Topic: Is there any malware that captures your recovery seed when shown or typed? (Read 779 times)

Currently I manage my crypto only on my Linux partition, we are not 100% free of malware, but it already solves a good number of problems, I only use Windows for cryptocurrencies with a maximum hardware wallet.

That's a great suggestion, I hadn't thought of that, although there are solutions on github that do something similar to what you suggested, but it's an open source third-party tool and you should analyze the code or trust whoever analyzed the code for you.

In multibit classic there was something similar, but it was not a deterministic wallet yet, so to export the wallet's private keys, you would have to encrypt the file to be exported with a password and you could decrypt it with openssl with encryption algorithm aes-256-cbc.

Regarding the tool I suggested in the link, I just did some tests with newly generated seeds that I wouldn't use as main wallets, so I can't guarantee if it's a minimally safe tool. Run your own tests.

I am also one of those paranoid people that worry about things like this. I always make sure that I shift whatever coins that was on a wallet that I recoved to another secure wallet, emmidiately after I used the seed to recover it. You have to be faster than the "hacker" that infiltrated your system.

I have suggested before on previous threads that developers create a offline solution, where you encrypt the seed before you go online and when you copy and paste the encrypted data, it will decrypt it within the software with a password... before it can be used. So even if the hacker retrieve the encrypted "seed" ... it cannot be used without the password to decrypt it, when you go online.

Clipboard attacks will be nulified, because you can reboot your device before you go online and it will clear the clipboard and keyloggers cannot actively record your keystrokes, because you do this offline. (Just open a word pad document and type other random words, while you configure your seed and swap between the program that you are using and wordpad to scramble the inputs)

You can also use TailsOS to clean reboot after each recovery to protect yourself against most Malware infections. Electrum wallet work very well with TailsOS... if you just want to quickly recover a seed and shift the coins to a new wallet.

I do this, when I shift coins from cold storage to hot wallets.

While following your restrictive procedures isn't bad and gives you less bad exposure to potentially bad sites, are you aware of issues with overly complex browser software, zero-day exploits and the possibility of malicious ads delivery from basically any site that has some space where ads are served and shown?

Google makes money with ads, other sites do the same and not every ad blocker does protect you here. Malicious payloads by ads is not a theoretical attack vector, it happened in the past.

Unmanageable complex browser software with tons of bugs is an issue and open door for malware, sooner or later, and nasty things can happen on any reputable sites which deliver programmable ads and other such shenanigans.

Don't use your crypto wallet stuff on a device with which you do your daily internet shit. That already can help a lot, but doesn't protect you 100%. Air-gapped or hardware wallets and careful verification of transaction details helps a lot, too.

95% of trojans intercept all yours keyboard typings, all wallet files, all passwords from all browsers and email clients, and trojans do it as some as posible after they come to your computer.

---

most "qality" trojans  clone your type of bios, os, installed software, and after this hackers  login  to your bank account like to  them home...

[moderator's note: consecutive posts merged]

Some Trojans can even remains after reinstalling OS because it's saved in the BIOS, so no matter when and how you install there is no way that we can assure that the device is free from malware. That's why Airgapped system is mandatory for storing decent amount of BTC. But OP looks more concerned about the crypto wallets of smartphones. We should not use smartphone to store big amount, should keep very minimal amount that you may need for day to day payments if there is any and all the remaining balance should be in HW or cold storage.

Text above yep just for readers   yop pecaution or paranoia, just don't mind!

This is the way. Air gapped is essential if you have any decent amount of BTC. It's liberating being your own back but like a bank, you need to take security seriously.

If your seed is well secured then you have done majority of the hard work in securing your Bitcoins. It's highly recommended to secure your seed on a piece of paper since it will take not more then a minute or two in doing so. Seed has to be flashed once when we are creating our wallet and there is no escape from that but we can minimise the risk of exposing the seed by taking steps as you mentioned. Do spend some money on buying hardware wallet to add extra layer of defence. 

Just as you have mentioned a multi sig actually offers better security only if the multi sig isn’t done on one device, using a single device to do that defeats the whole purpose of the multi sig as it points to one single point of failure. As for me if it is not maybe a two or more individual funds I will refer to buy an hardware Wallet or another device as airgapped and use the other as a watch only wallet and then add pass phrase as a second layer to my seed phrase. I believe both are of the same category of security. Except maybe the co signer for the multi sig is higher than 2 to sign a transaction

to enhance security, it is advisable to use multisignature wallets, which require multiple signatures (from different devices or individuals) to authorize transactions. This approach reduces the likelihood of successful attacks by necessitating multiple authorizations and offering additional safeguards against unauthorized access.

