What is the risk of copy and pasting Linux commands from a website? How can some commands be invisible? [duplicate]

Question

Like all beginners in the land of Linux, I usually look for websites that contain some useful shell commands, mark it with my mouse, copy it (CTRL + C) and paste it into a terminal.

For example, if I need to install package_name.deb

sudo apt-get install package_name.deb

I will give my root password and install the package_name.deb

When I paste this command to my text editor, it will be something like:

sudo apt-get install package_name.deb && apt-get install suspicious_file.deb 

Second example, if I want to add a new ppa (terminal)

sudo add-apt-repository ppa:some/ppa
sudo apt-get update

When I edit my sources.list, I will find something like:

deb http://ppa.launchpad.net/some-ppa/

and

deb http://ppa.launchpad.net/a_suspicious_some-ppa/

The problem is the second ppa deb http://ppa.launchpad.net/a_suspicious_some-ppa/ is added automatically and without my permission.

As you can see, there is an invisible part. It does not appear on my terminal.

What is the risk of copy and paste from an untrusted website in the terminal and how to fix my operating system?

Answer 1

Websites can append to your clipboard

The risk is exactly what you said it was. It's definitely possible to append malicious commands to the clipboard.

You could even append && rm -rf /* (only executes if the first command was successful), or ; rm -rf /* (executes even if the first command was unsuccessful) and brick certain UEFI devices.

You should also check out Michael's post in this thread for another example.

In the end, it really depends on how creative and malicious a particular evil "hacker" is.

---

But how can you make the commands "invisible" in the terminal?"

1. Method one

   echo test;echo insert evil here;clear;echo installing package
   

   Execution order:

   1. Echo "test" happens
   2. Echo "insert evil here" happens
   3. Actions are "cleared"
   4. Intended action happens here, but you don't see the rest.

   ...

   You can try to scroll up in the terminal window to find the rest of it.

2. Method two

   stty -echo 
   tput smcup
   

   This will disable the terminal from showing what you're typing, so it doesn't appear in the terminal window at all.

   You can try it like this:

   stty -echo;tput smcup;echo evil commands
   expected command
   

Those are just two really rough examples, but show the potential of what can be done to obfuscate commands. Note that it likely doesn't hide from ~/.bash_history unless the hidden commands specifically delete/modify it's contents.

You should assume that there are other ways to do this.

---

Mitigation

I recommend using an addon to disable clipboard manipulation. There are unfortunately ways to get around that, so I'd recommend pasting everything into a GUI text editor before it goes into your terminal, or anywhere.

You need to verify what you're doing. If you don't understand each individual command, you should google it. This is proper tinfoil hattery because copy and pasting can force the commands to auto-execute on many Linux flavors.

---

Repairing your Linux installation

You might not have any idea how deep the rabbit hole goes. Unless you have the time and effort to put into it, I'd suggest you just nuke from orbit, unless you have important files. If you have important files, just back up the non-executable stuff (no pdfs, documents, etc), and then nuke from orbit.

If you have PDFs, you can convert the PDF to post-script, or copy and paste the contents into a text file. With documents, copy and paste the text and format it later.

Answer 2

There is a risk. Websites can use CSS and JavaScript to hide things and then when you copy from that website, you actually copy what they want. @Gumbo provided the example: https://thejh.net/misc/website-terminal-copy-paste.

The fix: Don't copy and paste from websites you don't trust. Or visit them.

Answer 3

Yes, cutting and pasting commands from untrusted web sites can be dangerous. The text you paste will always contain the text you copy, but can have more text before, in between or after that.

On the web page this is done by CSS. Just make the extra text invisible. It will still be copied.

When you paste it in a terminal, the extra text will be shown. However, if it contains a newline it will be immediately executed and the damage will be done. Also, it can contain commands to clear away the extra text.

To avoid the danger paste the text into a text editor. Look it over. And then copy it from the editor to the terminal.

Just... make sure you understand the command well enough that you know it is safe. The other danger of pasting unknown commands is that you can simply don't understand what you are doing.

Answer 4

Besides the excellent answers above, I would add that besides malicious purposes, there are also issues copying&pasting from websites or PDFs due to character encoding.

You may be thinking you are pasting a group of characters, and due to character encoding, be pasting a different things, and having issues difficult to track down.

syslog fails to start

From the thread, the OP thought he had pasted:

file("/var/log/cisco/cisco.log");

But in reality he pasted something like this:

file(▒~@~\/var/log/cisco/cisco.log▒~@~]);