9 ms·

Wayland Keylogger

111 points by Jkvngt 6y ago

tinus_hn 6y ago
Windows is arguably more secure because it has the secure desktop that isn’t controlled by user applications. Unfortunately it doesn’t help with all kinds of password entry.
- Blikkentrekker 6y ago
  So does Android, but the same security is what creates a “walled garden”. To limit what malicious software that runs as one's user can do, one must limit what the user can do, and that's exactly what they attempt to do. I personally præfer that the user be trusted to be wise enough to run software that he does not trust in a contained environment, and he be given the freedom to control his own environment as he pleases.
  - canofbars 6y ago
    >To limit what malicious software that runs as one's user can do, one must limit what the user can do This is completely untrue. You can gain root access on Android and have full access to do anything while still keeping applications sandboxed. Limiting user freedoms is simply an extra thing that came with new mobile OSs.
    - Blikkentrekker 6y ago
      With “the user” I mean “user” in the operating system sense, not the human being. Many “users” on Unix do not correspond to any particular physical human being.
  - tinus_hn 6y ago
    That’s not what the secure desktop is. Windows has the normal desktop that shows your programs and separate desktops for special purposes. There is a desktop where your screensaver runs. So if your screensaver crashes it is not possible for your screen to show up. Another desktop is where the login screen is on. Normal programs can’t connect to that desktop so they can’t capture your keystrokes as you type your password. This isn’t about ‘walled gardens’.
- greggyb 6y ago
  Keepass can take advantage of the secure desktop to unlock the password database, and has multiple methods for entering passwords, including a method that mixes clipboard actions and auto-typing. It's not perfect, and anything that can log keys and monitor the clipboard would be able to sniff passwords. That said, it's a pretty good set of mitigations.
sam_lowry_ 6y ago
So, all the fuzz about Wayland security and how it is good security to kill window managers at will... comes out totally void.
- Kaze404 6y ago
  Isn't one of the most popular Wayland clients a window manager? I'm confused.
  - sprash 6y ago
    There is no such thing as a window manager on Wayland. Everything is baked into one centralized "compositor". AFAIK some compositors like Weston offer a non-standardized plug-in interface that allows a 3rd party to implement a window manager as a shared object. But so far I haven't seen anybody use it.
- znpy 6y ago
  yes but you're getting downvoted because HN doesn't like people actually realizing stuff.
  - canofbars 6y ago
    No one who understands wayland was under the delusion that wayland would protect against an application which has full access to your user directory. Wayland becomes secure when combined with an application sandbox using SELinux/flatpak. Previously you could sandbox the app and X would provide an escape.
    - znpy 6y ago
      Yes, I am aware about this. Yet the most common way to denigrate Xorg is to assert that Xorg is basically a keylogger. Which might be true, but as this post shows just switching to Wayland doesn't offer any additional protection under the key-logging point of view. You might combine a sandboxing technique with Xorg too, by the way.
hertzrat 6y ago
It’s pretty amazing that after all these years there is so little malware on Linux and in foss. The community really has somehow remained almost completely trustworthy. I don’t know of many other examples of that. Nobody trusts free as in beer software, but if it’s open source, we have barely had to even think about whether it’s safe or not because it has almost always been so - even tiny one-maintainer projects
- indymike 6y ago
  After dealing with hosting websites for paying customers on shared servers I'm not so sure that you can assume Linux is free of being targeted. Linux the OS may not be targeted, but Linux software like WordPress (and many others) is under constant attack. What is interesting is that the payload the hacker is trying to deliver often is not a rootkit - a bot node can run just fine as a user process on a Linux (or BSD) server. I've had to clean up: evil javascript injected into content, control servers for botnets, email relays, phishing farm software, chat servers and one time a whole CRM system. The one thing that was nice in every case was that Linux did a great job of isolating the hack to a single user's files.
  - samus 6y ago
    Linux would be targeted for sure if the exploits were easier to pull of. Because then the things you just described could be done to all the users on the system simultaneously.
- nemothekid 6y ago
  >It’s pretty amazing that after all these years there is so little malware on Linux and in foss. There's plenty of malware in Linux; it's just never called malware. I'm generally more wary of installing random software on a Linux box than I am on my personal macOS machine. When I ssh into a customer's machine to discover a bitcoin miner that is definition of malware; and there have been plenty of exploits that involve shodan style scans that take advantage of server software with poor defaults.
the_duke 6y ago
