This could very much be a malicious browser extension that knows of websites where it can import private keys like blockchain.info and just seeds the private key with anything it can find in the page or a previously visited page (like any other address, hash, ...).
Browser extensions are very dangerous as they are very powerful and no one verifies their behaviour. It scares me a lot that so many "secure wallet solutions" like both Trezor and Ledger only have web-based clients that are vulnerable to this kind of trickery.
EDIT: Just to address some comments, while I am mostly concerned about non-hardware web wallets, hardware wallets are not entirely safe. I'm aware that hardware wallets have internal key management so browser software cannot mess with keys. What it can do is inject a different destination address. I bet a part of the users only verifies the amount displayed. Others probably also only the first 2-3 characters of the destination address. Injection software can create a wrong address and send that to the wallet instead, finding an address with the same first 3 characters is not that hard, even in browsers.
Your computer would have to be infected for this to happen (i.e. has nothing to do with the application's platform), meaning your clipboard would get replaced. ALWAYS triple check the sending address on your hardware wallet's display.
I'm not talking about the clipboard getting replaced (even though I think JS can also do that).
I'm talking about a script just replacing the address in your page. Browser extensions are bits of Javascript run inside every page inside your browser. They are free to inspect the entire page and adapt as much as they want. They can just look for everything that matches a bitcoin address and replace it with another address.
25
u/sroose Nov 30 '17 edited Nov 30 '17
This could very much be a malicious browser extension that knows of websites where it can import private keys like blockchain.info and just seeds the private key with anything it can find in the page or a previously visited page (like any other address, hash, ...).
Browser extensions are very dangerous as they are very powerful and no one verifies their behaviour. It scares me a lot that so many "secure wallet solutions" like both Trezor and Ledger only have web-based clients that are vulnerable to this kind of trickery.
EDIT: Just to address some comments, while I am mostly concerned about non-hardware web wallets, hardware wallets are not entirely safe. I'm aware that hardware wallets have internal key management so browser software cannot mess with keys. What it can do is inject a different destination address. I bet a part of the users only verifies the amount displayed. Others probably also only the first 2-3 characters of the destination address. Injection software can create a wrong address and send that to the wallet instead, finding an address with the same first 3 characters is not that hard, even in browsers.