4 ms·

I agree that it is impossible to completely secure Skype because of X11. And I need as well for some calls the screen sharing feature. So for me this is a wante

by reirob 12y ago

I agree that it is impossible to completely secure Skype because of X11. And I need as well for some calls the screen sharing feature. So for me this is a wanted feature. But I would appreciate if I knew that Skype is _not_ able to access my confidential files through the file system. As a bonus it would be great if I could as well forbid Skype to access the local network and just allow it to talk through the default gateway. I then would start Skype on the laptop only when I have to speak with people. During these teleconferences I anyway have to clean my screen. After the call I can stop the skype process but keep being reachable through skype on phone. Would this scenario be possible or is there still a security risk for my data?

pflanze 12y ago
It is my understanding that once an app has access to full X11, it can do everything you can do with your keyboard and mouse[1]. Like open terminals, cat files, it won't even have to parse the result from the screen if xsel or a text editor is installed since it will be able to copy their content from the clipboard. Or it could run wget or netcat or similar to download a binary that will connect to a server to upload your files. I suppose that normally you're able to see these activities. But the app could observe periods of inactivity so as to wait until it thinks you're away, then quickly open a terminal, enter the command to wget then start the binary in the background and close the terminal again; that might be like 1/10 second of flickering. Or it might even be possible for it to act similar to a window manager and open the window where it wants, like off-screen or behind other windows, so you wouldn't see anything. Since it directs the window manager or panel program to open the terminal instead of starting the binary directly, any SELinux properties that say that commands exec'ed by Skype don't have the permission to do stuff will not trigger. You can't stop the panel from opening programs of course unless you're fine with preventing yourself from doing the same. (I don't think SELinux is able to track which X connection leads a panel app to start a binary; that would require it to be able to track code execution and understanding the logic of the program, which seems too complex to be feasible. Cooperation between panel and SELinux might solve this. But then this seems more like a cat&mouse game, will you not have missed other ways in which a program can be started? What about terminals that you opened, they would have to cooperate as well. In the end what you need is a replacement for X11.) [1] it is possible to inject keyboard and mouse events into the X11 event delivery system; although it might be possible for programs to differentiate between those and real keyboard/mouse events (I know that the events are tagged as articial or some such, but can the programs ignore them without ill effects, and are they doing it?) Here my knowledge is getting spotty, so perhaps it is still possible to get a (somewhat?) more secure situation than what I've depicted above. You'll have to ask someone who knows better. In any case it seems to me that entities that are willing and able to use Skype to break into people's computers will also have way more funding than you to find any obscure ways in which X11 can be used to break out. X11 (at least its normal, trusted mode of operation (and as I said, Skype won't run in untrusted mode)) isn't designed to provide security.
- reirob 12y ago
  Thanks for your long post. That is really scary! I will still try to get Skype constrained with apparmor. At least I will know that it will not siphon the data through the file interface. I am wondering if Wayland will be more secure by design. I hope, since it is highly awaited as something that will save us from X11.
  - the_why_of_y 12y ago
    Denying applications the ability to send faked input events is one of the design goals of Wayland. This makes some things more difficult, e.g. virtual keyboards. http://lwn.net/Articles/589147/ http://lwn.net/Articles/589147/

by reirob 12y ago

pflanze 12y ago

It is my understanding that once an app has access to full X11, it can do everything you can do with your keyboard and mouse[1]. Like open terminals, cat files, it won't even have to parse the result from the screen if xsel or a text editor is installed since it will be able to copy their content from the clipboard. Or it could run wget or netcat or similar to download a binary that will connect to a server to upload your files. I suppose that normally you're able to see these activities. But the app could observe periods of inactivity so as to wait until it thinks you're away, then quickly open a terminal, enter the command to wget then start the binary in the background and close the terminal again; that might be like 1/10 second of flickering. Or it might even be possible for it to act similar to a window manager and open the window where it wants, like off-screen or behind other windows, so you wouldn't see anything. Since it directs the window manager or panel program to open the terminal instead of starting the binary directly, any SELinux properties that say that commands exec'ed by Skype don't have the permission to do stuff will not trigger. You can't stop the panel from opening programs of course unless you're fine with preventing yourself from doing the same. (I don't think SELinux is able to track which X connection leads a panel app to start a binary; that would require it to be able to track code execution and understanding the logic of the program, which seems too complex to be feasible. Cooperation between panel and SELinux might solve this. But then this seems more like a cat&mouse game, will you not have missed other ways in which a program can be started? What about terminals that you opened, they would have to cooperate as well. In the end what you need is a replacement for X11.) [1] it is possible to inject keyboard and mouse events into the X11 event delivery system; although it might be possible for programs to differentiate between those and real keyboard/mouse events (I know that the events are tagged as articial or some such, but can the programs ignore them without ill effects, and are they doing it?) Here my knowledge is getting spotty, so perhaps it is still possible to get a (somewhat?) more secure situation than what I've depicted above. You'll have to ask someone who knows better. In any case it seems to me that entities that are willing and able to use Skype to break into people's computers will also have way more funding than you to find any obscure ways in which X11 can be used to break out. X11 (at least its normal, trusted mode of operation (and as I said, Skype won't run in untrusted mode)) isn't designed to provide security.

reirob 12y ago
Thanks for your long post. That is really scary! I will still try to get Skype constrained with apparmor. At least I will know that it will not siphon the data through the file interface. I am wondering if Wayland will be more secure by design. I hope, since it is highly awaited as something that will save us from X11.
- the_why_of_y 12y ago
  Denying applications the ability to send faked input events is one of the design goals of Wayland. This makes some things more difficult, e.g. virtual keyboards. http://lwn.net/Articles/589147/ http://lwn.net/Articles/589147/