27 ms·

Pastejacking

722 points by borski 10y ago

zbuttram 10y ago
The author noted that iTerm on MacOS notifies when a paste that's about to happen contains a newline. Cmder on Windows does this as well, it's a nice feature even outside of the security concerns.
- nathancahill 10y ago
  Didn't get a confirmation on iTerm 2.1.4, Firefox 46.0.1, OSX 10.11 (latest stable everything). Not sure if I missed something.
  - firloop 10y ago
    It's only in the iTerm beta IIRC. I see it on (beta) build 2.9.20160510.
  - drodgers 10y ago
    Yeah, it's only in the beta/nightly builds at this point. I switched to the beta just for that feature; it's great.
gravypod 10y ago
I wasn't able to get this to work. Do I need to use CNTRL + C?
- ipsin 10y ago
  I had a similar experience in Chrome, pasting into gedit. Ctrl-C/Ctrl-V works, but menu copy/paste doesn't.
- jaybosamiya 10y ago
  If you read the source of the website, it has a > document.addEventListener('keydown', function(event) { ... }) Basically, press any key on your keyboard on the website, and it'll work.
- grenoire 10y ago
  You do have to use the keyboard shortcut. It executes the snippet regardless of which key sequence you press though ('keydown' event on document). It may also be because you have no support for execCommand if it didn't work for CTRL+C.
fosk 10y ago
This is one of the innumerable reasons why copying and pasting commands on the fly is wrong. This also includes the awful popular installation commands in the form of "curl -s ... | sh" - which means you are basically giving your computer in the hands of a third party.
- chrismonsanto 10y ago
  > which means you are basically giving your computer in the hands of a third party As opposed to any other installation method? Do you regularly vet the entire source code of software you install?
  - orf 10y ago
    No, but I can verify the hash of the installer before I run it though.
    - ricardobeat 10y ago
      And who provided you with the hash?
      - joombaga 10y ago
        For distro packages? Any number of alternate download sources. But I agree with your greater point; hashes are better used as a guard against file corruption than fuckery.
        chrismonsanto 10y ago
        If the program you want to install is included in your distribution's packages then this whole discussion is moot. We are talking about ways of installing from third-party sources.
  - azernik 10y ago
    I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// https:// domain, the page you're copying from also needs to be on a trusted https:// https:// domain.
rbut 10y ago
This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.
- drauh 10y ago
  Or you could "View Source"
  - bbcbasic 10y ago
    Yes look in this one first: all_ze_scripts.min.js (8mb).
    - matt_kantor 10y ago
      I think drauh meant to copy the desired text from the source view, not to reverse-engineer the page to figure out its behavior.
      - bbcbasic 10y ago
        Ah!
- nadaviv 10y ago
  Note that clever timing could get the "evil text" in your clipboard between checking in a text editor and pasting into the terminal. Hard to time correctly, but not impossible.
  - rbut 10y ago
    To solve this, browsers should probably disallow modifying the clipboard after a certain time period from the event. Eg. 500ms.
hoodoof 10y ago
So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?
- saganus 10y ago
  Although what you propose sound plausible, the only instance of this I've seen is when adding copyright notices when you save the link to am image, or when they add this warning about not stealing the work and adding proper citation. The problem I see with this scenario is that not everyone is copy-pasting from the browser into a terminal. I for example copy things to my VM's text editor first, then run the command. Other could be copy-pasting to an email for example. In those instances it would be obvious that the site is doing something not so kosher and it would be notices pretty soon I guess, depending on the site's popularit
  - tedmiston 10y ago
    The worst are the sites that add additional text when you copy eg something like a quote. Try to copy one from this site for example. http://www.brainyquote.com/quotes/authors/a/albert_einstein.html http://www.brainyquote.com/quotes/authors/a/albert_einstein....
    - userbinator 10y ago
      The big warning message I get at the top of that page is funny (emphasis and commentary mine): "Please enable Javascript This site requires Javascript be enabled to provide you the best experience [for us]. Some features [like shoving crap into your clipboard] may not be available with Javascript disabled!" It's not uncommon to find sites whose definition of "good UX" is exactly the opposite of what I want.
    - makecheck 10y ago
      Interesting; drag-and-drop bypasses that (allowing the selected text, and only the selected text, to be grabbed) but Copy using either keyboard or mouse is hijacked.
cryptoz 10y ago
There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and how you should download their apps and read more on their website. At that point, I can't be bothered to clean it up and I refuse to type out some text that I should have been able to copy. Does it really work? Do sites actually get more traffic by hijacking your keyboard's basic functions to insert advertisements? I guess it probably does. :(
- grenoire 10y ago
  I don't have data on this, but it's a significant turnoff for me. Unless I really have to share the quote, I never bother cleaning it. It doesn't bug me to the extent that I won't share it altogether (I'll just type it out or copy from Chrome devtools); yet I'll be more hesitant to share from that website from thereon.
- dawnerd 10y ago
  I had to implement this kinda code when I worked for Demand Media and it certainly worked. Whats funny is you don't need any fancy new apis to make it work. We were doing some pretty basic tactics actually. Only real way to prevent it is disable javascript.
