Hackers target Windows clipboard to steal cryptocurrency wallet addresses

New email-based malware dubbed as ComboJack is targeting Japanese and American web surfers to steal cryptocurrency during transactions. Once installed and lurking in the background, the malware grabs the victim’s long cryptocurrency wallet address stored in the Windows clipboard. Due to their extreme length, many users simply copy and paste that string of characters, and that is when ComboJack attacks. 

Discovered by researchers at the Palo Alto Networks, it’s a variant of a cryptocurrency stealer called CryptoJack. It grabs the address of a victim’s cryptocurrency wallet coped to the clipboard and replaces it with the address of the hacker’s wallet. Thus, victims believe they are transferring digital currency to their personal virtual wallets when instead they’re unknowingly pasting a different destination into the transaction prior to completion. 

CryptoShuffler was the first malware to use this stealing agent in 2017, but solely focused on Bitcoin. In 2018, ComboJack arrives to target not only Bitcoin investors, but Ethereum, Litecoin, Monero, and many other digital currencies. But the route this malware takes can be avoided by simply not opening an emailed attachment from untrusted sources.  

According to the report, victims receive emails regarding a lost passport. The shady message requests that the victim view an attachment that’s supposedly a scanned passport in a PDF format for identification purposes. But once victims open the PDF, they are presented with a single line to open an embedded document. Inside this secondary file is an embedded remote object that attacks a security hole in Windows. 

“An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory,” Microsoft’s database states. “An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.” 

The embedded remote object downloads a two-part file, one part containing a self-extracting executable, and a second part containing password-protected components to create and install the final payload: ComboJack. The malware then uses a built-in Windows tool to give it system-level privileges, edits the registry to make sure it remains running in the background and enters into an infinite loop. ComboJack then checks the system clipboard every half second for a cryptocurrency wallet address. 

So why aren’t cryptocurrency users simply manually entering their wallet addresses? Because it’s a pain. Ethereum addresses are 42 characters long while Bitcoin uses 34 characters. The longest is likely Monero, which relies on addresses with characters counts between 95 and 106. This is why users typically copy and paste their addresses, which serves as a virtual gold mine for hackers. 

While the suggestion of manually entering addresses during transactions is out of the question, opening files attached to emails sent from unknown parties is an extremely bad idea. In this case, the big clue starts with the actual poorly written message along with its suspicious attachment. But even after opening the PDF, the request to open another file should be another huge red flag.

Emerging Tech

Awesome Tech You Can’t Buy Yet: Folding canoes and ultra-fast water filters

Check out our roundup of the best new crowdfunding projects and product announcements that hit the web this week. You may not be able to buy this stuff yet, but it sure is fun to gawk!
Movies & TV

The best shows on Netflix, from 'Haunting of Hill House’ to ‘Twilight Zone’

Looking for a new show to binge? Lucky for you, we've curated a list of the best shows on Netflix, whether you're a fan of outlandish anime, dramatic period pieces, or shows that leave you questioning what lies beyond.

Windows 10 user activity logs are sent to Microsoft despite users opting out

Windows 10 Privacy settings may not be enough to stop PCs from releasing user activity data to Microsoft. Users discovered that opting out of having their data sent to Microsoft does little to prevent it from being released.

Intel's discrete graphics will be called 'Xe,' IGP gets Adapative Sync next year

Intel has officially dubbed its discrete graphics product Intel Xe, and the company also provided details about its Gen11 IGP. The latter will include adaptive sync support and will arrive in 2019.

Intel answers Qualcomm's new PC processors by pairing Core and Atom in 'Foveros'

Intel has announced a new packaging technology called 'Foveros' that makes it easier for the company to place multiple chips together on one package. That includes chips based on different Intel architectures, like Core and Atom.

Razer’s classic DeathAdder Elite gaming mouse drops to $40 on Amazon

If you're looking to pick up a new gaming mouse for the holidays, Amazon has you covered with this great deal on the classic Razer DeathAdder Elite gaming mouse with customizable buttons, RGB lighting, and a 16,000 DPI optical sensor.

Firefox 64 helps keep your numerous tabs under control

Mozilla officially launched Firefox 64 by placing new features into the laps of its users including new tab management abilities, intelligent suggestions, and a task manager for keeping Firefox's power consumption under control.

Intel's dedicated GPU is not far off -- here's what we know

Did you hear? Intel is working on a dedicated graphics card. It's called Arctic Sound and though we don't know a lot about it, we know that Intel has some ex-AMD Radeon graphics engineers developing it.

Here's our guide to how to charge your laptop using a USB-C cable

Charging via USB-C is a great way to power up your laptop. It only takes one cable and you can use the same one for data as well as power -- perfect for new devices with limited port options.

Apple MacBook Air vs. Microsoft Surface Pro 6

The MacBook Air was updated with more contemporary components and a more modern design, but is that enough to compete with standouts like Microsoft's Surface Pro 6 detachable tablet?

Installing fonts in Windows 10 is quick and easy -- just follow these steps

Want to know how to install fonts in Windows 10? Here's our guide on two easy ways to get the job done, no matter how many you want to add to your existing catalog, plus instructions for deleting fonts.

Email take-backsies! Gmail's unsend feature is one of its best

Everyone has sent a message they wish they could take back. How great would it be if you could undo that impulsive email? If you're a Gmail user, you can. Here's how to recall an email in Gmail.

These laptop makers produce the most reliable, quality hardware today

If you want to buy your next laptop based around a specific brand, it helps to know which the best brands of laptops are. This list will give you a good grounding in the most reliable, quality laptop manufacturers today.

Here's why 64-bit (not 32-bit) dominates modern computing

Today's computing world isn't the same as it once was. With 64-bit processors and operating systems replacing the older 32-bit designs, we look at what 32-bit vs. 64-bit really means for you.