How does this work? The first part involves replacing what you copied with something else. It executed all by itself the instant I pasted. It's important to understand that, in this example, I did not press return to execute the command. On his proof-of-concept webpage, copying the following innocuous shell command and pasting it into the Terminal results in something completely different: Enter Dylan Ayrey, who discovered a way to use JavaScript to inject malicious commands into a copied shell script. After all, typos in shell commands can have devastating consequences, so it ought to be safer to copy and paste these commands, right? In fact, some sites explicitly tell you to do just that. If you Google "Mac show hidden files," you'll find countless sites with variations of this command, and your obvious inclination would be to copy such a long command and paste it into the Terminal. It turns out that this is possible with shell scripts pasted into the Terminal.Īs an example, consider the following command, which is commonly cited as a way to make your Mac show hidden files:ĭefaults write AppleShowAllFiles TRUE killall Finder
How to access clipboard on mac os x code#
The key to this issue lies with any code that the user might copy from a website, then copy somewhere else in such a way that it is automatically executed.
How to access clipboard on mac os x install#
Once malicious code has been run on your computer, that code can download and install other processes, and in no time, your Mac has been pwned. In other words, it could lead to someone else's malicious code being run on your computer without your knowledge! It turns out that there's a possibility that this could lead to remote code execution. Graham Cluley drew my attention the other day to an issue that has apparently been known to some for years, but was new to me: clipboard poisoning, an issue where a website can replace what you think is on your clipboard with something else.Īlthough this seems like an insignificant issue on first glance, it turns out that there are some very serious implications.
0 kommentar(er)
