Thread: Clipboard hijack

DISCLAIMER:
The following link hijacks your clipboard.However you can change the content of the clipboard by closing the page.

http://garyc.mooo.com:3232/rr/

Normally I have seen websites that are intrusive by opening popups and changing the
homepage.
But this one has gone one-level up by hijacking the clipboard.(although done to amuse the visitor).

I don't have a clue how they do this but I guess it may have something to do with "invisible" flash that loads on that page.
Imagine what would happen if the reverse is also possible?(If the contents of the clipboard can be sent to the site on visiting the site.(esp. if you have sensitive info in the clipboard))
Is the internet becoming more insecure these days?

Edit:
eeks!It does seem to be possible to do the above:
http://www.knowledgebase-script.com/...ticle-421.html

Firefox + flashblock + noscript

[ ] Yes, I'd like to download any piece of content-free crap which has no clear and present use.

It's not encrypted.

Code:

function onEnterFrame()
{
    System.setClipboard(strings.join("\r\n") + "\r" + "\n" + "\r" + "\n");
} // End of the function

var strings = ["We\'re no strangers to love", 
"You know the rules and so do I", 
"A full commitment\'s what I\'m thinking of", 
"You wouldn\'t get this from any other guy", 
"I just wanna tell you how I\'m feeling", 
"Gotta make you understand", 
"Never gonna give you up", 
"Never gonna let you down", 
"Never gonna run around and desert you", 
"Never gonna make you cry", 
"Never gonna say goodbye", 
"Never gonna tell a lie and hurt you"];

var pointer = 0;

Originally Posted by stevesmithx

Is the internet becoming more insecure these days?

The internet's security isn't changing. This stuff has existed for years. Any major insecurities Adobe patches up immediately (the only problem with that is some people run outdated Flash players). MSIE gets tougher on phishing (I would know -wink-). Firefox gets tougher on everything (MSIE hides flash HTTP calls, Firefox doesn't). Plugins are developed to solve these problems (flashblock). We do however discover more bugs as time goes on, obviously. If you've tried to exploit Flash or AJAX, then you would now they are very secure. There's only a few exploits, one of which I'm not telling (only works well on MSIE anyway).

I doubt many programmers use MSIE (Yay!). That includes most of this forum. (Woot!) I found only 30% of my random visitors use MSIE. (Chaching!) MySpacers are definitely big offenders. (WTF!)

Edit: Vrooooooom!

It doesn't hijack anything... it just copies stuff to the clipboard with an interval. It's totally safe.

Thanks all for your replies.
@Salem
Thanks for the info about those extensions.Been using firefox for a long time with popular extensions sans the two you mentioned.

@DAE

It's not encrypted.

Code:

Code:

function onEnterFrame()
{
    System.setClipboard(strings.join("\r\n") + "\r" + "\n" + "\r" + "\n");
} // End of the function

var strings = ["We\'re no strangers to love", 
"You know the rules and so do I", 
"A full commitment\'s what I\'m thinking of", 
"You wouldn\'t get this from any other guy", 
"I just wanna tell you how I\'m feeling", 
"Gotta make you understand", 
"Never gonna give you up", 
"Never gonna let you down", 
"Never gonna run around and desert you", 
"Never gonna make you cry", 
"Never gonna say goodbye", 
"Never gonna tell a lie and hurt you"];

var pointer = 0;

How did you see the code?.I can't see a thing on the page source.
I thought the code was inside that flash component and NOT part of the javascript.

It doesn't hijack anything... it just copies stuff to the clipboard with an interval. It's totally safe.

It does that without user's permission.And after you leave the page open you can't copy
anything else on the clipboard.I think that is intrusive and too much of a "functionality" for a web page.I totally agree that it is safe but not when done in the reverse.

IE has a setting to disallow javascript access to the Clipboard.

Originally Posted by Dino

IE has a setting to disallow javascript access to the Clipboard.

It's not javascript - it's Flash.

@stevesmithx
You can't possibly support removing the clipboard functionality from Flash. It is an essential feature. This problem is another one of those "drive people mad with safe little annoying things". The reality is that intrusive sites simply aren't used and lose their market share.

Didn't you know you can simply decompile Flash files? And ActionScript's syntax isn't as close to Javascript's syntax as people tend to think.

Well, that explains it - it certainly looked like javascript.