oss-sec mailing list archives
virtual consoles
From: Tavis Ormandy <taviso () gmail com>
Date: Mon, 2 Dec 2019 08:56:38 -0800
Hey List, we were discussing simple screen spoofing attacks today, and whether we consider it a vulnerability or just social engineering. For example, this paper on tricks Android malware can use to trick the user into granting permissions to the wrong app. https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-ren-chuangang.pdf Regardless of your position, this is certainly possible on desktop Linux too, unprivileged users can start a new X server and switch virtual console, even over ssh. e.g. $ dbus-send --system --print-reply --dest=org.freedesktop.login1 /org/freedesktop/login1/seat/seat0 org.freedesktop.login1.Seat.SwitchTo uint32:2 (note: object paths may vary by distro, change the 2 to a different number if you're already on VT2, or seat0 if you're on a different seat) The obvious attack is to switch to a fake screensaver, then switch back after authentication, or make a fake gdm login. I'm sure this has been documented a million times, and most of us will be familiar with the "Secure Attention Key" idea, but this is slightly different from that attack as it's possible for an entirely remote user (active, physically local users usually have additional privileges, as it's assumed they can tamper with hardware anyway, etc). Should this have some policykit action requirement, or require physical presence? I don't know the answer. Tavis. -- ------------------------------------- taviso () sdf lonestar org | finger me for my pgp key. -------------------------------------------------------
Current thread:
- virtual consoles Tavis Ormandy (Dec 02)
- Re: virtual consoles Solar Designer (Dec 02)
- Re: virtual consoles Tavis Ormandy (Dec 02)
- Re: virtual consoles Leonid Isaev (Dec 02)
- Re: virtual consoles Leonid Isaev (Dec 02)
- Re: virtual consoles Georgi Guninski (Dec 03)
- Re: virtual consoles Simon McVittie (Dec 03)
- Re: virtual consoles Tavis Ormandy (Dec 03)
- Re: virtual consoles Solar Designer (Dec 02)