Don't copy-paste commands from webpages – you can get hacked

https://www.bleepingcomputer.com/news/security/dont-copy-paste-commands-from-webpages-you-can-get-hacked/

by thunderbong • 5 years ago

28 10 5 years ago

bleepingcomputer.com

Arch485• 5 years ago

I honestly expected some sort of weird zero-width char exploit. This is much simpler

easrng• 5 years ago

You don't even need JS.

    <pre>echo 'normal code, nothing to see here :)'<span style="color:transparent;font-size:0">; echo 'evil stuff'</span>
    echo 'nothing suspicious at all :)'</pre>

netizen-936824• 5 years ago

Do people not read what they pasted before hitting 'enter'?

Like do they just smash ctrl+v//enter super fast? Why would anyone do that

tharkun__• 5 years ago

Yes indeed they do not read it at all. Even if you tell them right before the to be copied text to replace the obvious placeholders with the real value needed. And then they complain on slack that 'this thing in the docs doesn't work. Help!'.

Always have them show you exactly what they did. No descriptions of what they did, let them show you. Yes, do ask the obvious 'did you replace the placeholders?' question.

Very common answer: 'What placeholders?'

Rychard• 5 years ago

From the article, emphasis mine:

Not only do you get a completely different command present on your clipboard, but to make matters worse, it has a newline (or return) character at the end of it.
This means the above example would execute as soon as it's pasted directly into a Linux terminal.

slickdork• 5 years ago

I usually paste into notepad++ first to make sure formatting is right. Guess this is a good habit for everyone to get into.

jolmg• 5 years ago

Last time I remember this issue was brought up:

https://news.ycombinator.com/item?id=24797720

You can mostly avoid this problem with a little configuration if bracketed-paste-mode isn't default on whatever you're using.

Make sure it's supported and/or active on your terminal (e.g. urxvt, xterm) and the CLI/TUI programs (e.g. vim, bash/libreadline) on which you want to paste.

At the link above is a link to an SE answer I wrote years ago:

https://security.stackexchange.com/questions/39118/how-can-i...

It has a table showing what terminals support bracketed paste mode, and also provides a urxvt plugin to fix a bug in urxvt's implementation.

jl2718• 5 years ago

Jus another reminder that the modern browser is an awful platform with basically no unique purpose but user exploitation - which is why it happens to be ubiquitous.

LinuxBender• 5 years ago

Here [1] is another method using CSS with previous discussion [2] and talks about bracketed mode not always mitigating this.

[1] https://thejh.net/misc/website-terminal-copy-paste

[2] https://news.ycombinator.com/item?id=5508225

SippinLean• 5 years ago

Related article from John Gruber in 2010:

https://daringfireball.net/2010/05/tynt_copy_paste_jerks

Don't copy-paste commands from webpages – you can get hacked

Related Stories