EthClipper: A Clipboard Meddling Attack on Hardware Wallets with Address Verification Evasion

TL;DR

EthClipper is a novel attack on hardware wallets that exploits address verification evasion by using a distributed database to generate visually similar fake addresses, compromising user security during Ethereum transactions.

Contribution

This work introduces EthClipper, the first malware targeting hardware wallets that uses a distributed database to generate address fakes, evading manual verification and demonstrating practical attack feasibility.

Findings

Attacker can match 25% of address digits for 50% success rate.

EthClipper successfully tested on Trezor, Ledger, and KeepKey wallets.

Hardware wallet manufacturers confirm the attack's danger.

Abstract

Hardware wallets are designed to withstand malware attacks by isolating their private keys from the cyberspace, but they are vulnerable to the attacks that fake an address stored in a clipboard. To prevent such attacks, a hardware wallet asks the user to verify the recipient address shown on the wallet display. Since crypto addresses are long sequences of random symbols, their manual verification becomes a difficult task. Consequently, many users of hardware wallets elect to verify only a few symbols in the address, and this can be exploited by an attacker. In this work, we introduce EthClipper, an attack that targets owners of hardware wallets on the Ethereum platform. EthClipper malware queries a distributed database of pre-mined accounts in order to select the address with maximum visual similarity to the original one. We design and implement a EthClipper malware, which we test on Trezor, Ledger, and KeepKey wallets. To deliver computation and storage resources for the attack, we implement a distributed service, ClipperCloud, and test it on different deployment environments. Our evaluation shows that with off-the-shelf PCs and NAS storage, an attacker would be able to mine a database capable of matching 25% of the digits in an address to achieve a 50% chance of finding a fitting fake address. For responsible disclosure, we have contacted the manufactures of the hardware wallets used in the attack evaluation, and they all confirm the danger of EthClipper.