  - mrfusion 10y ago
    You should have refused
    - akshatpradhan 10y ago
      You shouldn't refuse. You should document the privacy impact and make sure everybody is aware of the privacy implications.
    - dawnerd 10y ago
vonklaus 10y ago
I can't reproduce this in chrome or safari. I have ublock enabled, but a cmd + c gives me the bell in iterm(fail) and if I click edit copy from the drop down, the shell echos "not evil" without a line break as expected. Chrome and Safari. edit: doesn't seem to have unexpected behavior in terminal either. Am I missing something, or does uBlock default deny the scripts that can do this? edit 2: console log: Copying text command was unsuccessful. uBlock disabled.
- stepanhruda 10y ago
  Same here
spullara 10y ago
Doesn't seem to work in Safari 9.0.3. This was in the console "Copying text command was unsuccessful".
landhar 10y ago
Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?
- Unklejoe 10y ago
  On a somewhat related note: why do browsers allow websites to prevent you from leaving via those annoying dialog boxes that ask you to click "cancel" or "leave"?
  - zbuttram 10y ago
    I have seen sites that have pages where you're placed in a queue (for whatever reason) and if you leave the page you will be dropped from the queue, so it's nice to have something preventing you from accidentally leaving, but that's the only legitimate use I can think of.
    - smnscu 10y ago
      Still, that functionality should be opt-in.
      - snuxoll 10y ago
        It's really not that bad. The big problem was historically the buttons were labeled "Cancel" or "Ok", and some browsers allowed pages to customize the button labels, making which you clicked very ambiguous. Browsers today just giving "Stay on this page" and "Leave this page" buttons aren't really much of a bother if you remember how bad it used to be.
    - highphive 10y ago
      I used to work for a company whose primary product was a web server that companies could buy and run for use purely internally. Our pages involved a lot of data entry that could be lost, so that sort of pop-up can be handy in that situation as well. Of course a better solution wouldve been a program which doesnt so easily let you lose data in the first place, but this software was long past that.
pje 10y ago
Remind me again why we allow browsers to override OS copy commands?
- userbinator 10y ago
  Because the whole Web movement is trying to make browsers into the OS.
  - Cthulhu_ 10y ago
    Already done; see Chrome OS, WebOS, Firefox OS, probably others.
    - lohengramm 10y ago
      I got you, but those are actual operating systems. Regular browsers should keep being regular browsers, limits respected... This clipboard thing remembers me of the webrtc functionality that enable browsers to scan my network without asking me. Related: https://news.ycombinator.com/item?id=11407536 https://news.ycombinator.com/item?id=11407536
beardog 10y ago
I'd like to point out to everyone that isn't aware of it, this can be (sort of) done even without Javascript. Extra text can be hidden with CSS that is easily copied when highlighting other benign text, so be careful even when using Noscript. Edit: Sorry, I didn't read close enough.
- Viper007Bond 10y ago
  As mentioned in the first sentence of the second paragraph. ;)
  - beardog 10y ago
    Well, i goofed.
- colanderman 10y ago
  Don't forget the alt text of a 1×1 px image.
dschep 10y ago
Doesn't seem to affect select/middleclick X11 copy&paste.
deleted 10y ago
[deleted]
_asummers 10y ago
Are there any plugins that detect your clipboard is being manipulated and block the offending script from touching it, or perhaps prompt you? I'm thinking something like uMatrix for that class of JS. I can imagine that being a useful thing, if one doesn't already exist, both from the security standpoint and from the "don't add miscellaneous share crap" standpoint.
fu9ar 10y ago
fu9ar@traveler ~ % ^[[200~echo "evil" It works, but it also doesn't work. Usually I use the middle-click-to-paste feature, which just doesn't work at all.
tatotato 10y ago
With the gimmick of slipping the newline in aside, you can really go nuts on the ampersand.
tmcarr 10y ago
I may be the one guy using it, but I can't repro this on Safari + iTerm nightlies...
- manish_gill 10y ago
  Same here. Safari + iTerm nightly. Cmd+C/Cmd+V on other text works but for the demo the author provides, I get no content. The previous clipboard content isn't overwritten on copying "no evil".
intrasight 10y ago
On the web, I always right-click, inspect, edit html, and copy what I'm after
isaac739 10y ago
Default Terminal for OSX pasted the evil copy as expected. iTerm gave me a warning.
wtbob 10y ago
Aaand this is yet another reason to disable JavaScript. Why should a site I'm visiting be able to *$&% with my clipboard without my consent?
makecheck 10y ago
I remember adding an entire feature to my terminal to check for multi-line Paste because it was frustrating to execute something by accident. It never occurred to me that we would reach the point where the Copy itself could not even be trusted. It is time to rein in all the things that web browsers are complicit in doing at the request of random web sites. There needs to be a lot more thought put into these “APIs” that sites have access to, and a lot more scrutiny of the data.
HannibalLecter 10y ago
Firefox & Noscript win the day again.
tonyle 10y ago
This could be really horrible, especially if you use a password manager and copy and paste your password......
Mahn 10y ago
For the record you don't actually need to depend on new APIs like "document.execCommand('copy')", simply shifting focus to an off-screen textbox area when ctrl is down will do the trick in 95% of the cases, with full cross browser compatibility.
- Mandatum 10y ago
