Hacker News Reader

Comment by behnamoh | Hacker News Reader

Can clipboard content be exploited to run code? Something like a special OS string that escapes clipboard?

Also, is there a way to patch this Chrome "feature"?

Yes, it can be exploited - which is why terminals are adding confirmation steps to pasted multiline text (to avoid running the commands without user even seeing them).

This could be very fun on those websites that give you a code snippet to copy and paste and install oh-my-zsh and friends.

Or on crypto DEXes where you paste in one address, the compromised exchange website shows you what you pasted with a CSS overlay but in reality, the real input field underneath has already been replaced with a Tornado Cash address, so when you submit the form, it's crypto go bye bye.

maybe we need a clipboard manager that blocks Chrome in such situations.

This is not even a clipboard problem. If the site is compromised, they can display the correct value in the input form, but submit the malicious value in the code that triggers the wallet transaction.

The user’s wallet software can detect these by warning the user that the contract address is unknown or never before seen by them.

One safety measure is to enable a whitelist of trusted addresses.

If a you manually copy text then that's a "gesture". Sites are able to add malicious code when you copy text and this won't change as far as I know. In terms of security, it's horrible but not new.

Imagine you highlight a command and copy, but Js in the background replaces it with a malicious command.

The answer is simple: don't copy/paste commands, or at the very least review what you're about to execute after pasting. Reasonable terminals give you a warning that you're about to paste multiple lines and let you read the text before okaying.

Besides this is irrelevant. Websites have always been able to do what you're describing, because copying is a gesture. This bug doesn't change that.

"the answer is simple: don't use computers"

That has already been possible for a long time. Try copying text from a news or lyrics website and you’ll see extra junk in your clipboard.

Almost as bad as running code is if there is a way to read the clipboard.

Reply on news.ycombinator.com