4 ms·

I believe the real problem lies in the fact that Flash can actually put things in your clipboard. There should be a security configuration in Flash that makes t

by Rygu 15y ago

I believe the real problem lies in the fact that Flash can actually put things in your clipboard. There should be a security configuration in Flash that makes this clipboard "feature" disabled by default, or at least it should alert the user when the new clipboard content contains malicious code. Another thing that Facebook can do, is detect Wall-spamming and require the user to confirm that (s)he really wants to spam all his/her friends.

eurleif 15y ago
>Another thing that Facebook can do, is detect Wall-spamming and require the user to confirm that (s)he really wants to spam all his/her friends. The XSS code could just be modified to automatically confirm its actions.
- lancefisher 15y ago
  Not if it required a captcha.
  - eurleif 15y ago
    The XSS could change the text explaining the CAPTCHA and socially engineer people into solving it.
  - jQueryIsAwesome 15y ago
    But then the 'evil script' would select all his friends minus one; or maybe just send messages one by one. The only real way to eradicate this problem is what he is already trying to do: educate the users.
  - callahad 15y ago
    But at that point, you're already working with a user that's fallen victim to social engineering. The script could likely find a way to present the captchas that would similarly fool the user into completing them.
    - mkjones 15y ago
      They could just tell the user that the captcha is part of the "security check" the user must do to see if they're in the 2% or whatever. Users will do almost anything if you instruct them well enough.
mkjones 15y ago
Agreed that it's unfortunate that flash can write to your clipboard. The only place I've seen that used legitimately is on bit.ly so they can copy the shortened link to your clipboard. Even there, I usually end up confused about what happened and manually copy it anyway. As far as things we could do at Facebook, we definitely work to detect wall spamming. We end up blocking this kind of spam a lot the time, but there's always room for improvement.
- codejoust 15y ago
  How about running the facebook javascript in a sandbox? Such as proxying the document.createElement and document.getElements* methods for the initial script while breaking it for everything else?
  - mkjones 15y ago
    That's a good idea, and we actually thought about that. But assuming we need those APIs, what's to keep them from calling our wrappers around them? Put another way, how do we determine if the caller of some of our js is malicious or is us?
    - jQueryIsAwesome 15y ago
      It just needs to be non-predictable. Give the wrapper object and ALL his methods a random name for every session.
boucher 15y ago
Being able to put things on the clipboard programmatically is a really useful feature. It's actually quite sad that you need flash to do this reliably. Disabling javascript: urls in the address bar seems like a much better way to mitigate this problem.
- Me1000 15y ago
  While I agree being able to access the clipboard without flash would be very useful, I don't think disabling javascript URLs are a good idea either... A lot of very interesting and useful things can be done with bookmarklets. I suppose given the tradeoffs I'd choose clipboard access over bookmarklets though.
  - davej 15y ago
    You're not disabling bookmarklets by preventing people from copy/pasting javascript into their address bar. Bookmarklets still work they just can't be executed directly from the address bar.
    - Too 15y ago
      Replace instructions with: 1. Drag this icon to your favorites bar. 2. Click it. Might not have the same turnover as the paste-trick but will definitely catch at least 50% of those the other method does. Though IE will warn the user that this is dangerous in step 1 but other browsers doesn't. Bookmarklets are good but the security model is very fragile. A new concept of widgets has to be introduced in browsers. Kindof like IE8's "web-snippets" but with more power and some sandboxed interface between the widget and the current website. For power users and trusted widgets you should be able to disable the barriers completely to get the same functionality as today, but as opposed to today, this should require a user warning at least on bookmarklet install.
forgotusername 15y ago
If you nail down clipboard access then it'll just turn into 'drag and drop this to your address bar'. If you nail that down, well, I'm stumped just now, but there's no doubt a few more ways to trigger it. I think the blame lies with the address bar. If you think about it, it's a bit like having a magic key sequence on your car radio that drops you into the engine management system debugger.
rplnt 15y ago
Javascript can put things in your clipboard as well. Well, to clarify.. it's Microsoft's extension to javascript. Unfortunately supported by both Chrome and Firefox. Two of the most popular "alternative" browsers. I think that Safari anad Opera are clean when it comes to this "flaw" (which others call feature of course). Why flaw you ask? It can edit your clipboard content on "copy" and "paste" action. So you just select text, press ctrl+c and end up with some malicious link in your clipboard.
- Timothee 15y ago
  There are two different things: one is modifying the clipboard from JavaScript. IE used to be able to do that, I don't know if it's still the case. I'd be very surprised if Chrome allowed that… The second thing is modifying the selection through JavaScript which is indeed possible. However, removing that ability doesn't really solve your problem because you could imagine having white small text embedded wherever you select which would end up in your clipboard without your knowledge.

