  Hardware wallets are designed to withstand malware attacks by isolating their
private keys from the cyberspace, but they are vulnerable to the attacks that
fake an address stored in a clipboard. To prevent such attacks, a hardware
wallet asks the user to verify the recipient address shown on the wallet
display. Since crypto addresses are long sequences of random symbols, their
manual verification becomes a difficult task. Consequently, many users of
hardware wallets elect to verify only a few symbols in the address, and this
can be exploited by an attacker. In this work, we introduce EthClipper, an
attack that targets owners of hardware wallets on the Ethereum platform.
EthClipper malware queries a distributed database of pre-mined accounts in
order to select the address with maximum visual similarity to the original one.
We design and implement a EthClipper malware, which we test on Trezor, Ledger,
and KeepKey wallets. To deliver computation and storage resources for the
attack, we implement a distributed service, ClipperCloud, and test it on
different deployment environments. Our evaluation shows that with off-the-shelf
PCs and NAS storage, an attacker would be able to mine a database capable of
matching 25% of the digits in an address to achieve a 50% chance of finding a
fitting fake address. For responsible disclosure, we have contacted the
manufactures of the hardware wallets used in the attack evaluation, and they
all confirm the danger of EthClipper.