  .. Not sure this would work in OSX.
  - onion2k 10y ago
    Just use event.metaKey as well as CTRL.
- Houshalter 10y ago
  Most people copy text with right click, which would be unaffected by that. Also mobile browsers.
  - Mahn 10y ago
    I don't know that most people do that, but right click and mobile seem to bypass OP's method as well.
kevincox 10y ago
zsh actually detects pastes into the terminal and doesn't submit the commands on newlines. This way you see the full command and have to hit enter yourself to run it. It isn't perfect because people could try to obscure the command but in general it makes me a lot happier to paste commands into my terminal.
- lgas 10y ago
  This was one of the first things that made me fall in love with zsh.
- bdcravens 10y ago
  I must be doing something wrong, because I copy and paste multiple lines all the time into zsh (ohmyzsh on iTerm) and it will execute all but the last line (which generally doesn't have a new line on it)
  - kevincox 10y ago
    Maybe your terminal doesn't indicate pasted content properly. I'm using gnome-terminal and it works flawlessly.
- takluyver 10y ago
  This. I'd argue that the issue here is more with terminals and shells than web browsers: paste shouldn't immediately start executing something. The technology to not do so has been around for years - it's called bracketed paste: https://cirw.in/blog/bracketed-paste https://cirw.in/blog/bracketed-paste
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
andrepd 10y ago
The iTerm feature at the end is very thoughtful. I wish other terminals provided that feature.
GlitchMr 10y ago
How is that better than purely HTML/CSS attack (or even telling a person to use `curl blahblah | sh` command)? This particular attack doesn't work when not using keyboard to copy (think select to copy (traditional X behavior) or using a context menu), it causes text to unselect after busy loop ends, causes fans in my laptop to start working (because of busy new Date loop), causes cursor to cease changing for a certain period of time, requires me to enable JavaScript, requires support for "copy" command (which isn't universal), and requires the user to press CTRL+C either way (otherwise the webpage won't be able to copy into a clipboard). I guess you could paste an output after a certain time, but because of hijacking on Ctrl key, nothing can be copied before busy loop ends, and as a result, it doesn't prevent "pasting the command into Notepad" just to ensure it's safe - as either what previously was in pastebin or malicious command will be pasted. https://xfix.github.io/mystery-zone/command.html https://xfix.github.io/mystery-zone/command.html (disclaimer: I made this page) doesn't have any of those problems (other than requiring the user to copy text in any way (CTRL+C, text selection, context menu, whatever odd interface do you have)), and it still can break vim (and for that matter, bash, zsh (including zsh with paste protection), fish, and emacs).
Grue3 10y ago
I can't believe vim allows executing commands when pasting text. Who on earth thought it was a good idea?
- exclusiv 10y ago
  I just used it today to run 200 commands I generated from Excel.
- Nyubis 10y ago
  It's not something that vim explicitly allows, it's a side-effect of running the editor in a terminal. When you paste into a terminal, it's as if the keys are actually being pressed, rather than just text inserted. The proper way of pasting into vim, which doesn't have this problem, is "+p (as mentioned in the article).
  - oftenwrong 10y ago
    or :set paste
aruggirello 10y ago
Edit: I visited the "about:config" page, searched for "dom.event.clipboardevents.enabled", then I have set it to false, but that wasn't nearly enough. The linked PoC still works :-(
y7 10y ago
Even if browsers didn't allow changing the clipboard, there's still this older problem: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste The solution is definitely to avoid pasting commands with newlines in them into your terminal. With Vim, you can use the + register to paste (e.g. "+p). Using iTerm on OS X, I've added a custom keymap for Cmd+V, bound to Run coprocess: pbpaste | tr -d "\n" which filters out the newlines.
SFJulie 10y ago
I was like why does not it works! Then I remembered I had no script enabled, and then I remembered I don't trust JS and browsers by default, they are like OS in my OS that are way complex to be audited and they have access to way too much sensitive things (files, display, keyboard, network).
- olalonde 10y ago
  "When you’re a NoScript user and haven’t told anyone in 10 minutes" https://pbs.twimg.com/media/CWQbRunUAAAK8f6.png https://pbs.twimg.com/media/CWQbRunUAAAK8f6.png
  - SFJulie 10y ago
    Education is repetition :) Weirdly enough, I don't think noScript is the solution (it is heavy, unpractical and I dare not look the code). I am pretty awry of the evolution of the DOM + JS interaction and the new features brought in browsers that looks like both a cancer and instabilities to come.
inevitable2 10y ago
Thought I would find Mario Heiderich's presentation on the topic. Here you go : General approch to the problem of security of copy/paste buffers : https://insomnihackdotme.files.wordpress.com/2015/03/copypest.pdf https://insomnihackdotme.files.wordpress.com/2015/03/copypes...
RVuRnvbM2e 10y ago
rxvt also protects you from this by warning about multi-line pastes with the "confirm-paste" plugin
rplnt 10y ago
This was disabled by default in (classic) Opera (since it was a weird microsoft addition). Was surprised how many sites do this when I switched browsers. At the same time, it's better than those times when you had flash buttons to copy link. So I think it should be allowed to change clipboard on user's action (can it be detected?). But there certainly shouldn't be an event to change clipboard that is fired after the user copies something (selection copy, keyboard shortcut, browser ui, ..).
