1 |
On Fri, Dec 16, 2016 at 1:16 PM, Rich Freeman <rich0@g.o> wrote: |
2 |
> On Fri, Dec 16, 2016 at 11:51 AM, Miroslav Rovis |
3 |
> <miro.rovis@××××××××××××××.hr> wrote: |
4 |
>> On 161216-08:35-0500, Rich Freeman wrote: |
5 |
>>> |
6 |
>>> I'm not sure I understand what distinction you're making. I can't say |
7 |
>>> I'm intimately familiar with the security model around Pulseaudio (at |
8 |
>>> a glance it seems similar to X11 with its use of cookies, though |
9 |
>>> obviously if you tell it to broadcast unencrypted multicast RTP on |
10 |
>>> your LAN you'll get the obvious effects) but X11 has a couple of |
11 |
>>> glaring security weaknesses. The most obvious is the fact that any |
12 |
>>> random X11 client can read the keyboard input of any other client on |
13 |
>>> the same server unless you jump through a bunch of hoops that I don't |
14 |
>>> think anybody actually jumps through (though I do believe some of the |
15 |
>>> X11 PIN entry programs may use them at least). Anything you type into |
16 |
>>> an xterm could be read by your browser, and in turn by any code able |
17 |
>>> to execute outside any sandbox that browser might have (root privs not |
18 |
>>> needed for this). |
19 |
>> |
20 |
>> I don't claim it can not, but I doubt anyone can do it in my |
21 |
>> grsecurity-hardened based Gentoo machine. |
22 |
> |
23 |
> As far as I'm aware grsecurity provides no protection against X11 |
24 |
> client evesdropping. This is an X11 "feature" and not an exploit |
25 |
> per-se. |
26 |
> |
27 |
> Here is one overview of the possibilities: |
28 |
> https://pipefish.me/2012/08/28/spying-on-screens-and-keystrokes-the-dangers-of-open-x11/ |
29 |
> |
30 |
> Any program that has access to your X11 cookie and which can connect |
31 |
> to your X server (which includes anything actually displaying a window |
32 |
> on your screen), can generally grab any of the keyboard input bound |
33 |
> for any window on your screen. There are ways for programs to block |
34 |
> this, but they're not super-practical. |
35 |
> |
36 |
> Amusingly enough I stumbled upon this blog: |
37 |
> https://blog.separateconcerns.com/2014-10-24-cli-passwords.html |
38 |
> |
39 |
> This page "helpfully" suggests that you can secure your system by |
40 |
> using a console pinentry program instead of an X11-based one, with the |
41 |
> underlying assumption being that console software is more secure for |
42 |
> this sort of thing. While the basic assumption is probably true, in |
43 |
> this particular case it is definitely not. Entering a password on an |
44 |
> actual virtual console or over ssh is in fact secure. However, |
45 |
> entering it into an xterm (which is presumably what you're using if |
46 |
> you would otherwise be using an x11 pinentry program) is absolutely |
47 |
> not secure. The x11 pinentry program probably uses XGrabKeyboard to |
48 |
> ensure that other clients can't evesdrop, while the console-based |
49 |
> version doesn't know anything about x11. Some xterm implementations |
50 |
> have a secure mode buried in the menus which turns on this mode which |
51 |
> you can use to safely enter passwords, but almost nobody knows about |
52 |
> this. |
53 |
> |
54 |
> There are a lot of "cargo cult" tips out there which are based on a |
55 |
> lack of understanding of how software like X11 actually work. Of |
56 |
> course, X11 is so convoluted that almost nobody actually understands |
57 |
> everything about how it works, which is why Wayland has always been |
58 |
> right around the corner. In general, though, it largely dates back to |
59 |
> an era where people had rsh listening on all their hosts. |
60 |
> |
61 |
>> |
62 |
>>> And I wouldn't be surprised if a lot of X servers still run as root |
63 |
>>> for modesetting/etc. |
64 |
>> |
65 |
>> What user is that? It you want, tell me how to check it, and let's see |
66 |
>> how spyware-prone my system is. |
67 |
> |
68 |
> If you don't have USE=-suid on your xorg-server package, then X is |
69 |
> probably running suid root. |
70 |
> |
71 |
> In order to not have it run this way you need support for kernel |
72 |
