2

I have read the following:

Gene is working on his laptop with several tabs open in his browser. He unlocks his MetaMask wallet to make a transaction. An attacker uses the open tabs to see that Gene is using MetaMask.

The attacker sends Gene a pop-up message saying that his transaction has failed. This happens sometimes, so Gene isn’t worried. He enters his password to remake the transaction. The attacker now has access to Gene’s wallet.

I quite don't get how an attacker uses the open tabs to see that Gene is using Metamask.

I'd appreciate it if you explain this a little bit further.

Improve this question

1 Answer 1

Reset to default
2

Before Metamask v7, the wallet extension was sharing the user selected address with every opened tabs. That means, any websites opened through these tabs could possibly track the user's transactions history and the amount of ethers/tokens held by the wallet. A malicious website could simulate the Metamask behavior by sending the user fake pop-up/notifications.

For example, the attacker could wait for the user to send a transaction and then inject a scam pop-up acting in the following way :

  • tell the transaction has failed and ask the user to sign a new one where the recipient address is the hacker address.
  • tell the user a problem has occurred and the wallet has disconnected, then ask him to enter his seed (which is needed to recover the wallet) to re-connect and process the transaction.

A novice user could be trapped by this kind of attack.

Since the v7, Metamask no longer shares the account address to visited websites without the user's consent, who must manually confirm their willingness to interact with the site.

Improve this answer
10
  • Hi clement, appreciate the answer, however I might have the same kind of questions since I quite don't get the actual scenario. So, let's say I have 3 tabs open. facebook.com, instagram.com, malicious.com. How could malicious.com track metamask's wallet's balance ? is there a code for that ? and how could malicious.com detect when user would make a transaction with metamask ? and also, why on earth would metamask give balance and history to each tab ?
    – Nika Kurashvili
    Jan 24, 2021 at 12:59
  • How could malicious.com track metamask's wallet's balance ? Metamask was injecting the account address into the navigator (more info here : github.com/MetaMask/metamask-extension/issues/6325). Then malicious.com can simply see the address information (transacions history, balances, etc) using Etherscan for example. Hopefully this has been fixed now.
    – clement
    Jan 24, 2021 at 13:12
  • Metamask only communicates the address, not transactions history and balances. But knowing an address one can track these informations, using something like Etherscan.
    – clement
    Jan 24, 2021 at 13:14
  • So metamask would put the user's address in navigator object of window . Then malicious.com website could just get it from navigator, right ? .. How would malicious.com figure out that user made a transaction in real time so that it has to quickly show up its own popup ? does it make requests to etherscan every 1 second ?
    – Nika Kurashvili
    Jan 24, 2021 at 13:16
  • I guess you can manage this with Etherscan API, or some web3 functions such as getTransactionCount for exemple.
    – clement
    Jan 24, 2021 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.