It seems to me that if you can access the system clipboard you have enough access to do all sorts of stuff.
It seems to me that if you can access the system clipboard you have enough access to do all sorts of stuff.
https://techcrunch.com/2018/07/03/new-malware-highjacks-your...
I haven't run into any (that I know of), but it's trivial to write such a program.
> are there clipboard snoopers that access sensitive data they couldn't also access in any other way?
There's no such thing as a 100% secure system, but removing one of the most vulnerable attack vectors is a huge improvement in and of itself.
> It seems to me that if you can access the system clipboard you have enough access to do all sorts of stuff.
Not quite. Currently all applications have unrestricted access to the clipboard. Accessing decrypted credentials in a password manager is only possible by the authorized user, and this can be restricted in a number of ways. Maybe we need a stricter permission system for clipboard access, but I would argue we need to stop using the clipboard for exchanging sensitive data between applications.
I think a permission system for the clipboard would be pretty awkward UX, and not really worth the effort for the (hypothetical) problem it's solving.
This is designed to work with CobaltStrike, which is a tool used by security testers (i.e. redteams), but also by real life adversaries as well.