Don't copy-paste commands from webpages – you can get hacked | Hacker News Reader

Don't copy-paste commands from webpages – you can get hacked

bleepingcomputer.com

28 pointsthunderbong10 comments

Last time I remember this issue was brought up:

https://news.ycombinator.com/item?id=24797720

You can mostly avoid this problem with a little configuration if bracketed-paste-mode isn't default on whatever you're using.

Make sure it's supported and/or active on your terminal (e.g. urxvt, xterm) and the CLI/TUI programs (e.g. vim, bash/libreadline) on which you want to paste.

At the link above is a link to an SE answer I wrote years ago:

https://security.stackexchange.com/questions/39118/how-can-i...

It has a table showing what terminals support bracketed paste mode, and also provides a urxvt plugin to fix a bug in urxvt's implementation.

You don't even need JS.

    <pre>echo 'normal code, nothing to see here :)'<span style="color:transparent;font-size:0">; echo 'evil stuff'</span>
    echo 'nothing suspicious at all :)'</pre>

I honestly expected some sort of weird zero-width char exploit. This is much simpler

Here [1] is another method using CSS with previous discussion [2] and talks about bracketed mode not always mitigating this.

[1] - https://thejh.net/misc/website-terminal-copy-paste

[2] - https://news.ycombinator.com/item?id=5508225

I usually paste into notepad++ first to make sure formatting is right. Guess this is a good habit for everyone to get into.

Related article from John Gruber in 2010:

https://daringfireball.net/2010/05/tynt_copy_paste_jerks

Do people not read what they pasted before hitting 'enter'?

Like do they just smash ctrl+v//enter super fast? Why would anyone do that

Yes indeed they do not read it at all. Even if you tell them right before the to be copied text to replace the obvious placeholders with the real value needed. And then they complain on slack that 'this thing in the docs doesn't work. Help!'.

Always have them show you exactly what they did. No descriptions of what they did, let them show you. Yes, do ask the obvious 'did you replace the placeholders?' question.

Very common answer: 'What placeholders?'

From the article, emphasis mine:

> Not only do you get a completely different command present on your clipboard, but to make matters worse, it has a newline (or return) character at the end of it.

> This means the above example would execute as soon as it's pasted directly into a Linux terminal.

Jus another reminder that the modern browser is an awful platform with basically no unique purpose but user exploitation - which is why it happens to be ubiquitous.

Reply on news.ycombinator.com