8 ms·
Every Linux screen locker bypassed with a keypress
- tmhedberg 15y agoFor Arch Linux users, a patch has already been applied [1] to the xkeyboard-config package in [extra] this morning which corrects this issue by disabling the problematic "debug keys" in the X keymap. Update your system and restart X, and the issue should go away. [1] http://mailman.archlinux.org/pipermail/arch-general/2012-January/024297.html http://mailman.archlinux.org/pipermail/arch-general/2012-Jan...
- NanoWar 15y agoVery interesting. How do you find things like this?
- udp 15y agoProbably by looking at the source?
- idonthack 15y agoA million people across the world flail randomly at their keyboard all day, and when they find something cool they post it on the internet.
- vog 15y agoProbably by trying to do something like Ctrl+Alt+F1, or Ctrl+Alt+Backspace, or similar stuff, and hitting the wrong key. Or, by holding Ctrl+Alt and trying out all keys, out of pure curiosity.
- cbs 15y agoCtrl-Alt-Multiply is a known key shortcut. Someone just has to know it exists and think "I wonder what happens if I use this while the screen is locked". You can get to that internal question many different ways, but its worth mentioning on top of that, security minded have trained their brains to be good at serendipitously coming up with "what happens if I do X and X" questions.
- naner 15y agoI don't understand the key presses used. Is the "Multiply" key the asterisk (Shift+8)? And also the + key on the numpad works? I was unable to get slock to crash, using a US laptop keyboard. :/
- Dylan16807 15y agoMultiply is the key on the numpad that only does *.
- ericmoritz 15y agoIt's the * numpad key, Ctrl-Alt-Shift-8 doesn't work but if my coworker turns on numlock and does Ctrl-Alt-* with the numpad key the screen lock turns off.
- sagarun 15y agoIt won't work on laptops (most laptops won't have numpad). Ofcourse you can crack into the laptop using an external keyboard.
- stephenatwork 15y agoMost laptops have a way to use the numpad equivalent by holding down the function key, though I don't have a laptop in front of my to verify that it will still bypass the screen locker with the command.
- plaes 15y agoYou can do it on regular laptop keyboard too.. Usually the "numpad" is available via "Fn" key - so make sure that Num lock is on and press `Ctrl+Alt+Fn+*`
- a_a_r_o_n 15y agoMy Compaq laptop has an embedded numpad, located in the vicinity of the right hand home row. The numpad keys are noted as a key symbol inside a square. Set numlock will enable the numpad keys by default. If numlock is not set, then fn-numpadkey gets the numpad version of the key pressed. E.g. fn-p is *.
- Dylan16807 15y agoWhile this may be a 'debug' feature it sounds useful for when a fullscreen app locks up. If not these key combinations, what are you intended to do in such a situation?
- deleted 15y ago[deleted]
- gst 15y agoSwitch to one of the consoles and kill the app.
- leif 15y agoYou can usually either get to a tty or ssh in and kill the offending process.
- CGamesPlay 15y agoI'm fine saying that, for a lock screen, you need to reboot. For any other fullscreen app, I'd expect Ctrl+Alt+Fn to take you to a tty, where you could kill any apps.
- secure 15y agoAccording to the commit in question (http://cgit.freedesktop.org/xorg/xserver/commit/?id=7d2543a3cb3089241982ce4f8984fd723d5312a1 http://cgit.freedesktop.org/xorg/xserver/commit/?id=7d2543a3...), the feature either releases all grabs or kills clients which have any active grabs. A regular fullscreen application (such as MPlayer, VLC, Chromium, …) does not grab the keyboard and/or pointer. However, applications like pinentry-gtk (for things like entering your GPG passphrase) or screenlockers do grab the keyboard and pointer. So, in short: no, this doesn’t seem useful in that case. And what you are usually intended to do is use the shortcuts of your window manager to kill the window/application or switch to a different workspace/desktop with a shortcut and kill the process from there.
- Tobu 15y agoMenus seem to cause an X grab. At least, you can't call Ctrl-Alt-L while one is showing.
- CPlatypus 15y agoI tried this on my very recently installed Fedora 16 desktop at home, and it worked. All of my applications were accessible, alt-tab and other selection methods worked, etc. The only thing that was missing was the panel at the top, and I couldn't be bothered figuring out how to bring it back so I just rebooted. Good thing I don't rely on that feature too much.
- Ubersoldat 15y agoDoesn't work in Ubuntu Maverick with X.Org 1.7.5
- jgeralnik 15y agoIf you look at the linked post, the vulnerability was introduced in 1.10.99.902, any earlier versions of X.Org are not affected.
