With Firefox on X11, any page can pastejack you anytime (middle button paste) • Hacker News Board

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#191

Post by torgard » Sun, Oct 22, 2023, 5:24 PM UTC

torgard wrote: post #76

You can set clipboard.autocopy to false in about:config to disable this. It breaks the example, at least. EDIT: I thought the behavior was preserved for textareas, as the comment box here still copied on select. But it suddenly disabled it here too. Restarting the browser is probably a safe bet :)

I should say, doing this only mitigates the middle-click-paste pastejack exploit. The underlying issue - JAVASCRIPT CAN ALTER WHAT YOU HAVE SELECTED AT WILL AND WITHOUT DETECTION - remains, and I believe we'll see other exploits pop up from this.

Say you're about to copy a crypto wallet. You have it selected, and are about to press CTRL-C to copy it. It is entirely possible for malicious code to detect that. And, as it turns out, it's possible for it to change the selection to a different (invisible) string, right as you press CTRL-C.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#192

Post by knickersniffer » Sun, Oct 22, 2023, 11:37 PM UTC

teo_zero wrote: post #72

Zetobal wrote: post #2

Who pastes something and executes it without a second look?

If I understood it correctly, the snippet in TFA injects a return as well, so by the time you give the second look, the commands had already been executed. In a following snippet, the terminal scrolls 100 lines and prints no prompt, so a user is tempted to press Enter just to check what's going on. You can count this as a form of phishing, if you want.

No it does not scroll. Run bash in script(1) then check the typescript.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#193

Post by ldarby » Mon, Oct 23, 2023, 1:19 AM UTC

MadnessASAP wrote: post #164

kevin_thibedeau wrote: post #68

Earlier quoted context omitted.

It's not a Linux feature. It's an X11 feature that is super intuitive if you've been using it for 30 years. Wayland tried to remove it but it has been begrudgingly allowed because of it's incredible usefulness since it cuts out all keyboard interaction.

Meanwhile I'm sitting here trying to cut out all my mouse interaction. I'm annoyed when I have to move my hand back to the mouse. Of course that means I also don't have a horse in the "What should middle click do race".

> I'm annoyed when I have to move my hand back to the mouse.

You can bind a keyboard shortcut to a script that copies the primary to clipboard, then can use ctrl-v. Most apps also bind shift-insert to paste the paste buffer, so I bind shift-delete to this script, then to paste the primary it's just shift-delete then shift-insert. Here's the "script":

     xsel -p | xsel -i -b

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#194

Post by PurpleRamen » Mon, Oct 23, 2023, 1:21 PM UTC

hulitu wrote: post #137

> In firefox running on X11, any script from any page can freely write to the primary selection, and that can be easily exploited to run arbitrary code on the user's machine. This is a problem with web browsers. They shall not run untrusted code from the internet. But we are now in the stage "oh, cool, i can access my USB from internet".

It's the browsers job to run untrusted code, this is why there are sandboxes and all kind of security-mechanism. This case is about a questionable intentional hole in the sandbox, which can be used for a social engineering-attack. Inject some code in a text-buffer, and hope that the user will execute it, and not see the malicious part. Not the biggest attack-vector, but an annoying one, which should be able to fixed easily.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#195

Post by mlipmlopmlup » Wed, Oct 25, 2023, 10:35 AM UTC

PurpleRamen wrote: post #194

hulitu wrote: post #137

> In firefox running on X11, any script from any page can freely write to the primary selection, and that can be easily exploited to run arbitrary code on the user's machine. This is a problem with web browsers. They shall not run untrusted code from the internet. But we are now in the stage "oh, cool, i can access my USB from internet".

It's the browsers job to run untrusted code, this is why there are sandboxes and all kind of security-mechanism. This case is about a questionable intentional hole in the sandbox, which can be used for a social engineering-attack. Inject some code in a text-buffer, and hope that the user will execute it, and not see the malicious part. Not the biggest attack-vector, but an annoying one, which should be able to fixed…

except that 1. it's not intentional 2. no social engineering is necessary to exploit it and 3. it's not so easy to (properly) fix it. you'll have to rewrite some shoddy '90-style c++ code with 0 test coverage code from scratch. and oh I forgot 4. there's no buffer, either.