Clipboard being taken over through website

Question

Clipboard being taken over through website

This has happened to me twice now, on two separate computers at work. My clipboard has been hijacked with this:

http://windowsxp-privacy.net/?id=198760083

And once it's in the clipboard, I can't copy anything else over it until I've restarted the machine.

I'm only going to websites that are directly linked off the main page of digg.com, so they're not obscure, and I'm surfing in firefox, though the system wide clipboard is getting taken over, so I can't even copy something over that from a program like TextEdit.

I'm wondering if this has been happening to anyone else and if you you've found a way to take back the clipboard without rebooting.

8-Core PowerMac, iMac, Mac OS X (10.5.4)

Posted on Jul 30, 2008 12:03 PM

Reply

Answer 1

Camelot

Level 9

58,365 points

Jul 30, 2008 12:14 PM in response to Andrew Sinclair1

I don't know what you mean by your clipboard being taken over.

The site itself is bogus (claims to find a slew of viruses on your machine, even though it's Windows-only software and purports to check various Windows-only file names that don't exist on your Mac).

However, there shouldn't be any way it can affect your clipboard. The site itself may appear if you click on a link (or maybe an ad) that points to their site, but I can't see how it can affect you in any way other than the lies it tells.

Reply

Answer 2

Jul 30, 2008 12:40 PM in response to Camelot

When I say "taking over my clipboard" I mean it appears on my clipboard and can't be removed. Whenever I paste, that's what gets pasted. If I copy something else and then paste, whatever I copied isn't actually copied and that string is what gets pasted. I even went and searched the system files for the actual file where the clipboard stores things and couldn't figure out how to remove it from there (though I didn't try just deleting it, just in case it would mess with the system).

And yeah, I checked out the site after it started doing that to see who was doing that and if there was any way to track them, report them, whatever, and it was pretty obviously a crock. I didn't click on anything on that page, and I didn't visit it until after it had taken over my clipboard (actually, the first time I visited was because I copied a word to search for and pasted it into the firefox address bar, because it usually just takes you to a Wikipedia search for that word, and wound up at the site because I was too hasty in hitting the return key after pasting to make sure it had pasted properly). And actually, on this computer (the 2nd one), I haven't visited that site at all.

I do know there are ways to make pages copy things to clipboards (normally I've seen them used where you clicked a button before it copied), but I've never seen an instance where it would then prevent you from copying anything else.

Reply

Answer 3

ziddey

Level 1

9 points

Jul 31, 2008 10:59 AM in response to Andrew Sinclair1

I believe it's a malicious ad that abuses flash, or possibly java. As long as the ad is open, it'll constantly be putting the link into your clipboard, so pretty much as soon as you put something there, it'll already be overwritten.

I run over 80 tabs at once in firefox so it's hard to keep track of everything. But once when I was resuming my session, I got plagued by it. I tried to track it down since it's ****** cool of an exploit, but I couldn't find it. I killed firefox and then resumed the session again. Different ads loaded and this time I wasn't affected.

I'm surprised more people aren't reporting about this. Guess people don't use the clipboard much?? This is also the second time I've seen this, and also on a different computer.

edit: I see that many websites have a "copy to clipboard" using javascript/ajax. Perhaps this could be involved in the exploit.

Message was edited by: ziddey

Reply

Answer 4

Jul 31, 2008 11:22 AM in response to Andrew Sinclair1

Same thing happened to me today. As soon as I closed the firefox tab that had digg open, my copy-paste started working again.

Reply

Answer 5

Jul 31, 2008 8:01 PM in response to Andrew Sinclair1

First off, I realize I am in the Mac section of the forums...but this thread was the only one on the internet addressing this issue according to Google.

I am experiencing the same problem. After copying a feed URL from lime.com I pasted it into Itunes. Now, no matter what I copy, http://windowsxp-privacy.net/?id=198760083 is the only thing that will paste. I ran a cleaner, going to try a few other things.

