LXer: Old tricks are new again: Dangerous copy & paste

LXer · 04-17-2013, 01:11 AM

Published at LXer:

Copying and pasting something does not necessarily mean the user will get what they think they are getting. With a little bit of HTML magic, one can even trick unwitting web site visitors into executing shell commands without their knowledge. The trick is by no means new, but it is currently being demonstrated again on several web sites which means Linux users especially have to be careful what they copy and paste.

Read More...

H_TeXMeX_H · 04-17-2013, 01:42 AM

Lilyterm gives a warning when pasting multi-line text. You can also view the clipboard before pasting.

TobiSGD · 04-17-2013, 04:58 AM

Nice, didn't know that. Sadly Lilyterm does not support showing images with w3mimgdisplay, so changing the terminal to Lilyterm is a no-go for me.

Besides that, any user on any OS should make it clear to himself that before copying any command that he:
a) trusts the website in question
b) understands what the command is doing.

H_TeXMeX_H · 04-17-2013, 05:06 AM

You could copy it to a text document first in case you use other terminal emulators.

TobiSGD · 04-17-2013, 05:10 AM

Right, didn't think about that. Good advice!