Copy Pest - A Case Study On The ClipBoard, Blind Trust And Invis...

on YouTube ↗45m

" summary

Demonstrates concrete clipboard XSS: document apps create multiple clipboard “buckets” (HTML/RTF/text), attackers modify styles.xml or document.xml (rename docx to zip), edit fonts with FontForge modified preferred family name, or hex‑edit PDFs to inject payloads; uses entity‑encoded SVG animate and VBS/backtick tricks to bypass sanitizers in Chrome and Firefox and achieve script/iframe execution; builds a working proof: a Flash‑in‑PDF clipboard swap that replaces clipboard after copy. Works across ODT/DOC/DOCX/PDF/XPS/Office 2013/365/LibreOffice and common browsers. Defense: paste‑as‑plain (Ctrl‑Shift‑V) or robust whitelist sanitization.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 5:55Let's go back in time
3. 11:05Clipboard & Notepad
4. 28:26MS Office - Browser

" related talks

• 46mAn Interesting Copy-Paste Case - on the Risks of Pasting...Michał Bentkowski · Oh My H@ck 2020
• 40mStealing With Style: Using CSS to Exploit ProtonMail & FriendsPaul Gerste · Black Hat Asia 2023
• 44mWhen you can't afford 0days: Client-side exploitation for the massesMichele Orru · OWASP AppSecUSA 2014
• 59mBrowsers Gone WildXiaoran Wang, Angelo Prado · Black Hat Asia 2015
• 41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon WaysBrian Gorenc, Jasiel Spelman · Black Hat USA 2014
• 35mPapercuts: Stop the BleedKristine Sihto · Write the Docs Atlantic 2023
• 51mOffice in WonderlandPieter Ceelen, Stan Hegt · Black Hat Asia 2019
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015