the firmware update path to steal secrets, nor can you trick someone into using a modified Trezor, so long as they watch the startup.

Assuming all this is implemented correctly and has no bugs or defects, that leaves only the possibility of malicious firmware signed by the manufacturer so that it would be accepted by the security firmware without tripping the safeguards. So to some extent, you have to trust the manufacturer. However, if they ever signed "evil firmware", and that firmware got out, their reputation would be ruined.

Answer 2

I emailed them about this:

As for the possibility to get the seed out of the TREZOR:

1. Official firmware doesn't have any support for exporting the seed
2. Official firmware is opensource at github and signed by SatoshiLabs so anybody can check that the firmware can't leak the keys. The signature is checked by the device's bootloader which can't be changed, because the bootloader fuse is blown on the board after the board is fleshed with the bootloader.
3. When anybody wants to flash the device with unofficial bootloader the warning is displayed and user confirmation is needed. During update with unofficial bootloader (which can have the functionally of reading the internal device memory) the storage of the device is wiped first.

They also linked to this article from their FAQ.

Reflashing the TREZOR with evil firmware

Official TREZOR firmware is signed by the SatoshiLabs master key. Installing unofficial firmware on the TREZOR is possible, but doing so will wipe the device storage and TREZOR will show a warning every time it starts. Reprogramming the bootloader is impossible, because all TREZORs ship with their secure programming fuse blown.

What happens if the SatoshiLabs servers are hacked and the firmware signing key is stolen?

First off, this won’t happen ;). The SatoshiLabs master key is kept very safe. However, you don’t need to rely on the SatoshiLabs signature. You can verify the build yourself. Our hope is that a few trusted TREZOR users will make a habit of verifying firmware checksums. If you are concerned about this, we suggest making a habit of checking our blog or social news channels such as reddit before applying any updates. If there ever was a problem with the firmware not matching the source code, you can be sure someone will have written about it.

You don’t need to worry about the firmware being updated by a computer virus. Your TREZOR will ask you to manually confirm the update before anything is written to the TREZOR’s memory.