- machrider 15y agoIn other words, terrible headline on this post. I imagine Arch and Gentoo are the most likely to be affected, as they tend to run bleeding edge projects. Most Linux users are unaffected.
- gnosis 15y agoMy machine runs Gentoo and it's not affected -- because it runs an older version of Xorg. Just because the bleeding edge version of Xorg is available on Gentoo doesn't mean you're forced to use it. You can always decide not to upgrade and stay with an old version of anything. On the other hand, if you stay with old versions too long, things might break when you finally do try to upgrade.
- cookiecaper 15y agoMan, that is pretty crazy. Ctrl+Alt+* and the whole screensaver goes away just like that and everything on the workstation is accessible. Glad this vulnerability is getting more attention; I think it's obvious the feature should only be enabled in debug builds.
- regularfry 15y agoIt's not yet obvious it was intentional, to my knowledge.
- sirclueless 15y agoIt's pretty obvious that it wasn't intentional. Or rather, that there was some miscommunication. Someone added a debugging feature that gets rid of programs that have grabbed the screen, and which is enabled by mapping some key combination to a function. They probably realized this was dangerous to enable generally. Someone else saw the recommended key combination and packaged it for general distribution, not realizing that it was a dangerous function that shouldn't be mapped ordinarily.
- stewbrew 15y agoThe headline is simply wrong. "So from a superficial analysis anything since 1.10.99.902 could be vulnerable." That's not _every_ linux screen locker. E.g. ubuntu 10.04 isn't affected.
- mindstab 15y agopresumably because 10.04 is using an older version, being almost 2 years old now.
- watty 15y agoI think that was his point. "Every windows machine affected" doesn't mean Windows 7 only.
- sirclueless 15y agoI think it's pretty clear: "Every Linux screen locker" means every screen locking program that runs on linux, not every version of linux. The bug is in Xorg, if you have any screen-locker running on a version with the bug, then it can be bypassed.
- Sharlin 15y agoEven the latest Ubuntu (11.10) isn't affected, having xorg version 1.10.4.
- gcb 15y agomost new distros are. debian-sid uses 1.11 heh, OT rant, ...and i get a email from pg scolding me for using factually correct superlatives in my submissions.
- jsight 15y agoIt would be interesting to see which distros are and are not affected. If Fedora 16 is unaffected, I'm going to disagree with your assertion that "most new distros are". Debian stable is unaffected, for example, so the production Debian builds aren't vulnerable.
- zalew 15y agoJust tested on Debian sid. Damn, it worked.
- babilen 15y agoIt shouldn't: http://security-tracker.debian.org/tracker/CVE-2012-0064 http://security-tracker.debian.org/tracker/CVE-2012-0064
- mrb 15y agoOf course, if you think you are safe because your keyboard does not have a numeric keypad: you are not. The attacker can just plug in a USB keyboard with a numpad and use it. Yay plug-n-play!
- deleted 15y ago[deleted]
- lucian1900 15y agoDoesn't appear to work on Ubuntu Oneiric. Perhaps because it's running LightDM?
- jgeralnik 15y agoI'm using Ubuntu 11.10 and have X.Org 1.10.4; the vulnerability only exists from 1.10.99.902
- rufugee 15y agoI'm on Oneiric running Kubuntu, and it doesn't seem to work with the KDE screen lock.
- buu700 15y agoYep, also running Kubuntu Oneiric; nothing. Edit: Actually, wait, I'm still on Natty. Still nothing though.
- Florin_Andrei 15y agoYup, also on 11.04 Natty. Tried with and without Numlock LED turned on, nothing happened.
- lewstherin 15y agoX-org -version on Kubuntu 11.10 says 1.10.4 and the bug seems to have been introduced in 1.11 So yet to get the killer feature.
- Tinned_Tuna 15y agoI attempted to replicate this (attempted being the operative word, I could've been doing it wrong) with Ubuntu 11.10 and a GB keyboard layout. It didn't seem to work. Key combos: Ctrl+Alt+* (num pad) Ctrl+Alt+Shift+8 Both with numlock on and off.
- deleted 15y ago[deleted]
- jgeralnik 15y agoI'm using Ubuntu 11.10 and have X.Org 1.10.4; the vulnerability only exists from 1.10.99.902
- patricklynch 15y agoDoesn't appear to work on Linux Mint 11 (katya)
- pcvarmint 15y agoNor on LMDE.
- deleted 15y ago[deleted]
- utefan001 15y agoHere is the commit. http://cgit.freedesktop.org/xorg/xserver/commit/?id=7d2543a3cb3089241982ce4f8984fd723d5312a1 http://cgit.freedesktop.org/xorg/xserver/commit/?id=7d2543a3...
