Bitcoin Forum

My question have been answered before about Keylogger and Clipboard hacks, they are 100%  real but every comments I read are talking about computers/PC only, can these hacks happen on a mobile smartphone too? Android phones to be precise.

Clipboard malware is a kind of malware that affect what you copied, in a way the malware will change it to an attacker's data like bitcoin address. You can also copy and paste on android devices, which means it is also possible on android devices. Be expecting this type of malware on any device that can copy and paste.

Yes, Keylogger is also possible, that is why it is better to make use of virtual keyboard. Developers know what they are doing as they make virtual keyboard to popup when you are writing your seed phrase while setting up a wallet on Android devices. You will notice that on wallet like mobile Electrum. 

Smartphones, and more specifically, android based ones, are potential targets of malicious apps and fake apps  stealing your data, and that can of course apply to keyboards that you install (see for example this thread (https://bitcointalk.org/index.php?topic=5321628.msg56488897#msg56488897)). It could even happen unintentionally (https://bitcointalk.org/index.php?topic=5321628.msg56489796#msg56489796), as a result of data they amass that one may not be aware of, which can eventually get leaked. Hell, you’ve even got to be wary of text prediction options (https://bitcointalk.org/index.php?topic=5396861.0).

Keyboard app like Gboard are even vulnerable to these kinds of Clipboard malware. And to be honest, I even get a strange behavior back then when I was using Touchpal keyboard. Not sure if the theme that I downloaded was malicious ones or it is the Touchpal itself.

Aside from what was mentioned above me, you might also try to avoid those random USB keyboard that are capable of being connected to your Android phone if you can avoid it. Those have some weird behavior that I do not understand wtf is happening to my phone, lol. Good thing is that I do not involve any seed phrase nor any sensitive information in my phone.

There's at least 4 ways I can think of a smart phone keyboard being attacked:
1. The physical hardware of either a USB or Bluetooth keyboard (lots work without special drivers but if you need a special adapter for it then that can also carry malware as well as the keyboard itself being able to connect to the Internet via the phone to relay information).

2. The most likely way is downloading a keyboard with additional features that comes with malware that can see what you type as you type it in your keyboard..

3. Downloading some sort of app that allows for accessibility or productivity improvements and giving it access to your keyboard.

4. Anything that can record or log what's going on on your screen (including the coordinates of where touches happen) but this one is easiest to do if something like predictive text is also installed and shows suggestions to the attacker.

I was going to say, it doesn't make a lot of difference to have them words pop up in setting up your wallet either new creation or importing the wallet with the seeds on your device but in fact, it does make some difference as it pops up a set of words that could make the hacker have wide guess at almost 12 or 24 words in a phrase. That could be exhausting.
It's therefore of importance you don't tend to write all your seeds out but source out the words from the pop ups after inputing the closest characters.
Also, while being careful on links you click, also avoid downloading the fancy keyboards out there as some of them could be bugged to mirror your data's as you type. Always be okay with your device's default keyboard.

Absolutely! In fact, android devices are the most targeted among mobile phones because of a higher user base.

This is one of the few examples I just searched MysteryBot – the Android malware that’s keylogger, ransomware, and trojan (https://www.avira.com/en/blog/mysterybot-the-android-malware-thats-keylogger-ransomware-and-trojan)

Like a common saying goes, "No system is 100% secure". Where it involves your personal data or money, be paranoid.

keylogger and similar types of malware are not related to hardware, its software basis. on the code side, they look a bit different for windows and PC compared to android devices, but the essence is the same.

This reminds me of when I was repairing computers, so there was a case where they brought me a monitor to clean the viruses from it.  :D

Yes, but ONLY when using a certain installed app say the keyboard you installed and also ONLY when you accept the permissions ^{(e.g. files and media, camera, contacts, etc)} of the app because android apps cant do something when a certain permission is denied.
Unlike in pc where the whole system can be manipulated and infected of the malware, and not specific control when accepting permissions.

To all stock or unmodified devices of android OS, it's rare to infect a virus, it can't infiltrate the core filesystem not unless you are installed an app (apk) from an unknown source that has malware virus that is systematically easy for them to replicate like keyboard hacking and like placing the hacker's wallet crypto address.

But in general, there's no system that is safe and everything can be hackable when it comes connected to the internet.

Yes, I have friend with a case that when he copied his ronin wallet(axie infinity wallet) the address that been copied is exactly identical to his but to his surprise there is a few changes at the end of his wallet which means theres a malware infected on his cellphone. It did happened also on other users, so those scammers are literally good at spreading those infected files. Not sure how, but of course there is something related to download.

Android devices are more vulnerable to hacks. iOS devices are better against hacks.

