Clipboards have already been established as potential attack vectors. By now, malicious actors’ ability to use HTML/CSS tricks designed for developers to copy malicious code is well-documented.
But according to SecurityWeek, there’s an emerging copy concern on the Web: pastejacking. This process uses Java instead of CSS, which makes the exploit more powerful and harder to detect, and it could have serious consequences if paired with a phishing attack.
Here’s a rundown of the new paste problem.
Devil in the Details
His proof of concept showed what happens when users paste commands copied from a Web browser into their terminal: While it may appear that they are copying the line echo “not evil”, they’re in fact getting echo “evil\n.
This is a small difference, but a critical one — \n means “newline” and ensures that any command is automatically executed when pasted without the need to press a key.
As a result, victims may not even see the malicious code they’re copying before it starts to run. The exploit isn’t viable in Safari, while apps such as iTerm and Windows console emulator Cmder show warnings whenever the newline character is used.
There is a silver lining, since most users are now tech-savvy enough to avoid copy/paste commands on websites that don’t seem above-board. The problem? That’s the least likely attack vector.
Instead, it’s a safe bet that cybercriminals will bundle malicious code into a phishing email scam. If they convince users to copy in-mail text or do the same at a supposedly secure site, victims could unwittingly infect their own machines.