News for hackers. Stuff that matters.

A comment on OS X is now macOS and gets support for Siri, auto unlock. Parent comment

Re:OS X is now macOS and gets support for Siri, auto unlock by cwkoss on Monday June 13, 2016 @05:21PM (#11897761)
This enables an interesting new kind of attack.

1. Attach an attack device to someone’s account.

2. ‘Poll’ the clipboard by pasting every ~5 seconds.

3. If the contents of the clipboard appear to be ‘secure’ (looks like shellcode, bitcoin address, url, etc), quickly replace the contents with an attack string with same datatype.

If you have an untrusted device attached to your Apple account, your local clipboard can no longer be trusted.

[ Parent | on HN ]
Re:OS X is now macOS and gets support for Siri, auto unlock by motti on Monday June 13, 2016 @09:53PM (#11899233)
Indeed, WHATWG is currently considering [1] a related scenario where rogue websites with access to the clipboard will inject formats with dodgy payload to exploit flaws in some app if the user pastes.

[1] https://github.com/whatwg/html/issues/1244

[ Parent | on HN ]
Re:OS X is now macOS and gets support for Siri, auto unlock by stephenr on Wednesday June 15, 2016 @01:09PM (#11910547)
It's unrelated to "apple account" it works over Bluetooth LE.
[ Parent | on HN ]