I do use Linux (almost) exclusively, but I'm well aware of the security limitations. Forget this keylogger. All you need is to somehow write a single line into .profile or .bashrc, which basically every executed program can do, and you own the user account. You can intercept every program with wrappers by changing PATH or adding desktop entries in .local/share/applications, extract all data from applications, use LD_PRELOAD like shown in the submission ... the possibilities are endless. There isn't even a single decent dynamic firewall with those annoying popups. Apart from SELinux, there is also firejail [1], which I use to sandbox browsers. Flatpak and Snap are also trying to solve both the packaging and the sandboxing aspect, with moderate success. They also increase the risk due to lack of centralized package ownership, so require a very solid sandbox. The only reason why the Linux desktop is somewhat secure is the reliance on official package repos, the trustworthiness of the open source communities, and the and the relatively small target group. I do believe that the path forward has to be Mac OS/Android/iOS style sandboxing - especially for everything not directly from an official repo, but there seems to be relatively little interest in the ecosystem. Non Linux specific sidenote: ever notice how many VS Code extensions download random binaries from the net? Or just that they can execute arbitrary code? Compromising one of those could lead to some glorious returns for malicious actors, with potential access to lots of source code, credentials and internal networks. Bottom line: if you touch any sensitive data or work with secure systems at all, you have to be extremely paranoid about your machine - no matter what OS you are on. [1] https://firejail.wordpress.com/ https://firejail.wordpress.com/
- Jkvngt 6y ago
  Forget it? It’s the main selling point of Wayland that keyloggers are impossible.
  - deleted 6y ago
    [deleted]
  - Blikkentrekker 6y ago
    It's hardly the main selling point, but yes, it's often stated in such language that is sufficiently bereft of technical specifics so that the lay user reading it will gain the impression that the aforementioned proof of concept is not possible, but also that, when præsented with it, semantics arguments can be fronted that are more technical, to allow a statement that it wasn't so intended. On a more practical level: if the statement indeed eventually be phrased so that it does come with the technical truth, the practical gains are not of security, but performance, and only when not using nVidia cards. Better phrased, it is: > The current state of Wayland is that it allows for better hardware acceleration when sandboxing on X11 , except with nVidia cards, where on many compositors it does not allow allow for hardware acceleration at all. X11 allows for similar sandboxing by way of a nested server, but hardware acceleration is insufficiently implemented as of this moment. — this is not a theoretical impossibility and it could be implemented; it simply isn't fully, at this time.
theamk 6y ago
this seems completely miss the point of wayland security. Of course if you run the programs under same account you can keylog them. You can also connect to Chrome and steal the cookies directly, wrap terminal to install pty loggers, backdoor ssh and so on. The real point of wayland security is you can safely run multiple user accounts on the same desktop. And the LD_PRELOAD tricks (or PATH tricks etc..) do not work across accounts, unless you are doing something stupid. I wish people would stop saying silly things like "But for any possible way to break it, I could add countermeasures as well. Applications could use 'getenv' ....". That's not how you break keyloggers! You break them with privilege separation. The least-code version would be: 1. Create a separate user for web browsing, with its homedir and all 2. Create "/etc/sudoers.d" entry to launch browser which does not require password, but also does not allow any arguments, enforces HOME and only passes through a small subset of env vars 3. Launch your browser with "sudo -H -u browser-user firefox". Make it a desktop shortcut or something so you are not tempted to enter your password if someone messes with the shortcut. that's it -- this will stop this attack, and many others, cold. And will not require any SELinux.
- Blikkentrekker 6y ago
  > this seems completely miss the point of wayland security. The point is that Wayland security is useless because the security boundary on Unix is fundamentally the user account: > Of course if you run the programs under same account you can keylog them. You can also connect to Chrome and steal the cookies directly, wrap terminal to install pty loggers, backdoor ssh and so on. > The real point of wayland security is you can safely run multiple user accounts on the same desktop. And the LD_PRELOAD tricks (or PATH tricks etc..) do not work across accounts, unless you are doing something stupid. If this indeed be the point, then I ask you to come with a single official Wayland reference that promotes it as such and phrases it as such, as that is not the point the advocates make at all, and they phrase it simply as “One can no longer be keylogged by malware.”, which is a very dubious claim. Once malicious software has been executed as one's user, that is the