Put away your wget and curl, your SOAP clients and WSDLs, WebDAV servers, REST APIs and JSON callbacks; when it comes to moving data off websites and on to your computer the sticky stuff that greases the wheels is
copy and paste.
This side of haptic gloves, Ctrl+C and Ctrl+V is as close as we can get to reaching out and grabbing something off the web. It’s the cyber-grab you cyber-learn in your cyber-infancy and never cyber-forget because you endlessly cyber-repeat it.
Repetition teaches us that what goes in to our hand when we Ctrl+C (grab something) comes out of our hand when we Ctrl+V (let it go).
But what if it didn’t?
What if you reached out to grab one apple but when you opened your hand you had a pear? Or a piranha?
Pastejacking with Javascript
Javascript is a programming language that can be embedded into HTML web pages and, perhaps more than any other technology, it’s what turned the web from a collection of documents you could read into a collection of applications you can use.
It can’t break out from your browser and put things on your computer, but within the sandboxed confines of a web page it can access all sorts of powerful functionality that makes possible everything from
Nyan Cat to Gmail (and, when you’re all nyaned-out,
Chrome Experiments.)
With your permission it can trigger push notifications and geolocation, and without your permission Javascript can store megabytes of data in your browser’s cache, open windows, move things around the page, draw things on virtual canvases, log your keystrokes and track your mouse.
And, thanks to a function called execCommand('copy') it can paste cyber-pirhanas to your clipboard too.
An excellent
demonstration of how to do this and why it’s a bad idea has been put together by hacker Dylan Ayrey on Github and his personal site
security.love.
In the demo, users are invited to copy the text echo "not evil" and witness with horror as what they actually paste is the cruelly different echo "evil"\n.
The execCommand('copy') command that performs this magic has to have a trigger, known as an ‘event’ to run, so Ayrey’s code uses the keydown event which happens to be triggered when you use the keyboard shortcut for Ctrl+C. The code then waits 0.8 seconds and switches out the text from your clipboard.
The snippets of text in the example aren’t just words, they’re valid computer commands that can be run inside a terminal window (that mysterious, featureless black window with white text that ‘power users’ never see and real geeks use to get work done).
The \n on the end of echo "evil"\n is a newline and if you type a newline into a terminal window it will run the preceding command immediately.
In other words Ayrey has offered you something that won’t run until you tell it to and then replaced it behind your back with something else that will run as soon as you paste it.
Luckily for anyone using Ayrey’s example it’s a benign command that ends up getting run, but of course it doesn’t have to be; an attacker could just as easily make you think you’re copying something safe and replace it with a command that deletes your home directory and steals your password file.
