As a developer, it's often an easier option to simply copy-paste anything we see, mostly when we only have to work with an IDE – then it's not much of a problem. But if the issue needs us to copy-paste something on the terminal that’s when things, get risky and we must be more careful.
What should I be safe about anyways?
As programmers, we are more cautious than the average users on the web, but we still sometimes can be caught off guard.
While debugging, most programmers would probably search for the error that you have on Google and try to find appropriate solutions. Most of the time you will find some thread on StackOverflow with the solution, but sometimes you will land on some random sketchy website without even noticing it.
Below, I will explain how simply copying a coding solution from a sketchy site can infect and give the attacker full control of your device.
How unsafe is the copy event?
The thing is that the browser lets the programmers listen to copy events and even change the content after the copying is done, so usually this feature is exploited to harm people.
Next time you copy something, check the source of the website for its credibility or paste it into the notepad first.
Here we have an example of carelessly copying and pasting directly to the terminal. This is some scary stuff.
The risks the browser creates
Now imagine instead of “nope actually not” I could have written a reverse shell command and would've had a backdoor on your PC and the freedom to access your PC remotely at any time I want.
The scary thing is you don’t even need to press enter, the attacker can just add “\n” a trailing newline and immediately when you paste it will enter automatically.
How could you recreate this?
Here is the JavaScript that makes this all happen. Please don't misuse it, I'm sharing it just for educational purposes. So basically the browser is letting us listen to the “copy” event so right when the user copies something we can change the clipboard data to anything we want, malware, inappropriate content, etc.
document.getElementById('test').addEventListener(
'copy', function(e){
e.clipboardData.setData('text/plain',
'malware'
);
e.preventDefault();
})Conclusion
Take your time debugging, don’t copy-paste from random sites, and if you do paste it, do it first in a safe space instead ofyour terminal, for example. Every day we are getting more vulnerable to cyber attacks, that even our own browser might trick us sometimes. It’s always better to be safe than sorry.
__
Guest article by Ardit Xhaferi, an experienced web developer working in this industry since he was 14. Now several years later, he's skilled in PHP, Laravel, and Python, etc.
