Topics

Advisory (possible security bypass): you can view contents of the clipboard even from the lock screen #msftenable #narrator


 

Hi all,

The following is a possible security advisory, especially for enterprises and those who work with clipboard a lot:

Someone over at Twitter described a way to view clipboard contents from lock screen, and it turns out it can be done thanks to Narrator.

Steps to reproduce:

  1. Copy something to the clipboard.

  2. Press Windows+L to lock the computer.

  3. Press Windows+ENTER (Control+Windows+ENTER in Creators Update) to bring up Narrator.

  4. Press Caps lock+F1 to open command search window, then paste the clipboard contents.

Expected: clipboard content isn't shown.

Actual: clipboard content is shown, including possibly sensitive data.

Workarounds: none at this time - please don't leave sensitive data on the clipboard.

Thanks.

Cheers,

Joseph


 

Joseph,

         How does one intentionally empty the clipboard?  The only time I've ever done this is when I get a warning from an Office program when I'm exiting that I have a substantial amount of data on the clipboard and the option to purge the clipboard is offered.

         I don't think I've ever done an intentional clipboard purge otherwise, so I have no idea how it would be forced.
--
Brian

        After all, a democracy based solely on the values of the majority, with no overriding ethical principles and processes, is nothing more than clubhouse democracy, great for those on the inside and a tyranny for those who fail to see eye to eye with the majority.

     ~ Paul Noeldner,  May 16, 2007


 

Hi,

At least two ways without restarting the computer: press Print Screen key to capture a screenshot, or type the following into the Run dialog:

cmd /c “echo off” | clip

The second one is a bit safer, as an empty text will be copied to the clipboard.

The tip comes from:

http://www.sysprobs.com/simple-tip-how-to-clear-clipboard-in-windows-10-8-1-and-7

Cheers,

Joseph

 

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Brian Vogel
Sent: Thursday, February 16, 2017 3:39 PM
To: win10@win10.groups.io
Subject: Re: [win10] Advisory (possible security bypass): you can view contents of the clipboard even from the lock screen #Narrator #MSFTEnable

 

Joseph,

         How does one intentionally empty the clipboard?  The only time I've ever done this is when I get a warning from an Office program when I'm exiting that I have a substantial amount of data on the clipboard and the option to purge the clipboard is offered.

         I don't think I've ever done an intentional clipboard purge otherwise, so I have no idea how it would be forced.
--
Brian

        After all, a democracy based solely on the values of the majority, with no overriding ethical principles and processes, is nothing more than clubhouse democracy, great for those on the inside and a tyranny for those who fail to see eye to eye with the majority.

     ~ Paul Noeldner,  May 16, 2007