DNSSEC root keys rotate and hardware wallet supply chain attacks reported
Key Takeaway
The DNSSEC root key has undergone its second major rotation since implementation, while hardware wallet users face sophisticated physical implants in the supply chain.
Summary
The DNSSEC root key rotated on October 11, 2026, a process that began in early 2025 to ensure a smooth transition for resolvers. Separately, security researchers have identified sophisticated hardware implants in Ledger Nano X wallets, likely introduced via the supply chain, which use LTE modems to steal recovery seeds by reading the device's LCD screen.
Security updates and hardware vulnerabilities
- DNSSEC Key Rotation: The new root of trust key must be signed by the previous key and is subject to a 30-day observation period before being fully trusted by resolvers.
- Ledger Hardware Implants:
- Implants are physically integrated into the device (e.g., via flex circuits).
- They bypass the host computer and WiFi by using an independent LTE modem, antenna, and eSIM.
- The attack targets the LCD screen to read recovery seeds as they are displayed to the user.
- Multiple generations of implants have been identified, ranging from hand-soldered wires to custom black-coated flex circuits.
Why it matters
The DNSSEC rotation maintains the integrity of the global DNS trust chain, while the Ledger supply chain attacks highlight the critical risks of non-authorized hardware resellers.
Original reference: hackaday.com →