- Aoyagi 10y ago
  Yeah, I was wondering "This example is clearly broken, it won't copy at all". Glad I'm still using the best browser around!
gcb0 10y ago
freaking Adobe flash. in it's feature creep it added clipboard access. then web site developers thought it's a crucial feature. even github used a flash element to allow easy copy of repo url. as if anyone using git can't copy. then some moron added that to the browser, and every other moron followed. morons. copying flash...
wingless 10y ago
>How do you protect yourself? I am already using a terminal emulator that warns me when I paste multiple lines (ConEmu).
pdkl95 10y ago
> Note the newline character gets appended to the end of the line. As others have already pointed out, an API for interacting with the clipboard is a terrible idea that should be removed from the browser. However, this particular problem of pasting multi-line strings into the terminal is already a solved problem if you use rxvt-unicode. The standard package includes the perl plugin "confirm-paste"[1][2]. Enable it in ~/.Xresources URxvt.perl-ext-common: default,confirm-paste confirm-paste passes single line pastes normally, but asks for a y/n confirmation before sending a multi-line paste to the shell. [1] urxvt-confirm-paste(1) [2] http://cvs.schmorp.de/rxvt-unicode/src/perl/confirm-paste?view=markup http://cvs.schmorp.de/rxvt-unicode/src/perl/confirm-paste?vi...
upofadown 10y ago
The proof of concept didn't work on Linux (Firefox) using regular Unix style copy and paste (left button to copy, middle button to paste). So am I immune (Unix style is all I ever use) or is there a way for my browser to mess with that buffer as well?
deleted 10y ago
[deleted]
DoubleMalt 10y ago
Well once more I'm happy to browse with noscript by default ;)
awalGarg 10y ago
Shameless self plug Just wrote https://github.com/awalGarg/realcopy https://github.com/awalGarg/realcopy to "counter" this. Plan to add for FF as well.
commentereleven 10y ago
"Note that if I can get you to "su and say" something just by asking, you have a very serious security problem on your system and you should look into it." - Paul Vixie, vixie-cron INSTALL file (https://github.com/rhuitl/uClinux/blob/master/user/vixie-cron/INSTALL https://github.com/rhuitl/uClinux/blob/master/user/vixie-cro...)
hrjet 10y ago
> It should also be noted, for some time similar attacks have been possible via html/css [1] As it happens, this particular attack doesn't work in gngr [0]. The example uses an absolute positioned div to put extra text out of viewport, which is not picked up by gngr when selecting text. gngr also doesn't enable Javascript by default, so attacks such as that described in OP are not possible from random site visits. (I recommend uBlock / uMatrix for other browsers). However, the attack surface is really quite large here. CSS directives such as `opacity: 0.001` could be easily used to mask extra text. [0]: https://gngr.info/ and https://github.com/UprootLabs/gngr [1]: https://thejh.net/misc/website-terminal-copy-paste
gsiris 10y ago
Dragging the selected text to somewhere else before copying reveals the actual text to be copied (at least on Firefox): http://i.imgur.com/A7VIWtX.png http://i.imgur.com/A7VIWtX.png
ohstopitu 10y ago
This is not the first time this has come up. In fact I wrote an article a while back on how to use this for something legitimate [1] (including mobile support). It is far easier to execute on the desktop (by watching for the control key press, then creating a hidden div that contains the text to be copied + malicious code if necessary). [1] https://sonalkeshav.me/2015/08/30/html5-clipboard-api/ https://sonalkeshav.me/2015/08/30/html5-clipboard-api/
romaniv 10y ago
The full reach of this issue might not be limited to just text. It might be possible to mess with scripts in programs like Word by abusing rich text, macros and styles: https://www.youtube.com/watch?v=LoORMRbptTg https://www.youtube.com/watch?v=LoORMRbptTg
mavus 10y ago
Quite nicely iTerm2 will catch when you attempt to paste new line characters and warn you about it. Mostly it's useful when I've accidentally copied an extra line, but protecting against malicious abuse is a useful plus. http://imgur.com/hPMtbU2 http://imgur.com/hPMtbU2
jrmiii 10y ago
If you use a clipboard manager (I use the one built into LaunchBar) you can preview the contents of the clipboard without having to paste into a text editor. It takes seconds and is a good habit to develop.
makecheck 10y ago
Since operating systems can “quarantine” downloaded files, it seems perfectly reasonable to also quarantine data that can be arbitrarily modified by remote APIs. This is doubly true when there are all kinds of ways for web sites to trick the user into visiting domains they don’t really know that they “requested”. On the Mac, applications downloaded from the Internet are quarantined; they stay that way until you accept a warning message displayed at first launch (even if you wait days to launch it for the first time). The OS helpfully remembers where the file came from, e.g. “This was downloaded from www.notmalware.com on July 6, 2000.”. If a web browser insists on allowing web-controlled Copy behavior, the resulting pasteboard should be given a big, black TAINTED mark that cannot be cleared without a very explicit action. If I go to another application and try to Paste, the other application should not be able to access the data without clearing the quarantine (e.g. OS provides standard dialog that shows the entire text and web site of origin, free of any white text-coloring or Unicode invisibility tricks).
Razengan 10y ago
[1] is not working on OS X 10.11.5 / barebones Safari 9.1.1 (11601.6.17) [1] https://security.love/Pastejacking/ https://security.love/Pastejacking/
dcgoss 10y ago
This is somewhat terrifying. My fear is that a prankster will make the pasted command be `rm -rf / \n'

722 points by borski 10y ago

The author noted that iTerm on MacOS notifies when a paste that's about to happen contains a newline. Cmder on Windows does this as well, it's a nice feature even outside of the security concerns.

nathancahill 10y ago
Didn't get a confirmation on iTerm 2.1.4, Firefox 46.0.1, OSX 10.11 (latest stable everything). Not sure if I missed something.
- firloop 10y ago
  It's only in the iTerm beta IIRC. I see it on (beta) build 2.9.20160510.
- drodgers 10y ago
  Yeah, it's only in the beta/nightly builds at this point. I switched to the beta just for that feature; it's great.

gravypod 10y ago

I wasn't able to get this to work. Do I need to use CNTRL + C?

ipsin 10y ago
I had a similar experience in Chrome, pasting into gedit. Ctrl-C/Ctrl-V works, but menu copy/paste doesn't.
jaybosamiya 10y ago
If you read the source of the website, it has a > document.addEventListener('keydown', function(event) { ... }) Basically, press any key on your keyboard on the website, and it'll work.
grenoire 10y ago
You do have to use the keyboard shortcut. It executes the snippet regardless of which key sequence you press though ('keydown' event on document). It may also be because you have no support for execCommand if it didn't work for CTRL+C.

fosk 10y ago

This is one of the innumerable reasons why copying and pasting commands on the fly is wrong. This also includes the awful popular installation commands in the form of "curl -s ... | sh" - which means you are basically giving your computer in the hands of a third party.

chrismonsanto 10y ago
> which means you are basically giving your computer in the hands of a third party As opposed to any other installation method? Do you regularly vet the entire source code of software you install?
- orf 10y ago
  No, but I can verify the hash of the installer before I run it though.
  - ricardobeat 10y ago
    And who provided you with the hash?
    - joombaga 10y ago
      For distro packages? Any number of alternate download sources. But I agree with your greater point; hashes are better used as a guard against file corruption than fuckery.
      - chrismonsanto 10y ago
        If the program you want to install is included in your distribution's packages then this whole discussion is moot. We are talking about ways of installing from third-party sources.
- azernik 10y ago
  I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// https:// domain, the page you're copying from also needs to be on a trusted https:// https:// domain.

rbut 10y ago

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.

drauh 10y ago
Or you could "View Source"
- bbcbasic 10y ago
  Yes look in this one first: all_ze_scripts.min.js (8mb).
  - matt_kantor 10y ago
    I think drauh meant to copy the desired text from the source view, not to reverse-engineer the page to figure out its behavior.
    - bbcbasic 10y ago
      Ah!
nadaviv 10y ago
Note that clever timing could get the "evil text" in your clipboard between checking in a text editor and pasting into the terminal. Hard to time correctly, but not impossible.
- rbut 10y ago
  To solve this, browsers should probably disallow modifying the clipboard after a certain time period from the event. Eg. 500ms.

hoodoof 10y ago

So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?

saganus 10y ago
Although what you propose sound plausible, the only instance of this I've seen is when adding copyright notices when you save the link to am image, or when they add this warning about not stealing the work and adding proper citation. The problem I see with this scenario is that not everyone is copy-pasting from the browser into a terminal. I for example copy things to my VM's text editor first, then run the command. Other could be copy-pasting to an email for example. In those instances it would be obvious that the site is doing something not so kosher and it would be notices pretty soon I guess, depending on the site's popularit
- tedmiston 10y ago
  The worst are the sites that add additional text when you copy eg something like a quote. Try to copy one from this site for example. http://www.brainyquote.com/quotes/authors/a/albert_einstein.html http://www.brainyquote.com/quotes/authors/a/albert_einstein....
  - userbinator 10y ago
    The big warning message I get at the top of that page is funny (emphasis and commentary mine): "Please enable Javascript This site requires Javascript be enabled to provide you the best experience [for us]. Some features [like shoving crap into your clipboard] may not be available with Javascript disabled!" It's not uncommon to find sites whose definition of "good UX" is exactly the opposite of what I want.
  - makecheck 10y ago
    Interesting; drag-and-drop bypasses that (allowing the selected text, and only the selected text, to be grabbed) but Copy using either keyboard or mouse is hijacked.

cryptoz 10y ago

There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and how you should download their apps and read more on their website. At that point, I can't be bothered to clean it up and I refuse to type out some text that I should have been able to copy. Does it really work? Do sites actually get more traffic by hijacking your keyboard's basic functions to insert advertisements? I guess it probably does. :(

grenoire 10y ago
I don't have data on this, but it's a significant turnoff for me. Unless I really have to share the quote, I never bother cleaning it. It doesn't bug me to the extent that I won't share it altogether (I'll just type it out or copy from Chrome devtools); yet I'll be more hesitant to share from that website from thereon.
dawnerd 10y ago
I had to implement this kinda code when I worked for Demand Media and it certainly worked. Whats funny is you don't need any fancy new apis to make it work. We were doing some pretty basic tactics actually. Only real way to prevent it is disable javascript.
- mrfusion 10y ago
  You should have refused
  - akshatpradhan 10y ago
    You shouldn't refuse. You should document the privacy impact and make sure everybody is aware of the privacy implications.
  - dawnerd 10y ago

vonklaus 10y ago

I can't reproduce this in chrome or safari. I have ublock enabled, but a cmd + c gives me the bell in iterm(fail) and if I click edit copy from the drop down, the shell echos "not evil" without a line break as expected. Chrome and Safari. edit: doesn't seem to have unexpected behavior in terminal either. Am I missing something, or does uBlock default deny the scripts that can do this? edit 2: console log: Copying text command was unsuccessful. uBlock disabled.

stepanhruda 10y ago
Same here

spullara 10y ago

Doesn't seem to work in Safari 9.0.3. This was in the console "Copying text command was unsuccessful".

landhar 10y ago

Why do browsers not require explicit user permission before allowing a site to perform clipboard manipulations? In a similar tashion to how the HTML5 geo-location API is opt-in?

Unklejoe 10y ago
On a somewhat related note: why do browsers allow websites to prevent you from leaving via those annoying dialog boxes that ask you to click "cancel" or "leave"?
- zbuttram 10y ago
  I have seen sites that have pages where you're placed in a queue (for whatever reason) and if you leave the page you will be dropped from the queue, so it's nice to have something preventing you from accidentally leaving, but that's the only legitimate use I can think of.
  - smnscu 10y ago
    Still, that functionality should be opt-in.
    - snuxoll 10y ago
      It's really not that bad. The big problem was historically the buttons were labeled "Cancel" or "Ok", and some browsers allowed pages to customize the button labels, making which you clicked very ambiguous. Browsers today just giving "Stay on this page" and "Leave this page" buttons aren't really much of a bother if you remember how bad it used to be.
  - highphive 10y ago
    I used to work for a company whose primary product was a web server that companies could buy and run for use purely internally. Our pages involved a lot of data entry that could be lost, so that sort of pop-up can be handy in that situation as well. Of course a better solution wouldve been a program which doesnt so easily let you lose data in the first place, but this software was long past that.

pje 10y ago

Remind me again why we allow browsers to override OS copy commands?

userbinator 10y ago
Because the whole Web movement is trying to make browsers into the OS.
- Cthulhu_ 10y ago
  Already done; see Chrome OS, WebOS, Firefox OS, probably others.
  - lohengramm 10y ago
    I got you, but those are actual operating systems. Regular browsers should keep being regular browsers, limits respected... This clipboard thing remembers me of the webrtc functionality that enable browsers to scan my network without asking me. Related: https://news.ycombinator.com/item?id=11407536 https://news.ycombinator.com/item?id=11407536

beardog 10y ago

I'd like to point out to everyone that isn't aware of it, this can be (sort of) done even without Javascript. Extra text can be hidden with CSS that is easily copied when highlighting other benign text, so be careful even when using Noscript. Edit: Sorry, I didn't read close enough.

Viper007Bond 10y ago
As mentioned in the first sentence of the second paragraph. ;)
- beardog 10y ago
  Well, i goofed.
colanderman 10y ago
Don't forget the alt text of a 1×1 px image.

dschep 10y ago

Doesn't seem to affect select/middleclick X11 copy&paste.

deleted 10y ago

[deleted]

_asummers 10y ago

Are there any plugins that detect your clipboard is being manipulated and block the offending script from touching it, or perhaps prompt you? I'm thinking something like uMatrix for that class of JS. I can imagine that being a useful thing, if one doesn't already exist, both from the security standpoint and from the "don't add miscellaneous share crap" standpoint.

fu9ar 10y ago

fu9ar@traveler ~ % ^[[200~echo "evil" It works, but it also doesn't work. Usually I use the middle-click-to-paste feature, which just doesn't work at all.

tatotato 10y ago

With the gimmick of slipping the newline in aside, you can really go nuts on the ampersand.

tmcarr 10y ago

I may be the one guy using it, but I can't repro this on Safari + iTerm nightlies...

manish_gill 10y ago
Same here. Safari + iTerm nightly. Cmd+C/Cmd+V on other text works but for the demo the author provides, I get no content. The previous clipboard content isn't overwritten on copying "no evil".

intrasight 10y ago

On the web, I always right-click, inspect, edit html, and copy what I'm after

isaac739 10y ago

Default Terminal for OSX pasted the evil copy as expected. iTerm gave me a warning.

wtbob 10y ago

Aaand this is yet another reason to disable JavaScript. Why should a site I'm visiting be able to *$&% with my clipboard without my consent?

makecheck 10y ago

I remember adding an entire feature to my terminal to check for multi-line Paste because it was frustrating to execute something by accident. It never occurred to me that we would reach the point where the Copy itself could not even be trusted. It is time to rein in all the things that web browsers are complicit in doing at the request of random web sites. There needs to be a lot more thought put into these “APIs” that sites have access to, and a lot more scrutiny of the data.

HannibalLecter 10y ago

Firefox & Noscript win the day again.

tonyle 10y ago

This could be really horrible, especially if you use a password manager and copy and paste your password......

Mahn 10y ago

For the record you don't actually need to depend on new APIs like "document.execCommand('copy')", simply shifting focus to an off-screen textbox area when ctrl is down will do the trick in 95% of the cases, with full cross browser compatibility.

