4

A brief quote from the article "Old tricks are new again: Dangerous copy and paste" at The H Security website:

Copying and pasting something does not necessarily mean the user will get what they think they are getting. With a little bit of HTML magic, one can even trick unwitting web site visitors into executing shell commands without their knowledge. The trick is by no means new, but it is currently being demonstrated again on several web sites which means Linux users especially have to be careful what they copy and paste.

How do users of Ubuntu 12.10 mitigate the problem?

2

2 Answers 2

6

Some simple ways of avoiding this problem:

  • Select (Drag the mouse over) only the text you see. If this is found in multiple lines, do not drag the mouse downwards to select all the lines. Instead, select each line, one by one and only select the text you can actually see. Of course this does not work always (In fact as Chaskes mentions and the link provided shows, it will still carry the malicious code with it). You would still need to copy/paste the content in a text file first.

  • Another quicker way is to go Rambo on the text and simply select the whole thing. Then paste this in gedit for instance. There you will be able to see if it contains anything suspicious on it.

  • A nice trick to detect this kind of malicious codes is to double click it. When you double click some of this types of hidden codes, the selectable part will become highlighted I might show something that looks just plain wrong. For example, here are 2 cases related to the same article:

    enter image description here

    In this case, I double clicked the ls part. I would assume as a normal user that it would have highlighted the whole line, but instead did the above. This shows that ls and the rest of the line of code is NOT on the same HTML element, giving you a hint that there is something wrong with the HTML. It could be wrong tag or malicious intent.

    enter image description here

    In this one, you can see the highlighted part keeps on going to the right and although, in this case if you paste the copy code to gedit it will show the correct information, this is another way of using the malicious code. The code could be hidden to the right and by double clicking it, even if you do not see it, the highlighted part would still take it (For example, changing the menu on the right to a z-index value higher than the rest and to top it off, a position that makes sure everything looks "good".

    In neither of this cases, double clicking the code gave you the actual line. I want to also add that if you double click and it selects the whole line, like in the second example, it might not be a bad thing in some sites. The site could have handled the selected area as the whole line instead of selecting only the text as the following example illustrates:

    enter image description here

    As you can see, I double clicked on the command but it highlighted the whole line. Yes, there could be some evil code behind this, but since the site is trusted, it lowers the chance of this happening (Still, to make sure, paste the content to a text editor).

    What it actually should NOT do a select half of the code then do what the first image I posted did which is to jump to the bottom of the page for no "appearing reason" instead of selecting the whole line where it is.

It is very easy to execute this and also very easy to avoid it altogether.

In my case, if it is pretty long (And I trust the site am copying it from) then I put it in gedit.

2
  • 1
    Selecting only the text you see won't solve the problem. In the linked examples a span tag positions some of the text off the screen, but the hidden text is still part of the visible text and will still be copied.
    – chaskes
    Apr 18, 2013 at 3:55
  • 1
    @chaskes totally true. I have to agree, that is one smart way of creating a problem. Apr 18, 2013 at 3:58
1

The easiest way is probably to first paste the text into a plain-text editor like Gedit. I developed this habit as a way to strip surrounding web formatting or objects that are sometimes copied by accident, but it will also let you see everything you copied.

You can also right-click in the browser document and view the page source to see what's really there.

2
  • 1
    Same reason. For example, copying the text from a site that "quotes" the code and you end up with a quote symbol that is totally weird. Apr 18, 2013 at 3:55
  • 1
    Exactly. Putting aside malicious intent, when pasting from the web you never really know what you have (or how it will render on your system) until you paste it as plain text.
    – chaskes
    Apr 18, 2013 at 3:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .