What is clipboard hijack attack? - Definition from WhatIs.com

Definition

clipboard hijack attack

Part of the Malware glossary:

What is a clipboard hijack attack?

A clipboard hijacking is an exploit in which the attacker gains control of the victim's clipboard and replaces its contents with their own data, such as a link to a malicious Web site.

The attack makes it impossible for users to copy anything else to the clipboard until they either close the browser or reboot the machine. Aside from the nuisance factor, the danger is that a user might inadvertently paste the inserted content into their browser or into online content, exposing themselves or others to malicious code.

In August 2008, there were reports of clipboard hijack attacks conducted through Adobe Flash-based ads on many legitimate Web sites, including Digg, Newsweek and MSNBC.com. The coding is in Shockwave files and uses a method called System.setClipboard() that repeatedly flushes and replaces clipboard contents. If users follow the inserted link, they are taken to a fake security software site warning them that their systems are infested with malware. The purpose of the attack is to get users to download fraudulent software, putting personal information at risk in the process. All major operating systems and browsers are vulnerable to the attacks, as long as Flash is installed.

Adobe has since announced it will add a mechanism to the next version of Flash that allows users to grant or deny access when a Shockwave file tries to load data to the clipboard.

Learn More About IT:
> BBC News reported on the Flash clipboard hijack attacks.
> PC Magazine's Security Watch blog has more information about clipboard hijacking.
> The Spyware Sucks blog covers clipboard hijack attacks and includes links to more information.
> Security researcher Aviv Raff created a clipboard hijack demo. (You'll have to close your browser to get rid of the link in your clipboard.)

This was last updated in September 2008
Posted by: Margaret Rouse

Related Terms

Definitions

  • car hacking

    - Car hacking is the manipulation of the code in a car's electronic control unit (ECU) to exploit a vulnerability and gain control of other ECU units in the vehicle.   (WhatIs.com)

  • man-in-the-middle attack (MitM)

    - A man-in-the-middle attack is one in which the attacker secretly intercepts and relays messages between two parties who think they are communicating directly with each other. (SearchSecurity.com)

  • fileless infection (fileless malware)

    - Fileless malware is written directly to RAM rather than being installed and existing in a device's hard disc storage. Because the malware doesn't exist as a file, it can elude intrusion prevention ... (WhatIs.com)

Glossaries

  • Malware

    - Terms related to malware, including definitions about viruses and Trojans and other words and phrases about malicious software.

  • Internet applications

    - This WhatIs.com glossary contains terms related to Internet applications, including definitions about Software as a Service (SaaS) delivery models and words and phrases about web sites, e-commerce ...

Ask a Question About clipboard hijack attackPowered by ITKnowledgeExchange.com

Get answers from your peers on your most technical challenges

Tech TalkComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.