What is Pastejacking and How to protect yourself

The easiest method to obtain any text and images from a website is to select it, copy it using CTRL+C keys and then paste it using CTRL+V. What if the pasted material is not what you copied from the website? Surely, you’ll copy-paste again, and the results might be the same.  It’s risky, and we’ll talk why.

A quick example is that you copy a command from a website and paste it on the console. It turns out the command was changed, and this damages your data. Is there something wrong with the way you copy-paste? Or is it something malicious? This article talks about what is Pastejacking – the art of changing what you copy from web pages.

What is Pastejacking

Nearly all browsers allow websites to run commands on the users’ computers. This feature can allow malicious websites to take over your computer’s clipboard. That is, when you copy something and paste it to your clipboard, the website can run one or more commands using your browser. The method can be used to change the Clipboard contents. While it may not be much dangerous if you are copying to Notepad or Word etc. , it could be a problem for your computer if you paste something directly to the Command Prompt.

Websites run command(s) when anything specific is done by the user – like when pressing a specific key or right-clicking the mouse. When you press CTRL+C on your keyboard, it triggers the website command mode. After a small wait, say 800 ms, it pastes something malicious to your clipboard. The wait is to let you use CTRL+V to paste the original text that you copied. Some websites may track CTRL+V and use it to trigger a command that changes the clipboard contents.

They can also track mouse movements. If you do not use the keyboard but instead, use the context menu to copy, they can also trigger commands to replace your clipboard contents.

In short, Pastejacking is a method malicious websites employ to take control of your computer’s clipboard and change its content to something harmful without your knowledge.

Why is Pastejacking harmful

Suppose you are copy-pasting from a website to Microsoft Word. When you press CTRL+C or CTRL+V, the website places a few commands on your clipboard that can create and execute harmful macros.

The worst is when you paste content directly to a console like PowerShell or Command Prompt window. Mac users have some security if they are using iTerm. It is an emulation that allows Mac users to replace the default console. When using iTerm, it asks the users if they really wish to paste something containing “newline” character. Users can then select “Yes” or “No” depending on their actions.

The Newline character is actually half the Enter key. The Enter key is depicted, generally by an arrow that seems to be originating from an upper line to a lower line and then to the left. The Enter key is a combination of Newline (change to next line) and Return (read “carriage return to leftmost position x,0” as in typewriters) characters. When you press the Enter key, any command on that console line is executed. It is dependent upon the console to ask for confirmation.

The Windows command prompt does not ask for confirmation in the case of most commands. It asks for confirmation only in case you use a DEL or FORMAT command. For commands like RENAME, etc., it will not ask for confirmation. I haven’t used Powershell much, so I don’t know how the commands are accepted there.

In any case, if the website places commands on your clipboard with the Enter key (/n/r where /n is newline and /r is carriage return), the console or any programmable application directly runs the command(s). If these commands are harmful, they can create havoc on your machine and network.

Read: Website Traffic Fingerprinting.

How to avoid Pastejacking

If you are an OS X, you can use the iTerm emulator for safety. It will prompt you in case pastejacking happens with the already appended Enter set of characters.

Windows users need to check what is placed into their computers’ clipboards. To do this, first, paste the contents into the Notepad. It pastes the clipboard as text only and lets you see what is there in the clipboard. If you see what you copied, you can go ahead and paste it wherever you want. It means an additional step, but it is better than getting Pastejacked. Remember that using Word to check the clipboard may be dangerous as it, too, is programmable using macros, etc.

Remember that using Word to check the clipboard may be dangerous as it, too is programmable using macros, etc. Notepad is not programmable and hence, it is safe to check the contents of the clipboard. Of course, you will not see the format, fonts, styles, etc., as the contents are pasted as plain text.

For images, though I am not sure, I think right-clicking and selecting “Save As…” is better than using the “Copy” command.

Also read: Clipboard Data Theft – Harden security settings.