Possible USB TXN injection attack vector?

[trezor]

Possible USB TXN injection attack vector?

[jhoenicke]

Change addresses are checked since version 1.5.x (don't remember the exact version). The change address path must be in the same wallet as all input addresses and end with .../1/x, where x must be small enough. Otherwise, it is not regarded as change, must be confirmed by the user, and is added to the total sent amount.

[prusnak]

Closing as per above comment. We already thought about this attack vector in advance, that's why there is a check.

[brianddk]

Great news! Looks like the paper came out 2 months ago, but has gotten tracktion this week since it is no longer behind a paywall.

If it balloons into something you got a perfect "been there, done that".

Thx for keeping ahead of the curve!