end of it, and one's entire account can now be treated as forfeit, and Wayland does nothing, and cannot do anything due to the fundamental designs of Unix to stop that. Furthermore, there are already quite a few mechanisms on X11 to achieve what you illustrated. — that does not mean that Wayland is useless, it simply means that it does not provide a solution to any existing problem in this specific field that is not provided elsewhere. There are two common claims that are very frequently made by official sources such as GNOME that are false: - X11 cannot be sandboxed. - With Wayland, one cannot be keylogged. > that's it -- this will stop this attack, and many others, cold. And will not require any SELinux. Yes, never running malicious code with the privileges of one's user would stop it from gaining access to said user, but the promises of Wayland are protections even if the former have happened. — this is false advertisement.
rhn_mk1 6y ago
> This program is in no way meant as criticism of the Wayland project. It simply demonstrates that creating a secure desktop requires more than just a few server-side restrictions. This is the right takeaway. Unfortunately, given the previous paragraph and the name, I suspect a lot of people are going to think "Wayland is insecure, so why bother?". The reality is closer to "many parts of Linux are insecure, and Wayland closes one of the holes".
- skymt 6y ago
  I'm not sure it's even accurate to say that Wayland closes one of the holes when the hole Wayland closes isn't part of the system's security boundaries. It's like installing a deadbolt in a door standing in the middle of a room.
  - Spivak 6y ago
    The "user is the only security boundary" ship sailed long ago with, chroot, SELinux, AppArmor, Snap, Flatpak, namespacing. It will continue to be a bumpy ride retrofitting an ecosystem not made for the tighter boundaries but it's still the goal.
    - Blikkentrekker 6y ago
      Many of those work by running processes under what is effectively a subuser. The problem with it is, that it works fine when one purely speak of being able to write and read from files, but the moment servers such as display servers or Pulsaudio and DBus come into play, the picture becomes more difficult. All of those technologies work on a simple binary level where the subuser has access to the socket, or it does not, for finer grained control the kernel is required to speak the protocol, which will obviously not happen. So, those services themselves must come with a means to filter communication appropriately, and sandboxing technology is beholden to the extent thereof. Flatpak had to provide an alternative DBus-proxy server to do this with DBus, similar to using nested X11 servers; no solution has been reached for Pulseaudio, whereof I know, and no plans even exist for a variety of more obscure servers that software might need to communicate. For instance, ZNC can be instructed from the IRC client to load modules that contain arbitrary code. Therefore, any IRC client that has acces to ZNC has ZNC's full capabilities, as it does not come with such finer granulation as of this moment. If any sandboxing technology is to be effective, a large number of servers that are in common use often need to provide specific support for that specific sandboxing technology, or simply not be accessible at all from within it.
jstarks 6y ago
Why does this say (2021) when the last commit was in 2014?
- Jkvngt 6y ago
  Still works great, too! How long until Wayland developers fix this, another seven years?
  - theamk 6y ago
    Ugh, they cannot fix it because this is not something that wayland can fix at all. Look, if you have user access to the account, you can get its data. Even if you somehow make Wayland 100% secure, you can still replace “firefox” shortcut with malicious version which also steals all your passwords. No windowing aystem involved at all.
    - Jkvngt 6y ago
      But bleargh, why do Wayland proponents always seem to bring up keyloggers? That’s icky.
      - zlynx 6y ago
        The X11 protocol allows any client connected to the server to become a keylogger or insert input events. So, even a X11 client trapped in a sandbox or another user account has full access.
      - theamk 6y ago
        Do you mean "opponents"? For example, this post is the only post on HN about wayland keyloggers, and it is clearly written by Wayland opponents.
      - dralley 6y ago
        Because the X11 protocol itself enables every X app to keylog every other app without any "hacks" involved, which is what this is. It's the difference between having a poor quality lock on your door and having no door at all.
tubularhells 6y ago
SE Linux is enabled by default in Debian, Ubuntu, Fedora and Manjaro (iirc), so I stopped reading at the introduction. The exploit presupposes the lack of this basic hardening.
- krick 6y ago
  I'm not sure how it helps here. User-level access in enough, isn't it?
  - Jkvngt 6y ago
    It is.
  - freeone3000 6y ago
    SELinux is more fine-grained than user-level access: it implements application-level access. Even if you, as a user, can access a file, an application working on your behalf cannot do so; same for launching applications.
    - danieldk 6y ago
