Hiding malicious commands in copy-and-pasted text
Quite often websites will encourage you to copy and paste commands into your terminal.
There are a variety of reasons why this is bad - not least because someone could hide malicious code. That's usually done with a bit of CSS to make the evil command invisible, or using Javascript to inject something unwanted into your keyboard.
Here's method that I hadn't seen before. Copy this code and paste it into your terminal to see your external IP address:
Notice anything weird about it? Depending on how you selected it, possibly not. Try pasting it into your terminal.
Let's take a look at how it works:
HTML
<input
type="text"
readonly=""
value="curl ipconfig.io ;yes "Don't copy and paste commands!""
size="17"
style="display: inline;
width: fit-content;
background: var(--color-box);
border: none;
outline: none;
padding: 0;
font-family:monospace;
border-radius: 0;">
It's a readonly text input! The size has been set to cut off anything after the innocuous command. The CSS makes it look like part of the regular page with none of the styling associated with an input.
I'd hope that most people would realise that the command they pasted looked different from the one they thought had been copied - but we all make mistakes.
I think it was CSI 3i in SCO Xenix that worked as a "print screen" command. But for a terminal, so it would send the content of the screen back to the tty, which was supposed to capture it and then do something with it, for example printing.
So if somebody had a root shell open, and was
mesg y, you could send them 'clear screen', some command, 'csi 3i' and the screen content - the command - would be echoed back to the tty, with the shell listening.Very quickly my admin had 'mesg n'
| Reply to original comment on chaos.social
| Reply to original comment on mastodon.social
| Reply to original comment on mastodon.social
"with firefox on X11, any page can pastejack you anytime"
https://seclists.org/oss-sec/2023/q4/132
I'd never thought of copy-paste being dangerous before..
More comments on Mastodon.