EthClipper is malware example of Clipboard Meddling Attack on Hardware Wallets with Address Verification Evasion, and paper is released by Nikolay Ivanov and Qiben Yan.
This malware targets hardware wallet owners using ClipperCloud distributed service and distributed database of pre-mined accounts that creates addresses with maximum visual similarity to the original one.
They tested this malware on Trezor One, Ledger Nano S, Ledger Nano X, and KeepKey hardware wallets, and manufacturers all confirmed danger of EthClipper.
EthClipper can run as a simple script and it doesn't need any hardware access or special os privileges.
EthClipper is using modified and improved version of clipboard hijacking with social engineering, ClipperCloud that mines and stores billions of addresses that are later compared with original address detected in clipboard, and ClipperCloud than finds visual similar address and replaces it.
It is harder for victim to recognize false generated address and they send coins to attackers address.
https://arxiv.org/pdf/2108.14004.pdfOne of the problems with this attack is bad design and small screen that many of hardware wallet devices have, like we can see in image below:
Biggest problem however is human mistake of not fully confirming address but just looking at first and the last part of address, like we can see in example of similar address replaced with ClipperCloud:
![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FgvKkOAR.jpg&t=665&c=mUYCbD4vMe67Ew)
Interesting part is to hear replies this two developers received from hardware wallet manufacturers:
ShapeShift (KeepKey):
...it would likely impact KeepKey users since in my experience, you are right: most users either verify the first/last characters or none at all.
SatoshiLabs (Trezor):
It’s quite obvious from the description how the attack works...
Ledger:
The attack you described is a problem we already discussed, and we did not find a satisfactory solution to tackle it. We would be happy to collaborate with you in order to develop defenses against it.
Recommendation for avoiding this kind of attacks would be to avoid doing partial address confirmation, better spend few more seconds to fully verify address, and using separate computer for crypto would always be a good advice.