Why You Shouldn’t Trust Your Clipboard [Practical]

[Odogwu-Blockchain]

I’m skeptical that member of this very old forum will ignore the basic on the clipboard check.

Only newbie might possibly be lazy to check the copied address but not for an old time member that frequently copied wallet address due to bunch of transactions since they started on Bitcoin.

If I am using my mobile device for transffering off my decentralized wallet, I do not cross check the wallet many times because I am used to the receiving address been copied many times especially if the address comes from centralized exchange platforms.

When such transfers are made consistently to your cex for p2p trading to Fiat currency, it would be impossible to check the address all the times, it's impossible.

[Mpamaegbu]

How it works in simple words:
The scammers software always monitor your clipboard when you copy a address the software notice it and replace with scammers address. And you may think you pasting what you copy but it actually paste a different address.

This is why I advise my mentees to handle Bitcoin/crypto transactions and every financial dealings, including banks with an utmost precision a murder case demands. Don't rush over it. In my early days here I used to check few characters in an address but now I scan through all. It doesn't take much time to ensure that safety. I rather be safe than hurry up and end up being sorry. No hurry in life applies to this situation.

[MusaMohamed]

This is why I advise my mentees to handle Bitcoin/crypto transactions and every financial dealings, including banks with an utmost precision a murder case demands. Don't rush over it. In my early days here I used to check few characters in an address but now I scan through all. It doesn't take much time to ensure that safety. I rather be safe than hurry up and end up being sorry. No hurry in life applies to this situation.

It's safest to check all characters of a Bitcoin address that is not too long so that there is not too much time needed for checking all characters. It's a very recommended checking step for Bitcoin owner and user practice but there is one more thing, people must avoid to publicly reveal their Bitcoin addresses, and avoid to reuse Bitcoin addresses.

If they don't reuse Bitcoin addresses and don't copy addresses from their transaction history, they already eliminate risk of address poisoning attacks.
Bitcoin Address Poisoning Attacks.

No need of rushing because one Bitcoin block needs about 10 minutes to be found so your transactions likely won't be confirmed immediately in most of times.

[Porfirii]

The problem, apart from many people being unaware of the risk explained here, is that we usually start small with Bitcoin, making small transactions, without worrying too much about checking what we copy and paste, or if we scan a QR code, or whatever, and there are usually no problems. This can create a false sense of security over time, and that when you need to be aware of the dangers, that is, when you have been there for a while and want to make a relatively large transaction, as you never had problems in the past, you do not notice and trust that there is nothing to worry about.

Do not be like the frog that is slowly cooked in the cauldron: always check directions from the beginning, even if it's small amounts, and create a habit.

[taufik123]

-snip-
Should I use an infected device? Everyone chooses for themselves. Those who understand the danger will not take risks; the rest is up to the user. The best thing a user can do for himself is to start studying Linux systems and work in it, and all other entertainment can be entrusted to Windows, which is suitable only for frivolous use and communication on the Internet.

It looks strange when I have to migrate to Linux and of course it takes a lot of learners for me who from the beginning only know Windows for my daily work.
But I really understand how Windows gets infected and causes a lot of chaos for privacy masala, I even use an additional Premium Antivirus in addition to using Windows Defender,
But still there is no guarantee of security because the main problem is with the user himself.

Talking about Linux, is Mac OS also the best option besides having to use Linux?
Because I want to try using my Mac Mini for my new Device Upgrade and start leaving Windows.

[DubemIfedigbo001]

Lol this is ransom malware sitting on your clipboard. Just use any antivirus it won't be there anymore. I remember getting attacked by this particular shit. The catch is whenever you're copying a long string you copied item is getting replaced by scammer address. I recalled a event, I was in charge of more than 300 people's fund distribution. Whenever I was pasting those addresses it was jnjecting that malware and getting replaced. Thank god I did noticed and take necessary action.