Reply

Answer 6

Aug 2, 2008 2:11 AM in response to mikdashim

Yeah, that's why I started this thread, I couldn't find anything about it online, so partially this was seeing if it was some sort of bug that was being exploited or what, and partially it was just getting this talked about. I think it's a bit messed up that this company (or their advertisers) are doing something like this, and weird that no one had brought it up/complained/whatever. So I'm glad it's drawing attention from beyond just apple discussion lists.

Oh, and just checking, it's still there for you after you quit your web browser and whatnot? And after a restart?

Message was edited by: Andrew Sinclair1

Reply

Answer 7

Aug 2, 2008 1:19 PM in response to Andrew Sinclair1

It isn't happening anymore except when I got to that particular site and copy the feed URL. Very strange.

Reply

Answer 8

Aug 6, 2008 4:50 PM in response to Andrew Sinclair1

Woah, I've started getting this too. I was using facebook at the time and tried to copy and paste a youtube clip someone had uploaded to me. That's it. Let me know if you find the offending code. Grrr.

Reply

Answer 9

krystyl

Level 1

0 points

Aug 9, 2008 1:44 PM in response to Andrew Sinclair1

has anyone figured out how to remove this yet? it is driving me up a wall!

Reply

Answer 10

Aug 11, 2008 1:47 PM in response to Andrew Sinclair1

This happened to my friend on his practically brand new 10.5.4 Mac Book Pro (4GB RAM).

Is this some sort of virus or what?

Message was edited by: Steve Lewis

Reply

Answer 11

Aug 11, 2008 7:49 PM in response to ziddey

I'm not a web developer so the code is meaningless to me but to view it without the issues reported here, I temporarily changed Safari's Security Preferences to disable Java, JavaScript and Plug-ins. There is some JavaScript there but again, not being HTML savvy, I can't say what it's doing or why.

You can also enable the 'Develop' option within Safari which will give you additional options (disable site specific hacks etc...)

Reply

Answer 12

Aug 12, 2008 8:26 AM in response to Andrew Sinclair1

Nope, rebooting cured it and it hasn't recurred.

What browser were you using at the time? I was using Safari 3.1.2 at the time.

Reply

Answer 13

Aug 16, 2008 9:27 PM in response to Andrew Sinclair1

I came here from The Register and their article: http://www.theregister.co.uk/2008/08/15/webbasedclipboardhijacking. I copied and pasted the link they referenced <xp-vista-update.net> to the FF3.0 URL bar and the link sent me to google. I queried google for the link and there seems to be a lot of stuff out there now about it.

I closed FF, then relaunched it and the link was still on the clipboard. I fired up Safari (3.1.2) and the link was still on that clipboard. Restarted the computer and the link was no longer on the clipboard. Very weird.

Reply

Answer 14

Aug 17, 2008 2:18 AM in response to Andrew Sinclair1

These guys are the worst kind of people around the net. Looking at the code I couldn't belive how dishonest they are: if you let the thing run you will get a piece of trash either you say yes or no. Maybe they should get sued or something.

Reply

Answer 15

STWriter

Level 1

5 points

Aug 19, 2008 8:07 AM in response to Andrew Sinclair1

Check this article

http://news.bbc.co.uk/2/hi/technology/7567889.stm

This site tells about the hijacking of the clipboard. I clicked on a link in a known-sourced email {reunion.com} and it went to "theregister" and "ran" their virus check even though I tried to select cancel.

Can anyone tell me where the SOURCE PAGE or FILE for the clipboard is on the MAC?? I want to see where it is physically on the PC. And I will check the html source on the page that takes me there to try to find the offending link. And WHY is it "hard to delete"??

So far, when this pops up on my PC, I have had to open "Activity Monitor", select FireFox, and do a "Force Quit" to stop the thing. Though I suspect the thing was still there -- I typed in the link [reunion.com] in the address bar and it still went to the fake site. THAT makes me think they may have taken over the DNS site --- though maybe Firefox / PC used a local copy of the addresses instead of flushing & going to a real DNS web server.

Reply