Author: Liz & Reborn
Editor: Sherry
Background
In the last issue of the Web3 security beginner's guide, we analyzed the Pi Xiu disk scam. In this issue, we will focus on clipboard security.
In many incidents of stolen crypto assets, one of the most confusing points for victims is often: 'I never transmitted my private key online, how could it have been stolen?' In fact, the leakage of private keys / mnemonic phrases does not necessarily occur through the cloud or network transmission; it may also happen during seemingly 'local and secure' operations. For example, have you ever filled in your private key / mnemonic phrase by copying and pasting? Have you ever saved it in a memo or screenshot? These common operations are also the breakthroughs targeted by hackers.
This issue will focus on clipboard security, helping you understand its principles, attack methods, and the prevention recommendations we have summarized in practice, aiding users in building a stronger awareness of asset protection.
Why the clipboard poses risks
The clipboard is a temporary storage space provided by the operating system for local applications to share, mainly used to store temporary data (such as text, images, file paths, etc.) so that different applications can easily copy and paste content between them. For example, when you copy a wallet address, the operating system stores that address in the clipboard until it is overwritten or cleared by new content.
Plain text storage: Most operating systems (such as Windows, macOS, Linux) do not encrypt clipboard data by default, but store it in plain text in memory.
System API provides access methods: Most operating systems provide clipboard-related APIs that allow applications to access the clipboard. This means that if an application (such as a text editor, browser extension, input method, screenshot tool, or even malware) has the corresponding permissions, it can silently read or even tamper with the data in the background.
Moreover, because the content of the clipboard is not automatically cleared by default, it may remain accessible for a long time. If a user copies sensitive information but does not promptly overwrite or clear it, malware or third-party applications have the opportunity to read this content.
Some clipboard malware is specifically designed to tamper with addresses. A fraud report on transnational organized crime in Southeast Asia released by the United Nations Office on Drugs and Crime in 2024 mentioned that a commonly used malware by Southeast Asian criminal groups is clipper. This type of software monitors the clipboard of the infected system, waiting for an opportunity to replace addresses in cryptocurrency transactions. Once the victim inadvertently makes a transaction, it will transfer funds to the attacker's address. Since cryptocurrency wallet addresses are usually very long, users are less likely to notice changes in the receiving address.
(https://www.unodc.org/roseap/uploads/documents/Publications/2024/TOC_Convergence_Report_2024.pdf)
At this point in the article, I believe everyone has realized that the most fundamental way to prevent clipboard attacks is to avoid copying sensitive information and to install professional antivirus software to prevent malware intrusion.
The main purpose of clearing the clipboard is to shorten the exposure time of sensitive information and reduce the risk of being read by malware or other applications. If you accidentally copy sensitive information, clearing the clipboard in a timely manner can reduce the likelihood of leakage. A simple method is to immediately copy a large amount of unrelated content to 'flush' the previously copied sensitive information, which can reduce the probability of being read to some extent.
However, if your device is already infected with malware that steals or tampers with clipboard content, then manually clearing the clipboard has very limited effect. These malicious programs can monitor and read data in real-time, making it difficult to keep up with their operations. Therefore, the best practice is still to avoid copying sensitive information from the source and ensure device security. If you suspect your device has been infected, it is advisable to transfer your assets to a new wallet as soon as possible to prevent further losses.
In addition to the clipboard, sensitive information may also be leaked through the following methods, and users should pay more attention:
Album, cloud storage, input method: Avoid exposing private keys / mnemonic phrases online, including but not limited to albums, cloud storage, WeChat collections, phone memos, etc. Avoid entering sensitive information in input methods. It is recommended to use the system’s built-in input method, disable the 'cloud sync' feature of the input method, and try not to fill in private keys / mnemonic phrases through copy-pasting.
Malware risk: Regularly use antivirus software to scan the system and eliminate potential malware.
Browser extension permission issues: Disable unnecessary browser extensions. If you are concerned about the permission risks of a certain extension, you can first install the extension without using it, check the extension ID, search for its local path on the computer, find the manifest.json file in the extension's root directory, and send the file content to AI for permission risk interpretation. If you have an isolation mindset, consider enabling a separate Chrome Profile for unfamiliar extensions to at least make malicious actions controllable.
Transfer address tampering risk: When performing cryptocurrency transfers or other operations, be sure to carefully verify the wallet address to avoid mistakenly transferring funds due to clipboard tampering.
Clipboard clearing tutorial
Here are some relatively simple methods to clear the clipboard on macOS, iOS, Android, and Windows that you can try:
macOS only saves the current clipboard content and does not record history. You can overwrite sensitive history by copying a piece of unrelated content. iOS also only saves the current clipboard content. In addition to copying a piece of unrelated content, users can also create a shortcut to add the command to clear the clipboard to the home screen, making it more convenient to clear.
(https://x.com/0xBeyondLee/status/1855630836118467028)
Windows 7 and earlier versions only save the current clipboard content without a history. You can overwrite the original content in the clipboard by copying a piece of unrelated content, thus indirectly clearing it. Windows 10 / 11 (if 'Clipboard History' is enabled): Press Win + V to view the clipboard history, and click the 'Clear All' button in the upper right corner to delete all history.
The clipboard history on Android usually refers to the clipboard history recorded by the input method. Many Android devices provide a clipboard history feature in the input method, allowing users to manually clear unwanted records in the clipboard management interface.
In short, if the system itself does not save history, simply copying new content will suffice. If the system has clipboard history (such as Windows 10 / 11, some Android devices), then manually clearing the history as described above will do.
Summary
The clipboard is a frequently overlooked but high-frequency leakage channel. We hope this article can help users re-examine the security risks of copying and pasting, realizing that 'local operations do not equal absolute security.' Security is not just a technical issue, but also a behavioral habit issue. Only by maintaining vigilance, enhancing security awareness, and implementing basic protective measures in daily operations can one truly safeguard their assets.