111–120 of 246 posts
For the record you don't actually need to depend on new APIs like "document.execCommand('copy')", simply shifting focus to an off-screen textbox area when ctrl is down will do the trick in 95% of the cases, with full cross browser compatibility.
.. Not sure this would work in OSX.
Earlier quoted context omitted.
TextEdit is RTF by default - I wonder if you can include control characters to screw with that? I use Sublime/Atom since those are plaintext by default.
Yes, switching TextEdit to default to Plain Text is the first thing I do after installing OSX.
This particular attack doesn't work when not using keyboard to copy (think select to copy (traditional X behavior) or using a context menu), it causes text to unselect after busy loop ends, causes fans in my laptop to start working (because of busy new Date loop), causes cursor to cease changing for a certain period of time, requires me to enable JavaScript, requires support for "copy" command (which isn't universal), and requires the user to press CTRL+C either way (otherwise the webpage won't be able to copy into a clipboard).
I guess you could paste an output after a certain time, but because of hijacking on Ctrl key, nothing can be copied before busy loop ends, and as a result, it doesn't prevent "pasting the command into Notepad" just to ensure it's safe - as either what previously was in pastebin or malicious command will be pasted.
https://xfix.github.io/mystery-zone/command.html (disclaimer: I made this page) doesn't have any of those problems (other than requiring the user to copy text in any way (CTRL+C, text selection, context menu, whatever odd interface do you have)), and it still can break vim (and for that matter, bash, zsh (including zsh with paste protection), fish, and emacs).
Earlier quoted context omitted.
Note that clever timing could get the "evil text" in your clipboard between checking in a text editor and pasting into the terminal. Hard to time correctly, but not impossible.
To solve this, browsers should probably disallow modifying the clipboard after a certain time period from the event. Eg. 500ms.
Earlier quoted context omitted.
Demand Media makes money by monitoring ad networks and then paying people to churn out worthless content that pollutes search results. They watch metrics very carefully.
Sounds like a pretty unethical way to make money.
But yeah, Demand Media is terrible and their employees are not on my Christmas card list.
I may be the one guy using it, but I can't repro this on Safari + iTerm nightlies...
There are many news sites that make it extremely hard to share their content on sites like HN or reddit because of these tricks. I wonder if they are actually losing traffic from it, or if their tactics work? I'm referring when you copy the text in the title of an article to try to paste it into the Title box on HN or reddit. But what you 'paste' is actually a huge paragraph about how great the news website is and ho…
I had to implement this kinda code when I worked for Demand Media and it certainly worked. Whats funny is you don't need any fancy new apis to make it work. We were doing some pretty basic tactics actually. Only real way to prevent it is disable javascript.
Earlier quoted context omitted.
Demand Media makes money by monitoring ad networks and then paying people to churn out worthless content that pollutes search results. They watch metrics very carefully.
Sounds like a pretty unethical way to make money.