Most of the time when we see a code snippet online to do something, we often blindly copy paste it to the terminal. Even the tech savy ones just see it on the website before copy pasting. Here is why you shouldn't do this. Try pasting the following line to your terminal (SFW)
It should look something like this once it is pasted onto your terminal.
You probably guessed it. There is some malicious code between
Malicious code's color is set to that of the background, it's font size is set to 0, it is moved away from rest of the code and it is made un-selectable (that blue color thing doesn't reveal it); to make sure that it works in all possible OSes, browsers and screen sizes.
This can be worse. If the code snippet had a command with
Thanks for reading!
ls
; clear; echo 'Haha! You gave me access to your computer with sudo!';
echo -ne 'h4cking ## (10%)\r';
sleep 0.3;
echo -ne 'h4cking ### (20%)\r';
sleep 0.3;
echo -ne 'h4cking ##### (33%)\r';
sleep 0.3;
echo -ne 'h4cking ####### (40%)\r';
sleep 0.3;
echo -ne 'h4cking ########## (50%)\r';
sleep 0.3;
echo -ne 'h4cking ############# (66%)\r';
sleep 0.3;
echo -ne 'h4cking ##################### (99%)\r';
sleep 0.3;
echo -ne 'h4cking ####################### (100%)\r';
echo -ne '\n';
echo 'Hacking complete.';
echo 'Use GUI interface using visual basic to track my IP'
ls
-lat
It should look something like this once it is pasted onto your terminal.
You probably guessed it. There is some malicious code between
ls and -lat that is hidden from the userMalicious code's color is set to that of the background, it's font size is set to 0, it is moved away from rest of the code and it is made un-selectable (that blue color thing doesn't reveal it); to make sure that it works in all possible OSes, browsers and screen sizes.
This can be worse. If the code snippet had a command with
sudo for instance, the malicious code will have sudo access too. Or, it can silently install a keylogger on your machine; possibilities are endless. So, the lesson here is, make sure that you paste code snippets from untrusted sources onto a text editor before executing it.Thanks for reading!
