Tips on safe debugging from a Proxify developer

So we just copy-paste anything that we see, mostly when we just have to work with an IDE its not much of a problem. But if the issue needs us to copy-paste something on the terminal that’s when things get risky and we need to be more careful.

What should I be safe about anyways?

As programmers, we are more cautious than the average users on the web, but we still sometimes can be caught off guard.

While debugging, most programmers would probably search for the error that you have on google and try to find appropriate solutions. Most of the time you will find some thread on StackOverflow with the solution, but sometimes you will land on some random sketchy site and you won’t even notice it.

Below, I will explain how just copying a coding solution from a sketchy site can infect and give the attacker full control of your device.

How unsafe is the copy event?

The thing is that the browser lets the programmers listen to copy events and even change the content after the copying is done, so usually this feature is exploited to harm people.

Next time you copy something, check the source of the website for its credibility or paste it into the notepad first.

Here we have an example of carelessly copying and pasting directly to the terminal. This is some scary stuff.

The risks the browser creates

Now imagine instead of “nope actually not” I could have written a reverse shell command and would've had a backdoor on your PC and the freedom to access your PC remotely at any time I want.

The scary thing is you don’t even need to press enter the attacker can just add “\n” a trailing newline and immediately when you paste it will enter automatically. How could you recreate this?

Here is the JavaScript that makes this all happen. Please don't misuse it, I'm sharing it just for educational purposes. So basically the browser is letting us listen to the “copy” event so right when the user copies something we can change the clipboard data to anything we want, malware, inappropriate content, etc.

document.getElementById('test').addEventListener(
    'copy', function(e){
        e.clipboardData.setData('text/plain', 
            'malware'
        );
    e.preventDefault();
})

Conclusion

Take your time debugging, don’t copy-paste from random sites, and if you do paste it, do it first in a safe space instead ofyour terminal, for example. Every day we are getting more vulnerable to cyber attacks, that even our own browser might trick us sometimes. It’s always better to be safe than sorry.

__

Guest article by Ardit Xhaferi, experienced web developer working in this industry since he was 14. Now 19, he's skilled in PHP, Laravel, Python, etc. You can find out more about him here.

Find your next developer within days, not months

We can help you deliver your product faster with an experienced remote developer. All from €31.90/hour. Only pay if you’re happy with your first week.

In a short 15-minute call, we will:

  • Understand your development challenges
  • Explain our process to match you with qualified, vetted developers from our network
  • Share next steps to finding the right match, often within less than a week

Not sure where to start?

Let’s have a chat

First developer starts within days. No aggressive sales pitch.