Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pastejacking

github.com

Post reply on HN
Print view View original

41–50 of 246 posts

Re: Pastejacking

#41

Post by [deleted] »

saganus wrote: post #19
hoodoof wrote: post #8

So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?

Although what you propose sound plausible, the only instance of this I've seen is when adding copyright notices when you save the link to am image, or when they add this warning about not stealing the work and adding proper citation. The problem I see with this scenario is that not everyone is copy-pasting from the browser into a terminal. I for example copy things to my VM's text editor first, then run the command.…

[deleted]

Re: Pastejacking

#42

Post by rbut »

nadaviv wrote: post #36
rbut wrote: post #7

This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.

Note that clever timing could get the "evil text" in your clipboard between checking in a text editor and pasting into the terminal. Hard to time correctly, but not impossible.

To solve this, browsers should probably disallow modifying the clipboard after a certain time period from the event. Eg. 500ms.

Re: Pastejacking

#43

Post by rbut »

azernik wrote: post #40
chrismonsanto wrote: post #6

Earlier quoted context omitted.

> which means you are basically giving your computer in the hands of a third party As opposed to any other installation method? Do you regularly vet the entire source code of software you install?

I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// domain, the page you're copying from also needs to be on a trusted https:// domain.

Even if its a trusted https:// domain, it can still be compromised. (https://blog.jquery.com/2014/09/24/update-on-jquery-com-comp...)

Always review the script first.

Re: Pastejacking

#44

Post by userbinator »

tedmiston wrote: post #26
saganus wrote: post #19

Earlier quoted context omitted.

Although what you propose sound plausible, the only instance of this I've seen is when adding copyright notices when you save the link to am image, or when they add this warning about not stealing the work and adding proper citation. The problem I see with this scenario is that not everyone is copy-pasting from the browser into a terminal. I for example copy things to my VM's text editor first, then run the command.…

The worst are the sites that add additional text when you copy eg something like a quote. Try to copy one from this site for example. http://www.brainyquote.com/quotes/authors/a/albert_einstein....

The big warning message I get at the top of that page is funny (emphasis and commentary mine):

"Please enable Javascript This site requires Javascript be enabled to provide you the best experience [for us]. Some features [like shoving crap into your clipboard] may not be available with Javascript disabled!"

It's not uncommon to find sites whose definition of "good UX" is exactly the opposite of what I want.

Re: Pastejacking

#45

Post by beefsack »

zbuttram wrote: post #25
Unklejoe wrote: post #16

Earlier quoted context omitted.

On a somewhat related note: why do browsers allow websites to prevent you from leaving via those annoying dialog boxes that ask you to click "cancel" or "leave"?

I have seen sites that have pages where you're placed in a queue (for whatever reason) and if you leave the page you will be dropped from the queue, so it's nice to have something preventing you from accidentally leaving, but that's the only legitimate use I can think of.

Or potentially losing any page state when navigating away or closing a browser, such as form data.

Re: Pastejacking

#46

Post by chrismonsanto »

azernik wrote: post #40
chrismonsanto wrote: post #6

Earlier quoted context omitted.

> which means you are basically giving your computer in the hands of a third party As opposed to any other installation method? Do you regularly vet the entire source code of software you install?

I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// domain, the page you're copying from also needs to be on a trusted https:// domain.

Absolutely.

Re: Pastejacking

#47

Post by chrismonsanto »

rbut wrote: post #43
azernik wrote: post #40

Earlier quoted context omitted.

I think an actionable takeaway is: even if the curl/wget/whatever points to a trusted https:// domain, the page you're copying from also needs to be on a trusted https:// domain.

Even if its a trusted https:// domain, it can still be compromised. ( https://blog.jquery.com/2014/09/24/update-on-jquery-com-comp... ) Always review the script first.

You trust the upstream to provide you with a safe program, but not a safe installer? That makes zero sense, and your link doesn't provide any evidence to the contrary

Re: Pastejacking

#48

Post by rbut »

chrismonsanto wrote: post #47
rbut wrote: post #43

Earlier quoted context omitted.

Even if its a trusted https:// domain, it can still be compromised. ( https://blog.jquery.com/2014/09/24/update-on-jquery-com-comp... ) Always review the script first.

You trust the upstream to provide you with a safe program, but not a safe installer? That makes zero sense, and your link doesn't provide any evidence to the contrary

Yes, you are correct if the application and script are on the same domain. The link is simply an example of a major 'trusted' domain being compromised.

Re: Pastejacking

#49

Post by Buge »

hoodoof wrote: post #27
saganus wrote: post #19

Earlier quoted context omitted.

Although what you propose sound plausible, the only instance of this I've seen is when adding copyright notices when you save the link to am image, or when they add this warning about not stealing the work and adding proper citation. The problem I see with this scenario is that not everyone is copy-pasting from the browser into a terminal. I for example copy things to my VM's text editor first, then run the command.…

In an ideal world I'd get a warning that the copied text did not match the selected text.

Actually the selected text does usually match the copied text. It's just that some of the text is 0 font size so you don't know that you copied it.

Twitter does this on every single tweeted link. For example copy the link in this tweet: https://twitter.com/twitter/status/727507892283142145

You don't see a https:// on the page, but it gets put on your clipboard because it is actually there with 0 font size. In this case it's actually pointless though because they cut off the end of the url.

Re: Pastejacking

#50

Post by fu9ar » 

    fu9ar@traveler ~ % ^[[200~echo "evil"
It works, but it also doesn't work.

Usually I use the middle-click-to-paste feature, which just doesn't work at all.

Post reply on HN