[200 OK]: A Port80 Software Blog

We're all 200 OK: Web, HTTP and IIS Insights
posts - 203, comments - 424, trackbacks - 100

Pssst... I think your clipboard is showing: More JavaScript Security Fun

Those of us who spend lots of time typing at a keyboard probably love the dynamic duo of CTRL-C and CTRL-V on Windows. Why type in some repeated content, password, WEP key, or other string of information when you can quickly copy and paste it from a magic buffer (I had a teacher who once said, "Ah, cut and paste -- the two most powerful tools in language").

There is only one problem, Web surfers: this buffer is exposable for all Internet Explorer users using IE 6 or lower, a gaping security and privacy hole! See http://msdn.microsoft.com/workshop/author/dhtml/reference/objects/clipboarddata.asp for more...

If you leave something lying around on your clipboard, a "bad guy" can read the data and then use Ajax or something even as simple as an invisible <iframe> post or image request to send the leftover data. Now, granted, there might be junk on your clipboard, but there just might be treasure as well. Let's see what you have on your clipboard right now, shall we?:




Did you have anything on your clipboard? Hmmm. Now, let's really test the clipboard security issue in action with a demo. First, visit this page:

http://www.port80software.com/200ok/examples/secret.html

On this page, copy some text to your clipboard either with the menu (Edit, Copy) or using CTRL-C. Now, follow the link in that page, which will take you to another page...

Yikes! Notice that this page will show you what was on your clipboard!!!

Also, note that the clipboard object doesn't seem to follow JavaScript's same origin security policy or really care what domain the content was copied from. The demo clearly shows that you copy on the port80software.com domain and view on the w3compiler.com domain. Double yikes!

So, the moral of this blog post is: be careful what you Copy-Paste, you never know who might be reading it!

Browse on,
Port80

posted on Tuesday, August 08, 2006 11:24 AM

Feedback

# re: Pssst... I think your clipboard is showing: More JavaScript Security Fun

IE 7 Beta 3 asked me to confirm that I wanted the page to have access to my clipboard. Or was this part of your demo?
8/8/2006 12:32 PM | Joe

# re: Pssst... I think your clipboard is showing: More JavaScript Security Fun

Yes, good point.

This has been fixed for the beta users of IE 7, but not for IE 6 or lower... so watch your back, Jack, if you are not betaing IE7.

8/8/2006 12:53 PM | Chris @ Port80

# re: Pssst... I think your clipboard is showing: More JavaScript Security Fun

Also, it should noted that this hack only works for text on the IE 6 or eariler clipboard... not an image, etc.
8/8/2006 2:11 PM | Chris @ Port80

# re: Pssst... I think your clipboard is showing: More JavaScript Security Fun

Sorry, Eric -- we accidently deleted your comment while cleaning out some comment spam from the blog. Here it is again...

Comments from [200 OK]: A Port80 Software Blog:

Sender: Erik Bailey
Url:
IP Address: 160.109.98.44
=====================================

re: Pssst... I think your clipboard is showing: More JavaScript Security Fun

In IE6 this can be changed via Tools / Internet Options / Security / Custom Level / Scripting / Allow paste operations via script -- set to &quot;Prompt&quot;. This is a wise thing to do!

Source: http://www.port80software.com/200ok/archive/2006/08/08/2484.aspx#2547
8/11/2006 1:00 PM | Chris @ Port80

# Internet Explorer Turned 7 This Month

10/26/2006 11:34 AM | [200 OK]: A Port80 Software Blog

Post Comment

Title:  
Name:  
Url:  
Comment:  
Verify:
(Enter the word as it appears in the box above.)