Hacker News Reader

Comment by hoodoof | Hacker News Reader

So I copy a command off a dodgy website, hit paste in my terminal, and a command drops which runs a shell script that downloads a rootkit, logs me out and clears the screen leaving me thinking that some weird glitch has happened but all it OK - is that the sort of scenario we are talking?

View on HN

Although what you propose sound plausible, the only instance of this I've seen is when adding copyright notices when you save the link to am image, or when they add this warning about not stealing the work and adding proper citation.

The problem I see with this scenario is that not everyone is copy-pasting from the browser into a terminal. I for example copy things to my VM's text editor first, then run the command. Other could be copy-pasting to an email for example. In those instances it would be obvious that the site is doing something not so kosher and it would be notices pretty soon I guess, depending on the site's popularit

The worst are the sites that add additional text when you copy eg something like a quote.

Try to copy one from this site for example.

http://www.brainyquote.com/quotes/authors/a/albert_einstein....

The big warning message I get at the top of that page is funny (emphasis and commentary mine):

"Please enable Javascript This site requires Javascript be enabled to provide you the best experience [for us]. Some features [like shoving crap into your clipboard] may not be available with Javascript disabled!"

It's not uncommon to find sites whose definition of "good UX" is exactly the opposite of what I want.

Interesting; drag-and-drop bypasses that (allowing the selected text, and only the selected text, to be grabbed) but Copy using either keyboard or mouse is hijacked.

Middle click (if you have it) gets around this!

In an ideal world I'd get a warning that the copied text did not match the selected text.

The problem being that with this particular vulnerability, you do get the correct text in your clipboard initially, it's just overridden less than a second later.

Actually the selected text does usually match the copied text. It's just that some of the text is 0 font size so you don't know that you copied it.

Twitter does this on every single tweeted link. For example copy the link in this tweet: https://twitter.com/twitter/status/727507892283142145

You don't see a https:// on the page, but it gets put on your clipboard because it is actually there with 0 font size. In this case it's actually pointless though because they cut off the end of the url.

iTerm solves this problem from the other side- if you paste something that contains newlines, you get a confirmation dialog.

It defangs this vulnerability nicely.

Combined with XSS, it may not even have to be a dodgy website. A fair number of projects encourage people to copy and paste scripts into their shell in order to install these days.

Why close the window when you can hide what you did?

    echo hacked > hacked.txt; echo -ne '\033[1F\033[2K'
    echo innocent

Or just has a fun little `rm -rf /`

http://linux.die.net/man/1/rm

    --preserve-root
        do not remove '/' (default)

`rm -rf ~/*` then

  sudo rm -rf /sys/firmware/efi/efivars/

(no, don't run that at home)

Reply on news.ycombinator.com