Although I didn't find a solution to this problem in an instant. I did faced some difficulty with this issue.

You're lucky you found out, this is how people get into unnecessary debt because they weren't very observant. This have happened to my friend before and he lost funds, it was when he went to the transaction history he saw that he sent to an entirely different address and he did that transaction when he was very tired, so he didn't crosscheck. He attempted the tx again and doing the address copied was always changed when he pasted it

To combat this, I always leave a little amount of coins weekly in my Binance exchange and leverage on their "withdraw again" feature to identify and send coins to required addresses without need to type it in manually when I want to do little repeated crypto transactions like sending to my P2P exchange and others.

[Nathrixxx]

It is not that our clipboard is malicious by default, but we make some mistakes to download some fishing and malicious files on our device and search easily attacked our keyboard, we are not expected to be found on random platforms on making unnecessary downloads and visit to site that I'm not genuine, we should also question ourselves from how we Hunt after free things online because they may be promising quick and fast to reward once we can perform some task, all these may be a trap to introduce us to those malwares.

[cryptomaniac_xxx]

It is not that our clipboard is malicious by default, but we make some mistakes to download some fishing and malicious files on our device and search easily attacked our keyboard, we are not expected to be found on random platforms on making unnecessary downloads and visit to site that I'm not genuine, we should also question ourselves from how we Hunt after free things online because they may be promising quick and fast to reward once we can perform some task, all these may be a trap to introduce us to those malwares.

But still it is part of the system itself. If we used it to store or copy things and then without any checking for validation, we might fall for the phishing links or those clipboard malware. So it's very important that we understand it in the beginning and that not to trust our clipboard.

And that's where this criminals took advantage of us, we let our guard down and think that everything is fine and because what we search is somewhat going to help us in the end. However, we are totally wrong and so we shouldn't trust those, including copying and pasting addresses.

[promise444c5]

-snip-
Should I use an infected device? Everyone chooses for themselves. Those who understand the danger will not take risks; the rest is up to the user. The best thing a user can do for himself is to start studying Linux systems and work in it, and all other entertainment can be entrusted to Windows, which is suitable only for frivolous use and communication on the Internet.

It looks strange when I have to migrate to Linux and of course it takes a lot of learners for me..
~snip~
Talking about Linux, is Mac OS also the best option besides having to use Linux?
Because I want to try using my Mac Mini for my new Device Upgrade and start leaving Windows.

Try Mac OS if the Linux feels a bit difficult, but with time you will get used to it , depending on what you’re using it for.

Some distros are more beginner friendly though, if you don’t have business with pen-testing and likes .. you should install the one that fit more for beginners-mid and I believe  Ubuntu is a perfect example .. you can install any tools you will be needing anyway if you want more .

Mac or Linux can also be attacked by a malware , but MacOs is way better than windows.

Switching from windows to Mac will definitely feel weird at first too.. the commands are slightly different , which can also mess with the muscle memory.

[Z_MBFM]

Lol this is ransom malware sitting on your clipboard. Just use any antivirus it won't be there anymore. I remember getting attacked by this particular shit. The catch is whenever you're copying a long string you copied item is getting replaced by scammer address. I recalled a event, I was in charge of more than 300 people's fund distribution. Whenever I was pasting those addresses it was jnjecting that malware and getting replaced. Thank god I did noticed and take necessary action.

Although I didn't find a solution to this problem in an instant. I did faced some difficulty with this issue.

I have faced such a problem myself, in fact, there may be a malware attack here, and sometimes some clipboard bugs appear. Despite copying repeatedly, when pasting, instead of pasting the newly copied address or text, the previously copied address but text is pasted. Thus, once I sent $700 to the wrong address, and once I made a deposit of $1200 worth of tokens to the exchange, I accidentally sent the token to the contact address of that coin. Here, to export the token to my EVM wallet, I first copied the contract address of that token. Later, I copied the wallet from the exchanger several times, but when I sent the coin, I saw that the coin was sent to the contract address. In fact, whether there is a problem with the clipboard or not, you should definitely double-check before sending coins to any address because once sent, it can never be taken back in cryptography or blockchain technology.