      Indeed, Russell Coker even has a public demo machine (I don't know if it still works) where anyone can log in as root/uid 0, and still can't do much useful due to the SELinux policies on the machine: https://www.coker.com.au/selinux/play.html https://www.coker.com.au/selinux/play.html
- danieldk 6y ago
  Of those distributions, only Fedora sets SELinux to enforcing by default. Moreover, AFAIK Fedora (and RHEL) are the only distributions that had wide-scale testing of the reference policy [1] [2]. So, if you enable SELinux with the reference policy on the other distributions that you mention, it is likely that you will run into all kinds of issues. [1] https://github.com/SELinuxProject/refpolicy https://github.com/SELinuxProject/refpolicy [2] https://github.com/fedora-selinux/selinux-policy https://github.com/fedora-selinux/selinux-policy
CyberRabbi 6y ago
If we’re being honest, this keylogger is not exploiting a weakness in wayland. So it’s a bit clickbait to call it a “wayland keylogger”
- forgotpwd16 6y ago
  It doesn't exploit a Wayland weakness but it's written specifically for Wayland. Maybe "Wayland keylogging patch" will have been better.
arghwhat 6y ago
The position of the Wayland project is that security isolation requires sandboxing. Otherwise, applications can do whatever you can do, including changing all your personal config files and scripts. The security considerations in Wayland are primarily aimed at not being a weak link undermining sandboxing efforts, which is the case with X11. Without sandboxing, writing to e.g. ~/.profile would in most cases be enough for a malicious application to take over the machine. Equivalents apply to all platforms.
- znpy 6y ago
  > The position of the Wayland project is that security isolation requires sandboxing. which is not really a step forward since now I have do go and sandbox every app.
  - canofbars 6y ago
    You don't have to, package maintainers and developers do. Flatpak gives them the tools to do this. Flatpak solves a lot of other problems like making program installs a user level task without touching the OS. Which is needed because in the future the OS will be an immutable image.
  - Spivak 6y ago
    You always had to. There’s no magic universe where an app has the full privilege to do everything you as a user can do while also preventing it from doing things that you could do. Whatever mechanism that enforces those restrictions is the sandbox.
  - arghwhat 6y ago
    No. It's a step forward because you can, but it's ultimately up to you. You're still better off with Wayland, but no matter what you use, there's a huge glaring security hole if things are not sandboxed.
ddevault 6y ago
If you put a nice lock on your door and leave your window open, then a crook can still get in. Wayland is a nice lock. This "keylogger" depends on having arbitrary code execution as your user, outside of a sandbox. The same technique could be applied to backdoor literally anything. In other words, it requires being on the other side of an airtight hatch. https://devblogs.microsoft.com/oldnewthing/20200318-00/?p=103569 https://devblogs.microsoft.com/oldnewthing/20200318-00/?p=10... Wayland does not allow programs to use the Wayland protocol to snoop on other programs. X11 does allow this. That's the key distinction. Wayland does nothing to prevent programs from snooping on each other using any of the other features of your operating system. Wayland is only one part of a secure system. I wish we'd stop having this fucking keylogging discussion already.
FloatArtifact 6y ago
One of my main gripes unfortunately Wayland does not function very well with accessibility software without elevated privileges. Areas include but not limited to : -simulated keyboard/mouse input (some progress recently with some composers) ability to inspect window attributes (e.g. window title, executable and handle) ability to manipulate windows (e.g. maximise, close, etc) Considerations do need to be made in the framework / protocol for accessibility. I'm hoping the situation has changed. Possibly someone could comment on that.
- kaba0 6y ago
  I doubt it has changed all that much, but an accessibility software need not be on the same privilege level than an ordinary one, so it is entirely possible to propose an accessibility extension to query basically everything and explicitly enable these methods for a specific program. Unfortunately accessibility softwares are not all that good on linux as far as I know.
dathinab 6y ago
It's just anoter LD_PRELOAD key logger not really a wayland keylogger. Let's be honest with LD_PRELOAD you can currently get pretty much anything. Through you can setup SeLinux to make such attacks impossible or at least much harder needing other vulnerabilities/insecure design to succeed. But some programs abuse LD_PRELOAD for various reasons. Also there are so many other ways to undermine security that once you locked everything down Linux became supper hard to use. The funny think is, non of this attack vectors are a major problem for server/embedded or similar non-desktop Linux use cases. As in them you can normally run a hardened Linux, where such attacks simple are not possible. It hints to how Linux is not really designed as a desktop system. And IMHO is fundamentally unsuited to become a modern desktop (or handy) OS without changing it so much, that's not really Linux anymore. This is also why I never had much hope for the libre phone.