I believe that being a little bit paranoid about your funds is not so bad, especially when it is worth a lot. It can help you to take security and privacy very seriously. I agree that it is possible to use an online wallet without getting hacked, that is if you use your device well, like you have said. However, in an online wallet there is always a chance of an attack and if you own a lot in BTC, it is recommended to simply use an offline wallet and keep your keys permanently off the internet.

Guys, what's your worry if you don't download pirated movies, games and software? If you don't visit torrent and adult websites and don't download something strange from internet, then you don't have to worry about malware because Google and YouTube won't inject keyloggers into your computer. If they do it, then there will be a huge scandal. I have created many Bitcoin and altcoin wallets from a computer that always had online access since I bought it and keep in mind that I own Bitcoin wallet since 2016 and I have stored up to 3 Bitcoin for many months.
My recipe is simple, I don't download everything that I find online, I don't insert USB flash drive on my computer, I don't download pirated content and I don't open emails from strangers. If you use your computer that way, you'll be fine. If you download pirated content and do some other things, then you should get a new and clean computer and create a wallet there or buy a hardware wallet. Don't be paranoid when you don't need to be.

Disconnecting your computer from the Internet does not solve the issue totally, some Trojans and spyware comes with service workers which collect data both offline and online and transmits the data back to the attacker's database when Internet connection is restored.

The best solution remains hardware wallets and air gapped devices. Then if you should import it to a normal device, its important you reinstall the operating system, and let the wallet be the first software to be installed after the OS reinstall. Anything that involves third party softwares and usage of browser before importing your seed phrases is a red flag for me.

It would be very easy to implement on a Remote Access Trojan that monitors the desktop 24/7. These trojans have existed for decades, I would say since Windows 95 era, I remember some classics like the Sub7 one. For some reason these softwares make me very nostalgic of the early 2000 era. I think this one was of the first to take screenshots and monitor the desktop. So you could just make it recognize formats of seeds and take a screenshot of that so you don't have to go across hours of recordings. Yeah these softwares were pretty nasty but it is what it is, some people will always try to take advantage of others by any means. To avoid this please just use Linux.

First is privacy you don’t need to go around talking about you having cryptocurrency because that expose you to search by people. Even if someone sees that seed phrase without the passphrase there are only going to recover a different wallet. As for the storage of seed phrase offline, the same way it is not advisable to store your seed phrase in your head is the same way you shouldn’t rely on your head on where you store the seed phrase. The best thing will be to periodically check that storage location and check if the seed phrase is there. This can be like 6 months or even yearly not necessarily occasionally.

Good point! Storing the recovery seed in safe places and knowing where it's at the time of recovery, assuming you didn't just keep it at home, is a challenging process, as someone with knowledge of cryptocurrencies could find it and try to drain your wallet...

Hence the importance of extending the recovery seed to a custom word/passphrase and using it as a 2° factor.

However, some care must be taken, such as not storing the recovery seed and the personalized password in the same place together, but it is challenging, as it requires your creativity to know how to store this data without anyone with knowledge of cryptocurrency finding it and without you losing it. or forget where you stored them.

If you extend your seed phrase with a passphrase, you are not expected to commit the passphrase to memory, just the way you are not going to commit your seed phrase to memory, your passphrase should be backed up on paper, but in a different place from your seed phrase. Extending your seed phrase with a passphrase is a good layer of security and it can also be used for plausible deniability, so i recommend.

For me personally, air gapped devices its the best, followed by encryption of seed phrases and private keys. But you need to do the encryption yourself, do not use a random software to encrypt because that involves a third party. You do it yourself and keep the encryption key safe somewhere offline and possibly have it off heart so that even when the encryption is compromised, it cannot be decrypted unless the person has the key too. You can decrypt it yourself in seconds by running your little server with the aid of the the secret key you used for the encryption.

I'm not a fan of word extension, sometimes its easy to guess, and when you make it very difficult, you put yourself at great risk of forgetting the format one day and losing your coins too. When choosing safety measures, make sure you don't end up shooting yourself in the foot.

The keylogging malware and overlay attacks ^{(which will create a fake screen for attackers to get the victim's private wallet information)} that can execute all the forms of attack you listed are already developed. Another one is InnfiRAT malware which was detected years ago but what I believe is that we need to be careful of the environment we use the computer we use for our crypto activities, the websites we visit, use paid reputable antivirus, never share our computer, the device we use, and we need to use airgap computer for our wallet.

Thanks, have not thought about QR codes...... that is a good option to transfer data