3 ms·

Can clipboard content be exploited to run code? Something like a special OS string that escapes clipboard? Also, is there a way to patch this Chrome "feature"?

deleted 4y ago
[deleted]
SoftTalker 4y ago
Almost as bad as running code is if there is a way to read the clipboard.
bombcar 4y ago
This could be very fun on those websites that give you a code snippet to copy and paste and install oh-my-zsh and friends.
- b0ner_t0ner 4y ago
  Or on crypto DEXes where you paste in one address, the compromised exchange website shows you what you pasted with a CSS overlay but in reality, the real input field underneath has already been replaced with a Tornado Cash address, so when you submit the form, it's crypto go bye bye.
  - deleted 4y ago
    [deleted]
  - behnamoh 4y ago
    maybe we need a clipboard manager that blocks Chrome in such situations.
  - zeroclip 4y ago
    This is not even a clipboard problem. If the site is compromised, they can display the correct value in the input form, but submit the malicious value in the code that triggers the wallet transaction. The user’s wallet software can detect these by warning the user that the contract address is unknown or never before seen by them.
    - behnamoh 4y ago
      One safety measure is to enable a whitelist of trusted addresses.
- derimagia 4y ago
  If a you manually copy text then that's a "gesture". Sites are able to add malicious code when you copy text and this won't change as far as I know. In terms of security, it's horrible but not new.
tehlike 4y ago
Imagine you highlight a command and copy, but Js in the background replaces it with a malicious command.
- bzxcvbn 4y ago
  The answer is simple: don't copy/paste commands, or at the very least review what you're about to execute after pasting. Reasonable terminals give you a warning that you're about to paste multiple lines and let you read the text before okaying. Besides this is irrelevant. Websites have always been able to do what you're describing, because copying is a gesture. This bug doesn't change that.
  - Eduard 4y ago
    "the answer is simple: don't use computers"
- laundermaf 4y ago
  That has already been possible for a long time. Try copying text from a news or lyrics website and you’ll see extra junk in your clipboard.
mopsi 4y ago
Yes, it can be exploited - which is why terminals are adding confirmation steps to pasted multiline text (to avoid running the commands without user even seeing them).

deleted 4y ago

[deleted]

SoftTalker 4y ago

Almost as bad as running code is if there is a way to read the clipboard.

bombcar 4y ago

This could be very fun on those websites that give you a code snippet to copy and paste and install oh-my-zsh and friends.

b0ner_t0ner 4y ago
Or on crypto DEXes where you paste in one address, the compromised exchange website shows you what you pasted with a CSS overlay but in reality, the real input field underneath has already been replaced with a Tornado Cash address, so when you submit the form, it's crypto go bye bye.
- deleted 4y ago
  [deleted]
- behnamoh 4y ago
  maybe we need a clipboard manager that blocks Chrome in such situations.
- zeroclip 4y ago
  This is not even a clipboard problem. If the site is compromised, they can display the correct value in the input form, but submit the malicious value in the code that triggers the wallet transaction. The user’s wallet software can detect these by warning the user that the contract address is unknown or never before seen by them.
  - behnamoh 4y ago
    One safety measure is to enable a whitelist of trusted addresses.
derimagia 4y ago
If a you manually copy text then that's a "gesture". Sites are able to add malicious code when you copy text and this won't change as far as I know. In terms of security, it's horrible but not new.

tehlike 4y ago

Imagine you highlight a command and copy, but Js in the background replaces it with a malicious command.

bzxcvbn 4y ago
The answer is simple: don't copy/paste commands, or at the very least review what you're about to execute after pasting. Reasonable terminals give you a warning that you're about to paste multiple lines and let you read the text before okaying. Besides this is irrelevant. Websites have always been able to do what you're describing, because copying is a gesture. This bug doesn't change that.
- Eduard 4y ago
  "the answer is simple: don't use computers"
laundermaf 4y ago
That has already been possible for a long time. Try copying text from a news or lyrics website and you’ll see extra junk in your clipboard.

mopsi 4y ago

Yes, it can be exploited - which is why terminals are adding confirmation steps to pasted multiline text (to avoid running the commands without user even seeing them).