> modesetting. I was surprised when I found out that X11 even worked |
73 |
> that way (we're talking late 90s here). It seems a bit like running |
74 |
> pppd as root so that it can directly talk to a UART because you have |
75 |
> an aversion to using /dev/ttyS*. In any case the kernel devs have |
76 |
> generally been making the move to kernel modesetting so that your |
77 |
> device drivers actually are in the kernel and not in random userspace |
78 |
> programs (I'm all for microkernels, but not like this). |
79 |
> |
80 |
> If you don't have kernel modesetting enabled then X11 won't be able to |
81 |
> run with -suid set. Google for gentoo kernel modesetting for a guide |
82 |
> on how to enable it on most modern hardware. |
83 |
> |
84 |
>> |
85 |
>> It's been discussed over and over again. Lots of people are firm in |
86 |
>> their understanding that Lennart is an actor by and for the big |
87 |
>> business. Me too. |
88 |
> |
89 |
> Well, he is a Red Hat employee. Nobody really debates that. |
90 |
> |
91 |
>> |
92 |
>> Whatever would anybody try to claim Pulseaudio code is, but to make up |
93 |
>> for what was missing in some FOSS GNU Linux boxen for the missing |
94 |
>> functionality that the big players couldn't otherwise get for their |
95 |
>> Total Surveillance... |
96 |
>> |
97 |
> |
98 |
> Uh, if the NSA wanted to spy on your box I doubt they'd do it by |
99 |
> trying to sneak something into the open-source pulseaudio code that |
100 |
> has numerous maintainers and which is copied all over the place. |
101 |
|
102 |
There is at least one example of patches that, when taken together, |
103 |
introduce a bug into code. A particularly insidious example is |
104 |
described here: |
105 |
https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/ |
106 |
(no endorsement of the parent site implied). |
107 |
|
108 |
And there are more mundane examples involving attempting to modify the |
109 |
repository: https://lwn.net/Articles/57137/. This methodology is used |
110 |
as there is greater ROI in subverting infrastructure. It's easier to |
111 |
introduce mistakes than to find honest ones. |
112 |
|
113 |
> They'd probably just load some microcode into your audio hardware, and |
114 |
> have it talk to some microcode in your NIC hardware, and if they |
115 |
> needed some buffer they'd work it into your hard drive firmware. Then |
116 |
> it works no matter what OS you're using at the moment, or even if you |
117 |
> boot off of a DVD. |
118 |
|
119 |
These types of exploits are reserved for military use against state |
120 |
actors as a last resort. The thinking is withholding the complex, hard |
121 |
to find - but also hard to create and emplace - exploits keeps them |
122 |
relevant in case they are needed in the future. |
123 |
|
124 |
Generally what is attempted first is compromise of communication |
125 |
infrastructure, e.g. hacking your home router. They are easy targets |
126 |
(intentionally; even secure users often don't realize their router's |
127 |
firmware authenticity is not easily verifiable) and provide a point |
128 |
from which to launch further attacks on your personal computer or |
129 |
devices inside the network. |
130 |
|
131 |
Anecdote: Friend of a friend's roomate was in the process of being |
132 |
radicalized(?) and their router was hacked by the FBI. |
133 |
|
134 |
> And if they did want to do it more traditionally in userspace, they'd |
135 |
> hardly be foiled because you aren't running Pulseaudio. They'd just |
136 |
> modify your ALSA drivers or run a program that simply opens your |
137 |
> microphone and sends the audio to some remote host. |
138 |
|
139 |
I'd be worried about Intel AMT, the AMD variant, and the ARM variants, |
140 |
which carry with them the implication that every computer since ~2008 |
141 |
can not be secured. Applying this reasoning to computer peripherals |
142 |
concludes much the same thing. I suspect the prevalence of |
143 |
phone-processor-based SBCs is in part due to the Chinese military |
144 |
trying to obtain verifiably secure computing infrastructure. |
145 |
|
146 |
Of course, all of this is offtopic. |