111 points by Jkvngt 6y ago

Windows is arguably more secure because it has the secure desktop that isn’t controlled by user applications. Unfortunately it doesn’t help with all kinds of password entry.

Blikkentrekker 6y ago
So does Android, but the same security is what creates a “walled garden”. To limit what malicious software that runs as one's user can do, one must limit what the user can do, and that's exactly what they attempt to do. I personally præfer that the user be trusted to be wise enough to run software that he does not trust in a contained environment, and he be given the freedom to control his own environment as he pleases.
- canofbars 6y ago
  >To limit what malicious software that runs as one's user can do, one must limit what the user can do This is completely untrue. You can gain root access on Android and have full access to do anything while still keeping applications sandboxed. Limiting user freedoms is simply an extra thing that came with new mobile OSs.
  - Blikkentrekker 6y ago
    With “the user” I mean “user” in the operating system sense, not the human being. Many “users” on Unix do not correspond to any particular physical human being.
- tinus_hn 6y ago
  That’s not what the secure desktop is. Windows has the normal desktop that shows your programs and separate desktops for special purposes. There is a desktop where your screensaver runs. So if your screensaver crashes it is not possible for your screen to show up. Another desktop is where the login screen is on. Normal programs can’t connect to that desktop so they can’t capture your keystrokes as you type your password. This isn’t about ‘walled gardens’.
greggyb 6y ago
Keepass can take advantage of the secure desktop to unlock the password database, and has multiple methods for entering passwords, including a method that mixes clipboard actions and auto-typing. It's not perfect, and anything that can log keys and monitor the clipboard would be able to sniff passwords. That said, it's a pretty good set of mitigations.

sam_lowry_ 6y ago

So, all the fuzz about Wayland security and how it is good security to kill window managers at will... comes out totally void.

Kaze404 6y ago
Isn't one of the most popular Wayland clients a window manager? I'm confused.
- sprash 6y ago
  There is no such thing as a window manager on Wayland. Everything is baked into one centralized "compositor". AFAIK some compositors like Weston offer a non-standardized plug-in interface that allows a 3rd party to implement a window manager as a shared object. But so far I haven't seen anybody use it.
znpy 6y ago
yes but you're getting downvoted because HN doesn't like people actually realizing stuff.
- canofbars 6y ago
  No one who understands wayland was under the delusion that wayland would protect against an application which has full access to your user directory. Wayland becomes secure when combined with an application sandbox using SELinux/flatpak. Previously you could sandbox the app and X would provide an escape.
  - znpy 6y ago
    Yes, I am aware about this. Yet the most common way to denigrate Xorg is to assert that Xorg is basically a keylogger. Which might be true, but as this post shows just switching to Wayland doesn't offer any additional protection under the key-logging point of view. You might combine a sandboxing technique with Xorg too, by the way.

hertzrat 6y ago

It’s pretty amazing that after all these years there is so little malware on Linux and in foss. The community really has somehow remained almost completely trustworthy. I don’t know of many other examples of that. Nobody trusts free as in beer software, but if it’s open source, we have barely had to even think about whether it’s safe or not because it has almost always been so - even tiny one-maintainer projects

indymike 6y ago
After dealing with hosting websites for paying customers on shared servers I'm not so sure that you can assume Linux is free of being targeted. Linux the OS may not be targeted, but Linux software like WordPress (and many others) is under constant attack. What is interesting is that the payload the hacker is trying to deliver often is not a rootkit - a bot node can run just fine as a user process on a Linux (or BSD) server. I've had to clean up: evil javascript injected into content, control servers for botnets, email relays, phishing farm software, chat servers and one time a whole CRM system. The one thing that was nice in every case was that Linux did a great job of isolating the hack to a single user's files.
- samus 6y ago
  Linux would be targeted for sure if the exploits were easier to pull of. Because then the things you just described could be done to all the users on the system simultaneously.
nemothekid 6y ago
>It’s pretty amazing that after all these years there is so little malware on Linux and in foss. There's plenty of malware in Linux; it's just never called malware. I'm generally more wary of installing random software on a Linux box than I am on my personal macOS machine. When I ssh into a customer's machine to discover a bitcoin miner that is definition of malware; and there have been plenty of exploits that involve shodan style scans that take advantage of server software with poor defaults.

