Clipboard Hijacking
|
|
The attack makes it impossible for users to copy anything else to the clipboard until they either close the browser or reboot the machine. Aside from the nuisance factor, the danger is that a user might inadvertently paste the inserted content into their browser or into online content, exposing themselves or others to malicious code.
In August 2008, there were reports of clipboard hijack attacks conducted through Adobe Flash-based ads on many legitimate Web sites, including Digg, Newsweek and MSNBC.com.

Adobe has since announced it will add a mechanism to the next version of Flash that allows users to grant or deny access when a Shockwave file tries to load data to the clipboard.
Malicious hackers are using booby-trapped Flash banner ads to hijack clipboards
for use in rogue security software attacks. In the Web attacks, which affect
Mac, Windows, and Linux users running Firefox, IE, and Safari, bad guys are
seizing control of the machine's clipboard (probably using the Flash command
setClipboard) and inserting a hard-to-delete URL that points to a fake
anti-virus program. A number of legitimate sites have been seen to host acs
carrying the attack including Newsweek, Digg, and MSNBC.com. Researcher
Aviv Raff offers a harmless demo of how it's done.
Interesting bit from the Flash documentation
-
The System.setClipboard() method allows a SWF file to replace the contents of the clipboard with a plain-text string of characters. This poses no security risk. To protect against the risk posed by passwords and other sensitive data being cut or copied to clipboards, there is no corresponding getClipboard(read) method.
- In Flash Player 9, ActionScript could set data on the system Clipboard at any time. With Flash Player 10 beta, the System.setClipboard() method may be successfully called only through ActionScript that originates from user interaction. This includes actions such as clicking the mouse or using the keyboard. This user interaction requirement also applies to the new ActionScript 3.0 Clipboard.generalClipboard.setData() and Clipboard.generalClipboard.setDataHandler() methods.
- This change can potentially affect any SWF file that makes use of the System.setClipboard() method. This change affects SWF files of all versions played in Flash Player 10 beta and later. This change affects all non-application content in Adobe AIR, however, AIR application content itself is unaffected.
- Any existing content that sets data on the system Clipboard using the System.setClipboard() method outside of an event triggered by user interaction will need to be updated. Setting the Clipboard will now have to be invoked through a button, keyboard shortcut, or some other event initiated by the user.
References:
http://whatis.techtarget.com/definition/clipboard-hijack-attack.html
http://it.slashdot.org/article.pl?sid=08%2F08%2F20%2F0029220
Comments (0)