4 ms·

There was some discussion of this over on Reddit. I didn't see evidence of it, but the claim was that this had already happened. I'd be curious if someone had s

There was some discussion of this over on Reddit. I didn't see evidence of it, but the claim was that this had already happened. I'd be curious if someone had some examples of it in the wild.

throwup 4y ago
This particular clipboard attack has been part of malware for at least 5 years, maybe 10. But I haven't heard of it being distributed via a package manager until now.
- louislang 4y ago
  Oh I meant malware generating addresses that look directionally similar to the address the user expects (as opposed to a random address that's hardcoded). I'm not sure if this is a thing, or just conjecture from others.
anonporridge 4y ago
It could be very hard to prove after the fact. And it's generally much more likely that human error causes a loss than to be victim to a malicious attack. So even if it has legitimately happened, it's likely to be dismissed as the person was just incompetent and that there just wasn't enough software safeguards to protect people from themselves. This is probably a good lesson in general for intelligent malicious actors. If you have an exploit that works, it's important that you use it rarely enough and against the right marks that the loss doesn't enter the collective consciousness as a malicious attack, but simply as an individual or systemic failure. And for those of us who strive to be constructive and defensive actors, it's an important lesson to remember that sometimes malicious actors disguise their actions as amoral bugs in the system. Regular random auditing of the seemingly mundane is an important tool to uncover these kinds of exploits.
BoardsOfCanada 4y ago
I remember malware replacing addresses on the clipboard like this, probably 8-10 years ago, there were reddit threads about it at the time for anyone with energy to look.
deleted 4y ago
[deleted]

4 ms·

There was some discussion of this over on Reddit. I didn't see evidence of it, but the claim was that this had already happened. I'd be curious if someone had s

by louislang 4y ago

There was some discussion of this over on Reddit. I didn't see evidence of it, but the claim was that this had already happened. I'd be curious if someone had some examples of it in the wild.

throwup 4y ago
This particular clipboard attack has been part of malware for at least 5 years, maybe 10. But I haven't heard of it being distributed via a package manager until now.
- louislang 4y ago
  Oh I meant malware generating addresses that look directionally similar to the address the user expects (as opposed to a random address that's hardcoded). I'm not sure if this is a thing, or just conjecture from others.
anonporridge 4y ago
It could be very hard to prove after the fact. And it's generally much more likely that human error causes a loss than to be victim to a malicious attack. So even if it has legitimately happened, it's likely to be dismissed as the person was just incompetent and that there just wasn't enough software safeguards to protect people from themselves. This is probably a good lesson in general for intelligent malicious actors. If you have an exploit that works, it's important that you use it rarely enough and against the right marks that the loss doesn't enter the collective consciousness as a malicious attack, but simply as an individual or systemic failure. And for those of us who strive to be constructive and defensive actors, it's an important lesson to remember that sometimes malicious actors disguise their actions as amoral bugs in the system. Regular random auditing of the seemingly mundane is an important tool to uncover these kinds of exploits.
BoardsOfCanada 4y ago
I remember malware replacing addresses on the clipboard like this, probably 8-10 years ago, there were reddit threads about it at the time for anyone with energy to look.
deleted 4y ago
[deleted]