by Rygu 15y ago

eurleif 15y ago

>Another thing that Facebook can do, is detect Wall-spamming and require the user to confirm that (s)he really wants to spam all his/her friends. The XSS code could just be modified to automatically confirm its actions.

lancefisher 15y ago
Not if it required a captcha.
- eurleif 15y ago
  The XSS could change the text explaining the CAPTCHA and socially engineer people into solving it.
- jQueryIsAwesome 15y ago
  But then the 'evil script' would select all his friends minus one; or maybe just send messages one by one. The only real way to eradicate this problem is what he is already trying to do: educate the users.
- callahad 15y ago
  But at that point, you're already working with a user that's fallen victim to social engineering. The script could likely find a way to present the captchas that would similarly fool the user into completing them.
  - mkjones 15y ago
    They could just tell the user that the captcha is part of the "security check" the user must do to see if they're in the 2% or whatever. Users will do almost anything if you instruct them well enough.

mkjones 15y ago

Agreed that it's unfortunate that flash can write to your clipboard. The only place I've seen that used legitimately is on bit.ly so they can copy the shortened link to your clipboard. Even there, I usually end up confused about what happened and manually copy it anyway. As far as things we could do at Facebook, we definitely work to detect wall spamming. We end up blocking this kind of spam a lot the time, but there's always room for improvement.

codejoust 15y ago
How about running the facebook javascript in a sandbox? Such as proxying the document.createElement and document.getElements* methods for the initial script while breaking it for everything else?
- mkjones 15y ago
  That's a good idea, and we actually thought about that. But assuming we need those APIs, what's to keep them from calling our wrappers around them? Put another way, how do we determine if the caller of some of our js is malicious or is us?
  - jQueryIsAwesome 15y ago
    It just needs to be non-predictable. Give the wrapper object and ALL his methods a random name for every session.

boucher 15y ago

Being able to put things on the clipboard programmatically is a really useful feature. It's actually quite sad that you need flash to do this reliably. Disabling javascript: urls in the address bar seems like a much better way to mitigate this problem.

Me1000 15y ago
While I agree being able to access the clipboard without flash would be very useful, I don't think disabling javascript URLs are a good idea either... A lot of very interesting and useful things can be done with bookmarklets. I suppose given the tradeoffs I'd choose clipboard access over bookmarklets though.
- davej 15y ago
  You're not disabling bookmarklets by preventing people from copy/pasting javascript into their address bar. Bookmarklets still work they just can't be executed directly from the address bar.
  - Too 15y ago
    Replace instructions with: 1. Drag this icon to your favorites bar. 2. Click it. Might not have the same turnover as the paste-trick but will definitely catch at least 50% of those the other method does. Though IE will warn the user that this is dangerous in step 1 but other browsers doesn't. Bookmarklets are good but the security model is very fragile. A new concept of widgets has to be introduced in browsers. Kindof like IE8's "web-snippets" but with more power and some sandboxed interface between the widget and the current website. For power users and trusted widgets you should be able to disable the barriers completely to get the same functionality as today, but as opposed to today, this should require a user warning at least on bookmarklet install.

forgotusername 15y ago

If you nail down clipboard access then it'll just turn into 'drag and drop this to your address bar'. If you nail that down, well, I'm stumped just now, but there's no doubt a few more ways to trigger it. I think the blame lies with the address bar. If you think about it, it's a bit like having a magic key sequence on your car radio that drops you into the engine management system debugger.

rplnt 15y ago

Javascript can put things in your clipboard as well. Well, to clarify.. it's Microsoft's extension to javascript. Unfortunately supported by both Chrome and Firefox. Two of the most popular "alternative" browsers. I think that Safari anad Opera are clean when it comes to this "flaw" (which others call feature of course). Why flaw you ask? It can edit your clipboard content on "copy" and "paste" action. So you just select text, press ctrl+c and end up with some malicious link in your clipboard.

Timothee 15y ago
There are two different things: one is modifying the clipboard from JavaScript. IE used to be able to do that, I don't know if it's still the case. I'd be very surprised if Chrome allowed that… The second thing is modifying the selection through JavaScript which is indeed possible. However, removing that ability doesn't really solve your problem because you could imagine having white small text embedded wherever you select which would end up in your clipboard without your knowledge.