Hiding malicious commands in copy-and-pasted text
CyberSecurity HTML linux · 4 comments · 250 words
Quite often websites will encourage you to copy and paste commands into your terminal.
There are a variety of reasons why this is bad - not least because someone could hide malicious code. That's usually done with a bit of CSS to make the evil command invisible, or using Javascript to inject something unwanted into your keyboard.
Here's method that I hadn't seen before. Copy this code and paste it into your terminal to see your external IP address:
Notice anything weird about it? Depending on how you selected it, possibly not. Try pasting it into your terminal.
Let's take a look at how it works:
HTML
<input
type="text"
readonly=""
value="curl ipconfig.io ;yes "Don't copy and paste commands!""
size="17"
style="display: inline;
width: fit-content;
background: var(--color-box);
border: none;
outline: none;
padding: 0;
font-family:monospace;
border-radius: 0;">
It's a readonly text input! The size has been set to cut off anything after the innocuous command. The CSS makes it look like part of the regular page with none of the styling associated with an input.
I'd hope that most people would realise that the command they pasted looked different from the one they thought had been copied - but we all make mistakes.
mesg y, you could send them 'clear screen', some command, 'csi 3i' and the screen content - the command - would be echoed back to the tty, with the shell listening. Very quickly my admin had 'mesg n'More comments on Mastodon.