- slipperyp 15y agoAll the cgit.freedesktop.org links in the seclists thread time out for me. Do they point to the commit or work for others?
- lepht 15y agoThe offending commit[1] loads fine for me, but I'd rather not call out some poor OSS contributor by name here. My question is: what is the actual function/line that causes the screen lock to die? My C knowledge is close to non-existent, but the ungrab all function looks a bit suspicious. Some commentary by someone who understands what's going on here would be appreciated. [1]: http://cgit.freedesktop.org/xorg/xserver/commit/?id=7d2543a3cb3089241982ce4f8984fd723d5312a1 http://cgit.freedesktop.org/xorg/xserver/commit/?id=7d2543a3...
- yew 15y agoX11 screen lockers (usually) work by filling the screen and grabbing all keyboard and mouse input. The UngrabAllDevices function interferes with this functionality, and optionally kills the "offending" process. Said functionality is entirely intentional, although presumably the author didn't consider the implications outside of a debugging context.
- mrinterweb 15y agoJust tried it on Ubuntu 11.10. Did not work.
- mrpollo 15y agoSame here, 11.10 didn't work
- clebio 15y agoFor some reason, I read 'Android' when I scanned this headline. But since Android is a linux variant, would this be possible? My phone doesn't have a physical keyboard, but maybe the Asus Transformer with the attachable keyboard, for example?
- CGamesPlay 15y agoNo. Android does not use X.
- simcop2387 15y agoNo, this is an issue specifically with the way X11 works with the Xorg server. Android doesn't use X11 so would be unaffected by this particular issue.
- clebio 15y agoGood point. Sorry to ignore what was already given in the comments. Thanks, though.
- dazbradbury 15y agoWhilst not the same, on my HTC desire z (which has a physical keyboard), the two programmable keys on the keyboard work even when the screen is unlocked (you unlock to find that action has occurred) . Obviously, this is less of an issue, but one nonetheless.
- shmerl 15y agoPosted workaround doesn't really work.
- zokier 15y agoHow did this happen? I mean, I understand the debug key combinations, but how did they get mapped to actual keys? The commit says To use these, you need to modify your XKB maps.
- sirclueless 15y agoThe problem is that some versions of linux ship with those modifications in their default keyboard maps. For example, ArchLinux had them until recently in their xkeyboard-config package. http://mailman.archlinux.org/pipermail/arch-general/2012-January/024297.html http://mailman.archlinux.org/pipermail/arch-general/2012-Jan...
- rbanffy 15y agoSince it's been demonstrated not every Linux screen locker is vulnerable, how about changing the title?
- Jonhoo 15y agoSeems like I'm not allowed to change it anymore..?
- drivebyacct2 15y agoJust reminds me of more usability/security concerns in GNOME. If you have any popup dialog box open anywhere, it completely inhibits the screensaver. Try it. Open Rhythmbox and open the volume slider and walk away from your computer. Open Chrome and open the Google Voice popopen box. Your computer will not go to sleep. Also, it breaks mouse focus and more. The GNOME developers don't seem to care at all.
- literalusername 15y agoNever use an X11 screen locker. Use vlock -san. Problem solved, and several other problems with it.
- Adaptive 15y agoI used vlock for a long time but there were some hangups that caused me to switch to physlock (mentioned above, but here's the URL: https://github.com/muennich/physlock https://github.com/muennich/physlock ). It's in Arch's AUR.
- literalusername 15y agoI've been very happy with vlock. What hangups did you run into? I admit that it has required some scripting to avoid launching it twice concurrently (via xautolock and pm-utils), and to clear its console before locking, but overall I find it secure, elegant, and worthwhile. What do you prefer about physlock?
- Adaptive 15y agoSuspend related problems. There's a thread of similar issues at https://bbs.archlinux.org/viewtopic.php?id=110459 https://bbs.archlinux.org/viewtopic.php?id=110459 physlock also eliminated some of the scaffolding code to deal with the multiple launches, etc. It's just a better tool solving the same problem. Recommended.
- literalusername 15y agoThanks for the recommendation. I'll definitely bear it in mind for future installs, but since I put the effort into configuring vlock well, I'd like to live with it for a while more. I'd actually already read that thread when configuring vlock on my current box, and I do chvt $(cat /tmp/console.pm) on resume. It's robust when configured well, but I can see the value in a locker that requires less configuration time.
- Adaptive 15y agoI often use physlock from X. It drops you to a virtual console and locks from there. https://github.com/muennich/physlock https://github.com/muennich/physlock
- code_duck 15y agoI just log out and hit ctrl-alt-f2... sounds similar?