0 reactions
Why You Shouldn't Copy Addresses From Your Wallet Transaction History - Address Poisoning Attacks
Cryptocurrency addresses are long, random strings, so hardly anyone types them manually. Most people copy and paste them from somewhere. Attackers exploit precisely that habit.
The structure of the technique, called address poisoning, is as follows:
First, the attacker observes the address of the party you actually transact with. Then, they create a fake address that matches the first and last few characters of your real address. Tools exist to generate such addresses, so it's not difficult.
Next, they send a zero-amount transfer from this fake address to your wallet. This records the address in your transaction history.
Later, when you need to make a transfer, if you copy and paste an address that looks familiar from your history, you'll end up sending it to the attacker. Most people only check the beginning and end, not the middle, and wallet apps often truncate the middle part, making this attack easier.
This raises a question: How can someone else create a transaction that appears to originate from your address? The ERC-20 standard's transfer function doesn't check balances or approvals if the amount is zero. Therefore, anyone can create a zero-value transfer from an arbitrary address by paying a small fee.
The terrifying aspect of this attack is the time delay. Cases have been reported where attackers plant a fake address and wait for over two months before a victim falls prey. By then, no one remembers when or how that record was created.
The countermeasure is simple:
Don't use your transaction history as an address book. It's safer to save frequently used addresses in your wallet's address book feature and only retrieve them from there.
If you use an exchange, set up a withdrawal whitelist. This restricts withdrawals to registered addresses, and new addresses often have a waiting period for addition, giving you time to reverse mistakes.
For large amounts, send a small amount first to confirm, then send the rest. While the fee might seem wasteful, it's better than losing the entire amount.
And when checking addresses, look at the middle, not just the beginning and end. Attackers only match the beginning and end.
#cryptocurrency
Cryptocurrency addresses are long, random strings, so hardly anyone types them manually. Most people copy and paste them from somewhere. Attackers exploit precisely that habit.
The structure of the technique, called address poisoning, is as follows:
First, the attacker observes the address of the party you actually transact with. Then, they create a fake address that matches the first and last few characters of your real address. Tools exist to generate such addresses, so it's not difficult.
Next, they send a zero-amount transfer from this fake address to your wallet. This records the address in your transaction history.
Later, when you need to make a transfer, if you copy and paste an address that looks familiar from your history, you'll end up sending it to the attacker. Most people only check the beginning and end, not the middle, and wallet apps often truncate the middle part, making this attack easier.
This raises a question: How can someone else create a transaction that appears to originate from your address? The ERC-20 standard's transfer function doesn't check balances or approvals if the amount is zero. Therefore, anyone can create a zero-value transfer from an arbitrary address by paying a small fee.
The terrifying aspect of this attack is the time delay. Cases have been reported where attackers plant a fake address and wait for over two months before a victim falls prey. By then, no one remembers when or how that record was created.
The countermeasure is simple:
Don't use your transaction history as an address book. It's safer to save frequently used addresses in your wallet's address book feature and only retrieve them from there.
If you use an exchange, set up a withdrawal whitelist. This restricts withdrawals to registered addresses, and new addresses often have a waiting period for addition, giving you time to reverse mistakes.
For large amounts, send a small amount first to confirm, then send the rest. While the fee might seem wasteful, it's better than losing the entire amount.
And when checking addresses, look at the middle, not just the beginning and end. Attackers only match the beginning and end.
#cryptocurrency
| 4,000 mlx | |
| 5 | |
| 0 |