May 26, 2016 By Douglas Bonderud 2 min read

Clipboards have already been established as potential attack vectors. By now, malicious actors’ ability to use HTML/CSS tricks designed for developers to copy malicious code is well-documented.

But according to SecurityWeek, there’s an emerging copy concern on the Web: pastejacking. This process uses Java instead of CSS, which makes the exploit more powerful and harder to detect, and it could have serious consequences if paired with a phishing attack.

Here’s a rundown of the new paste problem.

Devil in the Details

Security expert Dylan Ayrey told SecurityWeek the use of JavaScript means “text can be copied after an event, it can be copied on short timer following the event, and it’s easier to copy in hex characters into the clipboard, which can be used to VIM.”

His proof of concept showed what happens when users paste commands copied from a Web browser into their terminal: While it may appear that they are copying the line echo “not evil”, they’re in fact getting echo “evil\n.

This is a small difference, but a critical one — \n means “newline” and ensures that any command is automatically executed when pasted without the need to press a key.

As a result, victims may not even see the malicious code they’re copying before it starts to run. The exploit isn’t viable in Safari, while apps such as iTerm and Windows console emulator Cmder show warnings whenever the newline character is used.

Hands-Free Pastejacking

So how do attackers convince potential victims to copy/paste malicious code? It’s easier than it appears. As noted by Softpedia, users don’t even need to copy all the malicious code; a single character is enough to start the process. What’s more, it’s possible for actors to add pastejacking JavaScript to an entire Web page so that any text copying results in potential infection.

Even worse? JavaScript gives cybercriminals the power to run their code, clear the console and then paste the originally selected text, leaving users with no clue that they’ve been compromised.

There is a silver lining, since most users are now tech-savvy enough to avoid copy/paste commands on websites that don’t seem above-board. The problem? That’s the least likely attack vector.

Instead, it’s a safe bet that cybercriminals will bundle malicious code into a phishing email scam. If they convince users to copy in-mail text or do the same at a supposedly secure site, victims could unwittingly infect their own machines.

There’s also the possibility of exploiting popular tech support sites. With more users now willing to search for help online before contacting IT departments, compromising a code repository with pastejacking JavaScript could help attackers slip past the security senses of even Web-wary users.

Clipboard concerns are back, and this time it goes beyond CSS. More adaptable JavaScript makes CTRL-V a viable attack vector.

More from

Regulatory harmonization in OT-critical infrastructure faces hurdles

3 min read - In an effort to enhance cyber resilience across critical infrastructure, the Office of the National Cyber Director (ONCD) has recently released a summary of feedback from its 2023 Cybersecurity Regulatory Harmonization Request for Information (RFI). The responses reveal major concerns from critical infrastructure industries related to operational technology (OT), such as energy, transport and manufacturing. Their worries include the current fragmented regulatory landscape and difficulty adapting to new cyber regulations. The frustration appears to be unanimous. Meanwhile, the magnitude of…

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today