[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 2 Dec 2019 08:56:38 -0800
From: Tavis Ormandy <taviso@...il.com>
To: oss-security@...ts.openwall.com
Subject: virtual consoles
Hey List, we were discussing simple screen spoofing attacks today, and
whether we consider it a vulnerability or just social engineering. For
example, this paper on tricks Android malware can use to trick the user
into granting permissions to the wrong app.
https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-ren-chuangang.pdf
Regardless of your position, this is certainly possible on desktop Linux
too, unprivileged users can start a new X server and switch virtual
console, even over ssh.
e.g.
$ dbus-send --system --print-reply --dest=org.freedesktop.login1 /org/freedesktop/login1/seat/seat0 org.freedesktop.login1.Seat.SwitchTo uint32:2
(note: object paths may vary by distro, change the 2 to a different
number if you're already on VT2, or seat0 if you're on a different seat)
The obvious attack is to switch to a fake screensaver, then switch back
after authentication, or make a fake gdm login.
I'm sure this has been documented a million times, and most of us will
be familiar with the "Secure Attention Key" idea, but this is slightly
different from that attack as it's possible for an entirely remote user
(active, physically local users usually have additional privileges, as
it's assumed they can tamper with hardware anyway, etc).
Should this have some policykit action requirement, or require physical
presence? I don't know the answer.
Tavis.
--
-------------------------------------
taviso@....lonestar.org | finger me for my pgp key.
-------------------------------------------------------
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
