81–90 of 246 posts
So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?
Remind me again why we allow browsers to override OS copy commands?
There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and ho…
I had to implement this kinda code when I worked for Demand Media and it certainly worked. Whats funny is you don't need any fancy new apis to make it work. We were doing some pretty basic tactics actually. Only real way to prevent it is disable javascript.
It isn't perfect because people could try to obscure the command but in general it makes me a lot happier to paste commands into my terminal.
Earlier quoted context omitted.
I had to implement this kinda code when I worked for Demand Media and it certainly worked. Whats funny is you don't need any fancy new apis to make it work. We were doing some pretty basic tactics actually. Only real way to prevent it is disable javascript.
Or to block the loading of the offending javascript!
Earlier quoted context omitted.
Note that clever timing could get the "evil text" in your clipboard between checking in a text editor and pasting into the terminal. Hard to time correctly, but not impossible.
To solve this, browsers should probably disallow modifying the clipboard after a certain time period from the event. Eg. 500ms.
To solve this, browsers should probably disallow modifying the clipboard .
This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.
Or you could "View Source"
This is why I always copy a command into TextEdit (or Notepad on Windows) first, and then re-copy the clean text before pasting into my terminal. While we are on the topic of copying and pasting. If the command downloads a script, make sure you download the script out-of-step via curl first, review its contents, and only then execute it. This avoids sites maliciously changing the script based on the User Agent.
So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?
echo hacked > hacked.txt; echo -ne '\033[1F\033[2K'
echo innocent