the_duke 6y ago

I do use Linux (almost) exclusively, but I'm well aware of the security limitations. Forget this keylogger. All you need is to somehow write a single line into .profile or .bashrc, which basically every executed program can do, and you own the user account. You can intercept every program with wrappers by changing PATH or adding desktop entries in .local/share/applications, extract all data from applications, use LD_PRELOAD like shown in the submission ... the possibilities are endless. There isn't even a single decent dynamic firewall with those annoying popups. Apart from SELinux, there is also firejail [1], which I use to sandbox browsers. Flatpak and Snap are also trying to solve both the packaging and the sandboxing aspect, with moderate success. They also increase the risk due to lack of centralized package ownership, so require a very solid sandbox. The only reason why the Linux desktop is somewhat secure is the reliance on official package repos, the trustworthiness of the open source communities, and the and the relatively small target group. I do believe that the path forward has to be Mac OS/Android/iOS style sandboxing - especially for everything not directly from an official repo, but there seems to be relatively little interest in the ecosystem. Non Linux specific sidenote: ever notice how many VS Code extensions download random binaries from the net? Or just that they can execute arbitrary code? Compromising one of those could lead to some glorious returns for malicious actors, with potential access to lots of source code, credentials and internal networks. Bottom line: if you touch any sensitive data or work with secure systems at all, you have to be extremely paranoid about your machine - no matter what OS you are on. [1] https://firejail.wordpress.com/ https://firejail.wordpress.com/

Jkvngt 6y ago
Forget it? It’s the main selling point of Wayland that keyloggers are impossible.
- deleted 6y ago
  [deleted]
- Blikkentrekker 6y ago
  It's hardly the main selling point, but yes, it's often stated in such language that is sufficiently bereft of technical specifics so that the lay user reading it will gain the impression that the aforementioned proof of concept is not possible, but also that, when præsented with it, semantics arguments can be fronted that are more technical, to allow a statement that it wasn't so intended. On a more practical level: if the statement indeed eventually be phrased so that it does come with the technical truth, the practical gains are not of security, but performance, and only when not using nVidia cards. Better phrased, it is: > The current state of Wayland is that it allows for better hardware acceleration when sandboxing on X11 , except with nVidia cards, where on many compositors it does not allow allow for hardware acceleration at all. X11 allows for similar sandboxing by way of a nested server, but hardware acceleration is insufficiently implemented as of this moment. — this is not a theoretical impossibility and it could be implemented; it simply isn't fully, at this time.

theamk 6y ago

this seems completely miss the point of wayland security. Of course if you run the programs under same account you can keylog them. You can also connect to Chrome and steal the cookies directly, wrap terminal to install pty loggers, backdoor ssh and so on. The real point of wayland security is you can safely run multiple user accounts on the same desktop. And the LD_PRELOAD tricks (or PATH tricks etc..) do not work across accounts, unless you are doing something stupid. I wish people would stop saying silly things like "But for any possible way to break it, I could add countermeasures as well. Applications could use 'getenv' ....". That's not how you break keyloggers! You break them with privilege separation. The least-code version would be: 1. Create a separate user for web browsing, with its homedir and all 2. Create "/etc/sudoers.d" entry to launch browser which does not require password, but also does not allow any arguments, enforces HOME and only passes through a small subset of env vars 3. Launch your browser with "sudo -H -u browser-user firefox". Make it a desktop shortcut or something so you are not tempted to enter your password if someone messes with the shortcut. that's it -- this will stop this attack, and many others, cold. And will not require any SELinux.

Blikkentrekker 6y ago
> this seems completely miss the point of wayland security. The point is that Wayland security is useless because the security boundary on Unix is fundamentally the user account: > Of course if you run the programs under same account you can keylog them. You can also connect to Chrome and steal the cookies directly, wrap terminal to install pty loggers, backdoor ssh and so on. > The real point of wayland security is you can safely run multiple user accounts on the same desktop. And the LD_PRELOAD tricks (or PATH tricks etc..) do not work across accounts, unless you are doing something stupid. If this indeed be the point, then I ask you to come with a single official Wayland reference that promotes it as such and phrases it as such, as that is not the point the advocates make at all, and they phrase it simply as “One can no longer be keylogged by malware.”, which is a very dubious claim. Once malicious software has been executed as one's user, that is the end of it, and one's entire account can now be treated as forfeit, and Wayland does nothing, and cannot do anything due to the fundamental designs of Unix to stop that. Furthermore, there are already quite a few mechanisms on X11 to achieve what you illustrated. — that does not mean that Wayland is useless, it simply means that it does not provide a solution to any existing problem in this specific field that is not provided elsewhere. There are two common claims that are very frequently made by official sources such as GNOME that are false: - X11 cannot be sandboxed. - With Wayland, one cannot be keylogged. > that's it -- this will stop this attack, and many others, cold. And will not require any SELinux. Yes, never running malicious code with the privileges of one's user would stop it from gaining access to said user, but the promises of Wayland are protections even if the former have happened. — this is false advertisement.