Mandatum 10y ago
.. Not sure this would work in OSX.
- onion2k 10y ago
  Just use event.metaKey as well as CTRL.
Houshalter 10y ago
Most people copy text with right click, which would be unaffected by that. Also mobile browsers.
- Mahn 10y ago
  I don't know that most people do that, but right click and mobile seem to bypass OP's method as well.

kevincox 10y ago

zsh actually detects pastes into the terminal and doesn't submit the commands on newlines. This way you see the full command and have to hit enter yourself to run it. It isn't perfect because people could try to obscure the command but in general it makes me a lot happier to paste commands into my terminal.

lgas 10y ago
This was one of the first things that made me fall in love with zsh.
bdcravens 10y ago
I must be doing something wrong, because I copy and paste multiple lines all the time into zsh (ohmyzsh on iTerm) and it will execute all but the last line (which generally doesn't have a new line on it)
- kevincox 10y ago
  Maybe your terminal doesn't indicate pasted content properly. I'm using gnome-terminal and it works flawlessly.
takluyver 10y ago
This. I'd argue that the issue here is more with terminals and shells than web browsers: paste shouldn't immediately start executing something. The technology to not do so has been around for years - it's called bracketed paste: https://cirw.in/blog/bracketed-paste https://cirw.in/blog/bracketed-paste

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

andrepd 10y ago

The iTerm feature at the end is very thoughtful. I wish other terminals provided that feature.

GlitchMr 10y ago

How is that better than purely HTML/CSS attack (or even telling a person to use `curl blahblah | sh` command)? This particular attack doesn't work when not using keyboard to copy (think select to copy (traditional X behavior) or using a context menu), it causes text to unselect after busy loop ends, causes fans in my laptop to start working (because of busy new Date loop), causes cursor to cease changing for a certain period of time, requires me to enable JavaScript, requires support for "copy" command (which isn't universal), and requires the user to press CTRL+C either way (otherwise the webpage won't be able to copy into a clipboard). I guess you could paste an output after a certain time, but because of hijacking on Ctrl key, nothing can be copied before busy loop ends, and as a result, it doesn't prevent "pasting the command into Notepad" just to ensure it's safe - as either what previously was in pastebin or malicious command will be pasted. https://xfix.github.io/mystery-zone/command.html https://xfix.github.io/mystery-zone/command.html (disclaimer: I made this page) doesn't have any of those problems (other than requiring the user to copy text in any way (CTRL+C, text selection, context menu, whatever odd interface do you have)), and it still can break vim (and for that matter, bash, zsh (including zsh with paste protection), fish, and emacs).

Grue3 10y ago

I can't believe vim allows executing commands when pasting text. Who on earth thought it was a good idea?

exclusiv 10y ago
I just used it today to run 200 commands I generated from Excel.
Nyubis 10y ago
It's not something that vim explicitly allows, it's a side-effect of running the editor in a terminal. When you paste into a terminal, it's as if the keys are actually being pressed, rather than just text inserted. The proper way of pasting into vim, which doesn't have this problem, is "+p (as mentioned in the article).
- oftenwrong 10y ago
  or :set paste

aruggirello 10y ago

Edit: I visited the "about:config" page, searched for "dom.event.clipboardevents.enabled", then I have set it to false, but that wasn't nearly enough. The linked PoC still works :-(

y7 10y ago

Even if browsers didn't allow changing the clipboard, there's still this older problem: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste The solution is definitely to avoid pasting commands with newlines in them into your terminal. With Vim, you can use the + register to paste (e.g. "+p). Using iTerm on OS X, I've added a custom keymap for Cmd+V, bound to Run coprocess: pbpaste | tr -d "\n" which filters out the newlines.

SFJulie 10y ago

I was like why does not it works! Then I remembered I had no script enabled, and then I remembered I don't trust JS and browsers by default, they are like OS in my OS that are way complex to be audited and they have access to way too much sensitive things (files, display, keyboard, network).

olalonde 10y ago
"When you’re a NoScript user and haven’t told anyone in 10 minutes" https://pbs.twimg.com/media/CWQbRunUAAAK8f6.png https://pbs.twimg.com/media/CWQbRunUAAAK8f6.png
- SFJulie 10y ago
  Education is repetition :) Weirdly enough, I don't think noScript is the solution (it is heavy, unpractical and I dare not look the code). I am pretty awry of the evolution of the DOM + JS interaction and the new features brought in browsers that looks like both a cancer and instabilities to come.

inevitable2 10y ago

Thought I would find Mario Heiderich's presentation on the topic. Here you go : General approch to the problem of security of copy/paste buffers : https://insomnihackdotme.files.wordpress.com/2015/03/copypest.pdf https://insomnihackdotme.files.wordpress.com/2015/03/copypes...

RVuRnvbM2e 10y ago

rxvt also protects you from this by warning about multi-line pastes with the "confirm-paste" plugin

rplnt 10y ago

This was disabled by default in (classic) Opera (since it was a weird microsoft addition). Was surprised how many sites do this when I switched browsers. At the same time, it's better than those times when you had flash buttons to copy link. So I think it should be allowed to change clipboard on user's action (can it be detected?). But there certainly shouldn't be an event to change clipboard that is fired after the user copies something (selection copy, keyboard shortcut, browser ui, ..).