However in general, you should use PC / laptop on Linux because the OS has less risk of hacks than Windows or MacOS. Tail OS can be another options for you too.

Download Linux Mint (https://linuxmint.com/)
How to Install Tails OS on USB flash drive for Wallet Purpose (https://bitcointalk.org/index.php?topic=5228801.0)

The rule of thumb I go with when a device is potentially infected with a virus or malware is to assume that all systems are possibly compromised. Assuming the extent of the breach and the resulting damage to security and privacy could be misleading and lead to losses.

Safest alternative, use an airgapped device for sensitive information like wallet address etc.

Not only these hacks can happen, but they are also continually happening as more and more users enter this new field and download dubious applications from the google scam store. These malicious applications may take control of your operating system and inject malware, keyloggers, and trojans of a different kind without you ever noticing it. Of course, until bad things happen and your crypto holdings get stolen by these evil applications. For example, two years ago or so,  android clipboard-hijacking malware called "Clipper" was found in Google Play Store. This malware would replace cryptocurrency addresses with ones belonging to an attacker. You can read more about this here: https://www.welivesecurity.com/2019/02/08/first-clipper-malware-google-play/

Yes! and honestly, they're the most targetted these days considering how vast the number of smartphone users nowadays. You're safe until it happens to you.

As most downloadables are easy to access from the playstore or any source that you will use to download your apps and softwares.

That's why you don't chill when you're not yet good in finding out the official source of the apps that you download with or, you can still be fooled by some phishing messages or emails.

I see smartphones even more unsafe than PC. And I use Windows PC!

And about hardware keyboard for the smartphone: I don't see why bother. Really. Instead of having that, why not simply using a hardware wallet? It is much safer and more convenient than any other option you can have for your smartphone.
Of course, picking the right hardware wallet is important. Of course, setting up correctly and safely that hardware wallet is even more important. But then one has the funds secure in a convenient manner.


PS. Even if one uses HW, he has to be careful when doing copy/paste. Clipboard malware can still exist, but a bit of carefulness fixes that.

It doesn't matter the kind of device in use copy and paste malware attack can be found anywhere but most predominantly common to PC, this type of an attack is very dreadful to left you unaware except if such user is quite aware that whenever you make use of the clipboard function, you must ensure to always check if the address copied and paste tally with the original one, you can do so by checking the first few letters that begin the address and the last few ones that end the address as well to tally from the original one, it can happens on mobiles ad well but mostly common with computers, read better on this aspect from: How to lose your Bitcoins with CTRL-C CTRL-V (https://bitcointalk.org/index.php?topic=5190776.msg52682018#msg52682018) which is a thread by LoyceV that talks more on the needful things to do in identifying such and how to prevent the attack.

Currently, there are even more Android smartphone users and almost everyone has it. If only refers to android keyboard hack it is very easy. Hackers will infect android devices through the malware they spread and of course the target is not only the keyboard, but many other systems they target. this becomes a more dangerous hack. The malware they spread through advertisements or via email to the victims they have targeted or random victims. So be aware and provide extra protection for your android device.

Although many will disagree for various reasons, every smartphone should have protection in the form of AV that would protect users from some basic threats, and it is completely incomprehensible to me how most users treat their smartphones compared to personal computers. Furthermore, the majority naively believe that everything in the PlayStore is safe and harmless, and what about those who install apps from unknown sources, bypassing the protection that protects them from potential malicious apps?

In a nutshell, anyone looking for trouble by behaving irresponsibly in their online activities will find it sooner or later, whether it's a PC or smartphone. Do you want to protect your critical information? It's simple, never enter them into any device that you even suspect may be compromised - use cold storage, hardware wallets or computers that are completely separate from your daily online activities.

Well, bad news. One more fear for me

I think it's much easier for keyloggers and clipboard malware to exist on smartphones than on computer devices.
Reason is that keyboard on modern smartphones is mostly software apps, and they can easily be changed with malicious version, most people probably wouldn't notice this.
In general I wouldn't use any smartphone for dealing with larger amounts of Bitcoin, and it's even better to use some open source alternatives like GrapheneOS, LineageOS, DivestOS or CalyxOS, with minimal amount of apps possible.

I tried a few apps before on my old Samsung phone like a key logger. The two option is to install a keyboard or just install an app that can have accessibility that all keyboards keystroke and copied text are recorded I just did this to monitor my kid's activity that's my only purpose.

I don't think it would be safe than using stock OS. Most other OS is rooted and vulnerable to any attacks. I would prefer to use stock firmware than using a different or modded OS.

Always stick with Stock OS that comes with your smartphone.

Do not download keyboard app on playstore some of them will store the words you type through them.

Avoid unlocking your phone through Rooting process, many do this but they don't know how dangerous a jailed broken smartphone is.