[Cookdata]

It is not that our clipboard is malicious by default, but we make some mistakes to download some fishing and malicious files on our device and search easily attacked our keyboard, we are not expected to be found on random platforms on making unnecessary downloads and visit to site that I'm not genuine, we should also question ourselves from how we Hunt after free things online because they may be promising quick and fast to reward once we can perform some task, all these may be a trap to introduce us to those malwares.

I try as much as possible to avoid custum keyboard when it comes to data input, copy and paste, I don't feel comfortable using them even if they don't pose any threat. Couple of time, I observed that anytjme you want to fill a sensitive information on some app, the phone by default turned to the system keyboard and there wouldn't be an option to change, this is to make sure that you don't lose your sensitive data to all these keyboards because they know it's possible.

I'm not sure if some androids users has stopped this habit of keyboard customized, I loved them those days when android first penetrated Africa, they were cheap and affordable but since I became an ios guy years back, I have never for once go back to android even though I'm sometime limited with some customization, I prefer to use the phone that way. This is not a claimer that iPhone is better than android but are better security with keyboard and this copy paste.

[lionheart78]

If you realize that something is wrong before you broadcast a transaction, it's good enough but sometimes people only realized about that when they already broadcasted a transaction and lost their bitcoins to hackers.

To avoid losing big fund, it's recommended to test your wallet, device with a small transaction. After broadcasting it, you can check the transaction detail with your wallet, and see whether the receiving address is accurate like what you actually intended to send your coins too. If anything was wrong, you will only lose small fund for that testing.

Is not a visual checking enough?  After pasting the address, we can double-check to quadruple-check whether we pasted the correct address, and if there is no problem with the pasted address, we can send the transaction without worrying that we pasted it wrong.  Although I do the same thing you stated when sending a huge amount of funds (a small amount is first sent to ensure that the receiver address is correct and the receiver is able to receive the funds), I still think that double-checking the pasted address is enough to verify if we pasted the right address.

[tbct_mt2]

Is not a visual checking enough?  After pasting the address, we can double-check to quadruple-check whether we pasted the correct address, and if there is no problem with the pasted address, we can send the transaction without worrying that we pasted it wrong.

For visual checking, it's enough but for your transaction and fund movement practice, it's not enough.

Although I do the same thing you stated when sending a huge amount of funds (a small amount is first sent to ensure that the receiver address is correct and the receiver is able to receive the funds), I still think that double-checking the pasted address is enough to verify if we pasted the right address.

Yes, I would to confirm that everything is right not only by my visual checking, but by broadcasting a small transaction first. If it is done well, I can do my next transaction with bigger value. If I have to move my big fund, I will not do it with only one transaction and I would like to split it to two or three transactions after my small transaction for testing.

With available small fund, transaction fee can be expensive in percent of a whole small fund, but with a big fund, transaction fee will not likely too unacceptable expensive, so splitting a big fund to two or three transactions is very comfortable, if its meaning is for minimizing risk of losing big fund with one transaction.

[tabas]

I'm not sure if some androids users has stopped this habit of keyboard customized, I loved them those days when android first penetrated Africa, they were cheap and affordable but since I became an ios guy years back, I have never for once go back to android even though I'm sometime limited with some customization, I prefer to use the phone that way. This is not a claimer that iPhone is better than android but are better security with keyboard and this copy paste.

I still see people who uses customized keyboards on their android phones. They find it cool but I don't mind them doing that and I don't bother them. IMO, whether we're for ios or android, the discipline and security lies still with the user and on how we're aware of these potential threats to our mobile devices. I think when a person starts to get involved with crypto, they're starting to know things like this clipboard malware and customized keyboards that has potential threats.