rhn_mk1 6y ago

> This program is in no way meant as criticism of the Wayland project. It simply demonstrates that creating a secure desktop requires more than just a few server-side restrictions. This is the right takeaway. Unfortunately, given the previous paragraph and the name, I suspect a lot of people are going to think "Wayland is insecure, so why bother?". The reality is closer to "many parts of Linux are insecure, and Wayland closes one of the holes".

skymt 6y ago
I'm not sure it's even accurate to say that Wayland closes one of the holes when the hole Wayland closes isn't part of the system's security boundaries. It's like installing a deadbolt in a door standing in the middle of a room.
- Spivak 6y ago
  The "user is the only security boundary" ship sailed long ago with, chroot, SELinux, AppArmor, Snap, Flatpak, namespacing. It will continue to be a bumpy ride retrofitting an ecosystem not made for the tighter boundaries but it's still the goal.
  - Blikkentrekker 6y ago
    Many of those work by running processes under what is effectively a subuser. The problem with it is, that it works fine when one purely speak of being able to write and read from files, but the moment servers such as display servers or Pulsaudio and DBus come into play, the picture becomes more difficult. All of those technologies work on a simple binary level where the subuser has access to the socket, or it does not, for finer grained control the kernel is required to speak the protocol, which will obviously not happen. So, those services themselves must come with a means to filter communication appropriately, and sandboxing technology is beholden to the extent thereof. Flatpak had to provide an alternative DBus-proxy server to do this with DBus, similar to using nested X11 servers; no solution has been reached for Pulseaudio, whereof I know, and no plans even exist for a variety of more obscure servers that software might need to communicate. For instance, ZNC can be instructed from the IRC client to load modules that contain arbitrary code. Therefore, any IRC client that has acces to ZNC has ZNC's full capabilities, as it does not come with such finer granulation as of this moment. If any sandboxing technology is to be effective, a large number of servers that are in common use often need to provide specific support for that specific sandboxing technology, or simply not be accessible at all from within it.

jstarks 6y ago

Why does this say (2021) when the last commit was in 2014?

Jkvngt 6y ago
Still works great, too! How long until Wayland developers fix this, another seven years?
- theamk 6y ago
  Ugh, they cannot fix it because this is not something that wayland can fix at all. Look, if you have user access to the account, you can get its data. Even if you somehow make Wayland 100% secure, you can still replace “firefox” shortcut with malicious version which also steals all your passwords. No windowing aystem involved at all.
  - Jkvngt 6y ago
    But bleargh, why do Wayland proponents always seem to bring up keyloggers? That’s icky.
    - zlynx 6y ago
      The X11 protocol allows any client connected to the server to become a keylogger or insert input events. So, even a X11 client trapped in a sandbox or another user account has full access.
    - theamk 6y ago
      Do you mean "opponents"? For example, this post is the only post on HN about wayland keyloggers, and it is clearly written by Wayland opponents.
    - dralley 6y ago
      Because the X11 protocol itself enables every X app to keylog every other app without any "hacks" involved, which is what this is. It's the difference between having a poor quality lock on your door and having no door at all.

tubularhells 6y ago

SE Linux is enabled by default in Debian, Ubuntu, Fedora and Manjaro (iirc), so I stopped reading at the introduction. The exploit presupposes the lack of this basic hardening.

