Hackers have started using predictive text on mobile phones to guess the seed phrase of cryptocurrency users.
Seed phrases are a random combination of words, chosen from a list of 2048 words from the Bitcoin Improvement Protocol (BIP). It is one of the main layers of security against unwanted access to digital wallets.
However, as Reddit user “u/Divinux” discovered, a mobile phone’s predictive text is capable of remember and suggest the words of the seed phrase in the correct order, which could pose a serious security problem if someone were to gain access to our smartphone without our permission.
“u/Divinux” posted on the “r/CryptoCurrency” thread that his mobile phone was able to predict the entire seed phrase just by typing the first word.
This way, anyone with access to a mobile phone can use a chat application to start typing any of the words on the BIP39 list and see what the phone suggests next.
Different keyboards, different results
Behind the user “u/Divinux” is André, a 33-year-old German computer scientist, who has used his knowledge of technology to reproduce the experiment under different circumstances. His goal is to share his experience with Reddit users, and those around the world, and to warn them of the possible consequences.
To do this, André experimented with various smartphone keyboards. In this sense, the Google's GBoard was the least vulnerable, as he was unable to predict the words in the correct order.
However, Microsoft's Swiftkey keyboard predicted the entire seed phrase just by typing the first wordSamsung’s keyboard was also able to predict words, although only when “Auto-replace” and “Suggest text corrections” had been enabled.
It might interest you: MetaMask warns of ongoing phishing attack targeting Apple users
How can we protect our cryptocurrencies from attacks?
“u/Divinux” advises users Do not keep your cryptocurrencies in hot walletsInstead, it is better to keep holdings in hardware wallets. He also advises never to invest more than you can afford to lose.
On the other hand, before sending large amounts of cryptocurrencies, it is always better to make a small transfer to the address for make sure it is correct.
Finally, it is also a good idea to disable predictive texts if you use wallets from a mobile phone.
