Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pastejacking

github.com

Post reply on HN
Print view View original

1–10 of 246 posts

Re: Pastejacking

#2

Post by zbuttram »

The author noted that iTerm on MacOS notifies when a paste that's about to happen contains a newline. Cmder on Windows does this as well, it's a nice feature even outside of the security concerns.

Re: Pastejacking

#4

Post by fosk »

This is one of the innumerable reasons why copying and pasting commands on the fly is wrong.

This also includes the awful popular installation commands in the form of "curl -s ... | sh" - which means you are basically giving your computer in the hands of a third party.

Re: Pastejacking

#5

Post by ipsin »

gravypod wrote: post #3

I wasn't able to get this to work. Do I need to use CNTRL + C?

I had a similar experience in Chrome, pasting into gedit. Ctrl-C/Ctrl-V works, but menu copy/paste doesn't.

Re: Pastejacking

#6

Post by chrismonsanto »

fosk wrote: post #4

This is one of the innumerable reasons why copying and pasting commands on the fly is wrong. This also includes the awful popular installation commands in the form of "curl -s ... | sh" - which means you are basically giving your computer in the hands of a third party.

> which means you are basically giving your computer in the hands of a third party

As opposed to any other installation method? Do you regularly vet the entire source code of software you install?

Re: Pastejacking

#7

Post by rbut »

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal.

While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.

Re: Pastejacking

#8

Post by hoodoof »

So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?

Re: Pastejacking

#9

Post by cryptoz »

There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and how you should download their apps and read more on their website. At that point, I can't be bothered to clean it up and I refuse to type out some text that I should have been able to copy.

Does it really work? Do sites actually get more traffic by hijacking your keyboard's basic functions to insert advertisements? I guess it probably does. :(

Re: Pastejacking

#10

Post by vonklaus »

I can't reproduce this in chrome or safari. I have ublock enabled, but a cmd + c gives me the bell in iterm(fail) and if I click edit copy from the drop down, the shell echos

   "not evil"
without a line break as expected. Chrome and Safari.

edit: doesn't seem to have unexpected behavior in terminal either. Am I missing something, or does uBlock default deny the scripts that can do this?

edit 2: console log: Copying text command was unsuccessful. uBlock disabled.

Post reply on HN