Aoyagi 10y ago
Yeah, I was wondering "This example is clearly broken, it won't copy at all". Glad I'm still using the best browser around!

gcb0 10y ago

freaking Adobe flash. in it's feature creep it added clipboard access. then web site developers thought it's a crucial feature. even github used a flash element to allow easy copy of repo url. as if anyone using git can't copy. then some moron added that to the browser, and every other moron followed. morons. copying flash...

wingless 10y ago

>How do you protect yourself? I am already using a terminal emulator that warns me when I paste multiple lines (ConEmu).

pdkl95 10y ago

> Note the newline character gets appended to the end of the line. As others have already pointed out, an API for interacting with the clipboard is a terrible idea that should be removed from the browser. However, this particular problem of pasting multi-line strings into the terminal is already a solved problem if you use rxvt-unicode. The standard package includes the perl plugin "confirm-paste"[1][2]. Enable it in ~/.Xresources URxvt.perl-ext-common: default,confirm-paste confirm-paste passes single line pastes normally, but asks for a y/n confirmation before sending a multi-line paste to the shell. [1] urxvt-confirm-paste(1) [2] http://cvs.schmorp.de/rxvt-unicode/src/perl/confirm-paste?view=markup http://cvs.schmorp.de/rxvt-unicode/src/perl/confirm-paste?vi...

upofadown 10y ago

The proof of concept didn't work on Linux (Firefox) using regular Unix style copy and paste (left button to copy, middle button to paste). So am I immune (Unix style is all I ever use) or is there a way for my browser to mess with that buffer as well?

deleted 10y ago

[deleted]

DoubleMalt 10y ago

Well once more I'm happy to browse with noscript by default ;)

awalGarg 10y ago

Shameless self plug Just wrote https://github.com/awalGarg/realcopy https://github.com/awalGarg/realcopy to "counter" this. Plan to add for FF as well.

commentereleven 10y ago

"Note that if I can get you to "su and say" something just by asking, you have a very serious security problem on your system and you should look into it." - Paul Vixie, vixie-cron INSTALL file (https://github.com/rhuitl/uClinux/blob/master/user/vixie-cron/INSTALL https://github.com/rhuitl/uClinux/blob/master/user/vixie-cro...)

hrjet 10y ago

> It should also be noted, for some time similar attacks have been possible via html/css [1] As it happens, this particular attack doesn't work in gngr [0]. The example uses an absolute positioned div to put extra text out of viewport, which is not picked up by gngr when selecting text. gngr also doesn't enable Javascript by default, so attacks such as that described in OP are not possible from random site visits. (I recommend uBlock / uMatrix for other browsers). However, the attack surface is really quite large here. CSS directives such as `opacity: 0.001` could be easily used to mask extra text. [0]: https://gngr.info/ and https://github.com/UprootLabs/gngr [1]: https://thejh.net/misc/website-terminal-copy-paste

gsiris 10y ago

Dragging the selected text to somewhere else before copying reveals the actual text to be copied (at least on Firefox): http://i.imgur.com/A7VIWtX.png http://i.imgur.com/A7VIWtX.png

ohstopitu 10y ago

This is not the first time this has come up. In fact I wrote an article a while back on how to use this for something legitimate [1] (including mobile support). It is far easier to execute on the desktop (by watching for the control key press, then creating a hidden div that contains the text to be copied + malicious code if necessary). [1] https://sonalkeshav.me/2015/08/30/html5-clipboard-api/ https://sonalkeshav.me/2015/08/30/html5-clipboard-api/

romaniv 10y ago

The full reach of this issue might not be limited to just text. It might be possible to mess with scripts in programs like Word by abusing rich text, macros and styles: https://www.youtube.com/watch?v=LoORMRbptTg https://www.youtube.com/watch?v=LoORMRbptTg

mavus 10y ago

Quite nicely iTerm2 will catch when you attempt to paste new line characters and warn you about it. Mostly it's useful when I've accidentally copied an extra line, but protecting against malicious abuse is a useful plus. http://imgur.com/hPMtbU2 http://imgur.com/hPMtbU2

jrmiii 10y ago

If you use a clipboard manager (I use the one built into LaunchBar) you can preview the contents of the clipboard without having to paste into a text editor. It takes seconds and is a good habit to develop.

makecheck 10y ago

Since operating systems can “quarantine” downloaded files, it seems perfectly reasonable to also quarantine data that can be arbitrarily modified by remote APIs. This is doubly true when there are all kinds of ways for web sites to trick the user into visiting domains they don’t really know that they “requested”. On the Mac, applications downloaded from the Internet are quarantined; they stay that way until you accept a warning message displayed at first launch (even if you wait days to launch it for the first time). The OS helpfully remembers where the file came from, e.g. “This was downloaded from www.notmalware.com on July 6, 2000.”. If a web browser insists on allowing web-controlled Copy behavior, the resulting pasteboard should be given a big, black TAINTED mark that cannot be cleared without a very explicit action. If I go to another application and try to Paste, the other application should not be able to access the data without clearing the quarantine (e.g. OS provides standard dialog that shows the entire text and web site of origin, free of any white text-coloring or Unicode invisibility tricks).

Razengan 10y ago

[1] is not working on OS X 10.11.5 / barebones Safari 9.1.1 (11601.6.17) [1] https://security.love/Pastejacking/ https://security.love/Pastejacking/

dcgoss 10y ago

This is somewhat terrifying. My fear is that a prankster will make the pasted command be `rm -rf / \n'