Apple Event: May 7th at 7 am PT

> Learn more

> Add to your calendar 

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: Andrew Sinclair1
Andrew Sinclair1 Author
User level: Level 1
5 points

Clipboard being taken over through website

This has happened to me twice now, on two separate computers at work. My clipboard has been hijacked with this:

http://windowsxp-privacy.net/?id=198760083

And once it's in the clipboard, I can't copy anything else over it until I've restarted the machine.

I'm only going to websites that are directly linked off the main page of digg.com, so they're not obscure, and I'm surfing in firefox, though the system wide clipboard is getting taken over, so I can't even copy something over that from a program like TextEdit.

I'm wondering if this has been happening to anyone else and if you you've found a way to take back the clipboard without rebooting.

8-Core PowerMac, iMac, Mac OS X (10.5.4)

Posted on Jul 30, 2008 12:03 PM

Reply
40 replies
User profile for user: orangekay
orangekay
User level: Level 5
4,085 points

Aug 19, 2008 9:23 AM in response to Andrew Sinclair1

That URL triggers a series of redirects, first going to 

http://mytube4.com/soft.php?aid=024209&d=3&product=XPA


and then to 

http://internetscanner2009.com/2009/1/freescan.php?aid=77024209


freescan.php calls 

window.open('_freescan.php?aid=77024209', '_self');


which delivers the obfuscated JavaScript payload. This page references the files 


http://internetscanner2009.com/2009/1/fileslist.js
http://internetscanner2009.com/2009/1/progressbar2.js
http://internetscanner2009.com/2009/1/common.js


If you attempt to download whatever they're offering it sends you 

http://internetscanner2009.com/2009/download/trial/AV2009Install_77024209.exe


which should not do anything on a Mac. I can't find any evidence of JavaScript being able to manipulate the clipboard through Safari, though it is apparently possible in IE and Firefox. Are any of the people complaining of this problem using Safari exclusively?
Reply
User profile for user: CT
CT
User level: Level 7
23,987 points

Aug 19, 2008 12:22 PM in response to orangekay

I know this is a little off topic, but could somebody explain why Flash was ever allowed access to the clipboard in the first place? What is the (legitimate) purpose of this?

Also: it seems like people reporting this always are using Firefox. Presumably the vulnerability (Flash access to clipboard) is universal, i.e., allowed by all properly function browsers with Flash enabled?

Thanks for insights.

charlie
Reply
User profile for user: Kirk McElhearn
Kirk McElhearn
User level: Level 2
164 points

Aug 20, 2008 12:57 AM in response to Andrew Sinclair1

After seeing your post quoted in a Computerworld article, I went to the website whose link you have published, and absolutely nothing happens to the clipboard. I have tried with three different browsers. I don't see how this could do anything to your clipboard, and I think that there's some confusion going on. You're describing - in detail - something that happens on Windows, but you're saying it's happening to your Mac. Others in this thread are saying it's not happening, and find no code on the page that could be doing what you suggest. It makes me wonder if you're serious about what you're saying...
Reply
User profile for user: OldHacker
OldHacker
User level: Level 1
8 points

Aug 20, 2008 5:45 AM in response to CT

I think that you are indeed exactly on topic!
I am not terrible savvy on Mac OS X but I think the following is true.
Any running application (and Flash is an application) can read or write the clipboard at any time.
If you put a password on a clipboard, some program that has arranged to still be running can make a copy of it and presumably send it out of your computer in a UDP packet.
It is not clear what the rules should be for allowing access to the clipboard.
Perhaps only programs 'associated' with the window with focus.
Reply
User profile for user: orangekay
orangekay
User level: Level 5
4,085 points

Aug 20, 2008 10:07 AM in response to STWriter

The clipboard is maintained in memory and anything that is placed on it can be loaded lazily if and when it's actually needed to conserve resources. This is how you are able to copy and past gigantic images in Photoshop without bogging the entire OS down.

There is absolutely no reason why you should have to reboot to kill a Flash ad--just quit the browser and it's gone.

I don't think there are very many Mac users posting in this thread at all.
Reply
User profile for user: fbitterlich
fbitterlich
User level: Level 1
8 points

Aug 20, 2008 11:03 AM in response to STWriter

Realist1953 wrote:
Somewhere on the hard drive is a file holding the contents of the clipboard.


That is complete nonsense. The clipboard is not stored in a file. Plus, it doesn't solve the problem. There is nothing "weird" in your clipboard; the problem is that the Flassh applet, while running, is constantly "updating" your clipboard with that malicious URL. So if you copy something else, it gets overwritten soon after.

Solution: Quit (not close - Quit!) all browsers. That's all.

Sidenote: The concept of a Flash applet having access to my clipboard is just ridiculous.
Reply

Clipboard being taken over through website

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.
Learn more Sign up