Like, you paste into cat, and if you reviewed and want to execute you can just press ctrl-D, and if you don't want to execute then just press ctrl-C.

Is there any character that could cause ctrl-D to be pressed, or is there other forms of attack against this method?

With noscript installed i dont have to worry about hidden scripts running in the background. This isnt an issue just a comment for everyone to install this plugin.
NoScript.net

https://security.love seems to be down…

neat trick, but it doesn't pastejack if I copy with right click-> copy, nor in Linux which auto copies text when selected, or with Firefox add-ons which do the same in Mac OS X. I don't know if there is a solution to that, but maybe you can add it to the 'How do you protect yourself' section of the readme

Instead of copy-pasting.

With X(org) on *nix systems it is common to copy text simply by selecting it and pasting it via middle click. It seems like this procedure is not affected by pastejacking.

Is this assumption correct or are there simply no attempts to cover this yet?

So I totally understand how this exploit works, but I'm curious who we think the target audience is and how well could one actually weaponize such an exploit. To me it seems like a pretty big stretch to get a high value target to copy and paste code off of an untrusted website and into a shell, but I'm open to other opinions and ideas.

First off, this exploit is easily defeated by pasting your clipboard into a benign text editor such as Sublime Text or Notepad. Nothing new here, but if this exploit does start to become a serious problem then I would assume this easy procedure would protect people 100% of the time.

But more interesting to me is the intended targets. It sounds to me like students, web hobbyists, perhaps a rushed dev-ops engineer would be the most likely phishing target. I just can't think of that many users who use the terminal and aren't power users. It's not like MS Word or Photoshop is gonna execute the hidden commands if a user pastes this message into them. But maybe I'm being naive, as we are all becoming more and more computer proficient and maybe more people are using the terminal.

I'm curious to hear any responses or thoughts about this, and thanks again for making the effort to publish this exploit and bring more attention to it.

:)

This currently relies on keydown, but as it turns out you can just do the following

document.addEventListener('copy', function(e){
    e.clipboardData.setData('text/plain', 'Hello, world!');
    e.clipboardData.setData('text/html', '<b>Hello, world!</b>');
    e.preventDefault(); // We want our data, not data from any selection, to be written to the clipboard
});

I'll be adding this soon!

I think it should be mentioned that this doesn't work with zsh, as it only executes commands when the user presses enter, not when pasting a newline.

While pasting text in gedit can be used to verify commands, what about a bash command?

I made a bash function that will show the clipboard safely and gives you the option to execute it after reviewing. You don't need to open any other programs like gedit (and also prevents vim scripts) and can be used on servers (ssh) without a gui.

It needs xclip to be installed. cat is used to display the clipboard and will also show special characters. (pp is for paste protection and it types fast)

function pp {
    xclip -o | cat -A
    echo -ne "\nExecute? (y/n): "
    read execute
    # only execute when 'y' was answered
    # all other input is ignored
    if [[ $execute == "y" ]]; then
        eval `xclip -o`
    fi
}

Example from the demo:

aaron@aaron-pc:~$ pp
echo "evil"$

Execute? (y/n): n
aaron@aaron-pc:~$

aaron@aaron-pc:~$ pp
echo "evil"$

Execute? (y/n): y
evil
aaron@aaron-pc:~$ 

This doesn't seem to work in Chrome Version 50.0.2661.86 (64-bit).

Has anyone found any evidence of this (or the old issue) being used in the wild? I absolutely think that it's a relevant issue, just thought it would be interesting to know if it has been used maliciously.

(I know this technically isn't the correct place to post something like this but I felt like it was the best alternative.)