krick 6y ago
I'm not sure how it helps here. User-level access in enough, isn't it?
- Jkvngt 6y ago
  It is.
- freeone3000 6y ago
  SELinux is more fine-grained than user-level access: it implements application-level access. Even if you, as a user, can access a file, an application working on your behalf cannot do so; same for launching applications.
  - danieldk 6y ago
    Indeed, Russell Coker even has a public demo machine (I don't know if it still works) where anyone can log in as root/uid 0, and still can't do much useful due to the SELinux policies on the machine: https://www.coker.com.au/selinux/play.html https://www.coker.com.au/selinux/play.html
danieldk 6y ago
Of those distributions, only Fedora sets SELinux to enforcing by default. Moreover, AFAIK Fedora (and RHEL) are the only distributions that had wide-scale testing of the reference policy [1] [2]. So, if you enable SELinux with the reference policy on the other distributions that you mention, it is likely that you will run into all kinds of issues. [1] https://github.com/SELinuxProject/refpolicy https://github.com/SELinuxProject/refpolicy [2] https://github.com/fedora-selinux/selinux-policy https://github.com/fedora-selinux/selinux-policy

CyberRabbi 6y ago

If we’re being honest, this keylogger is not exploiting a weakness in wayland. So it’s a bit clickbait to call it a “wayland keylogger”

forgotpwd16 6y ago
It doesn't exploit a Wayland weakness but it's written specifically for Wayland. Maybe "Wayland keylogging patch" will have been better.

arghwhat 6y ago

The position of the Wayland project is that security isolation requires sandboxing. Otherwise, applications can do whatever you can do, including changing all your personal config files and scripts. The security considerations in Wayland are primarily aimed at not being a weak link undermining sandboxing efforts, which is the case with X11. Without sandboxing, writing to e.g. ~/.profile would in most cases be enough for a malicious application to take over the machine. Equivalents apply to all platforms.

znpy 6y ago
> The position of the Wayland project is that security isolation requires sandboxing. which is not really a step forward since now I have do go and sandbox every app.
- canofbars 6y ago
  You don't have to, package maintainers and developers do. Flatpak gives them the tools to do this. Flatpak solves a lot of other problems like making program installs a user level task without touching the OS. Which is needed because in the future the OS will be an immutable image.
- Spivak 6y ago
  You always had to. There’s no magic universe where an app has the full privilege to do everything you as a user can do while also preventing it from doing things that you could do. Whatever mechanism that enforces those restrictions is the sandbox.
- arghwhat 6y ago
  No. It's a step forward because you can, but it's ultimately up to you. You're still better off with Wayland, but no matter what you use, there's a huge glaring security hole if things are not sandboxed.

ddevault 6y ago

If you put a nice lock on your door and leave your window open, then a crook can still get in. Wayland is a nice lock. This "keylogger" depends on having arbitrary code execution as your user, outside of a sandbox. The same technique could be applied to backdoor literally anything. In other words, it requires being on the other side of an airtight hatch. https://devblogs.microsoft.com/oldnewthing/20200318-00/?p=103569 https://devblogs.microsoft.com/oldnewthing/20200318-00/?p=10... Wayland does not allow programs to use the Wayland protocol to snoop on other programs. X11 does allow this. That's the key distinction. Wayland does nothing to prevent programs from snooping on each other using any of the other features of your operating system. Wayland is only one part of a secure system. I wish we'd stop having this fucking keylogging discussion already.

FloatArtifact 6y ago

One of my main gripes unfortunately Wayland does not function very well with accessibility software without elevated privileges. Areas include but not limited to : -simulated keyboard/mouse input (some progress recently with some composers) ability to inspect window attributes (e.g. window title, executable and handle) ability to manipulate windows (e.g. maximise, close, etc) Considerations do need to be made in the framework / protocol for accessibility. I'm hoping the situation has changed. Possibly someone could comment on that.

kaba0 6y ago
I doubt it has changed all that much, but an accessibility software need not be on the same privilege level than an ordinary one, so it is entirely possible to propose an accessibility extension to query basically everything and explicitly enable these methods for a specific program. Unfortunately accessibility softwares are not all that good on linux as far as I know.

dathinab 6y ago

It's just anoter LD_PRELOAD key logger not really a wayland keylogger. Let's be honest with LD_PRELOAD you can currently get pretty much anything. Through you can setup SeLinux to make such attacks impossible or at least much harder needing other vulnerabilities/insecure design to succeed. But some programs abuse LD_PRELOAD for various reasons. Also there are so many other ways to undermine security that once you locked everything down Linux became supper hard to use. The funny think is, non of this attack vectors are a major problem for server/embedded or similar non-desktop Linux use cases. As in them you can normally run a hardened Linux, where such attacks simple are not possible. It hints to how Linux is not really designed as a desktop system. And IMHO is fundamentally unsuited to become a modern desktop (or handy) OS without changing it so much, that's not really Linux anymore. This is also why I never had much hope for the libre phone.