Kids find a security flaw in Linux Mint by mashing keys • Hacker News Board

Re: Kids find a security flaw in Linux Mint by mashing keys

#111

Post by cuillevel3 » Wed, Jan 20, 2021, 12:05 PM UTC

kuter wrote: post #18

For anyone interested there is something called fuzzing that uses usually code coverage based heuristics to generate data to find bugs. For example LLVM's lib fuzzer uses instrumentation to track code coverage and mutates data to find invalid behaviour. https://llvm.org/docs/LibFuzzer.html It uses a compiler pass to insert code to branch points functions calls etc. I think it uses genetic algorithms to increase cover…

Here is an eight year old presentation on fuzzing X:

https://media.ccc.de/v/30C3_-_5499_-_en_-_saal_1_-_201312291...

Re: Kids find a security flaw in Linux Mint by mashing keys

#112

Post by Qub3d » Wed, Jan 20, 2021, 12:07 PM UTC

sbierwagen wrote: post #101

Qub3d wrote: post #94

For everyone linking the JWZ "I Told You So" post, the devs are aware of it and posted a response in the GitHub issue. I encourage everyone to read their side of the issue: https://github.com/linuxmint/cinnamon-screensaver/issues/354...

What context? Reading that issue, the content seems to be: 1: jwz says if you add accessibility features to a text box, make sure they don't have any bugs that can kill a process, since that will break screen lockers 2: Cinnamon adds a buggy accessibility feature to a text box that lets you crash the screen locker 3: Github user clefebvre says something along the lines of "why is jwz being so negative >:(" Well... yo…

> Why is it his responsibility to fix your code? The distro extended his program, the extension broke.

cinnamon-screensaver (the repo this discussion is pertinent to) is written from scratch. The commenter's intent here is to suggest that JWZ has valid criticisms, but he has voiced them before and his latest blog post doesn't add anything to the discussion.

This blog post, which links to the issue, creates additional overhead for the project to deal with. Just like this HN link does.

I think its fair for us to give them a voice in the matter if we're showing the discussion to everyone. It would be nice to assume people read the entire discussion but clearly, that is not a reality.

Re: Kids find a security flaw in Linux Mint by mashing keys

#113

Post by Leherenn » Wed, Jan 20, 2021, 12:10 PM UTC

Another tangentially linked anecdote. We had build artefacts stored on a Samba shared drive, that were write protected, since some people regularly used to move them instead of copying them. Then one day, the latest build was gone again. We asked around to see whether someone had purposefully removed the build, but no. Turns out someone on Windows 10 had tried to cut and paste the file, but his computer had crashed before pasting. Apparently the permissions were only checked on paste, but the file was unlinked on cut?

Re: Kids find a security flaw in Linux Mint by mashing keys

#114

Post by gspr » Wed, Jan 20, 2021, 12:13 PM UTC

canofbars wrote: post #63

krick wrote: post #44

Earlier quoted context omitted.

Oh, so Wayland is finally ready to replace X11?

Whether wayland is ready for you basically comes down to 2 questions: * Do you use a nvidia GPU * Do you need to screen share from electron or other x11 only applications (MS teams, etc) Its ready if you said no to both of those.

Screen sharing of X11 windows from a Firefox running on Wayland works fine for me under Sway. Sharing of other Wayland windows, or the whole screen, however, does not.

Re: Kids find a security flaw in Linux Mint by mashing keys

#115

Post by AnIdiotOnTheNet » Wed, Jan 20, 2021, 12:19 PM UTC

globular-toast wrote: post #16

gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

I've seen Windows do that too. It's not just Linux. My guess is that these lock screens are all bolted on afterwards rather than being in the design from the ground up.

> I've seen Windows do that too.

Really? I have never seen this in Windows. Don't get me wrong, I've seen plenty of lock screen failures in Windows, usually in the form of it suddenly being unresponsive, just never anything that actually gave me access to the locked session again.

The closest I've seen is when using RDP, if the Window has been minimized or hidden or otherwise has had reason not to update its display, then locked due to timeout, it will briefly show the last image it rendered when reactivated before updating and showing the lock screen.

P.S.: As other users have pointed out, Windows does have some known lock screen bypasses using accessibility and help dialogs, but in regards to merely crashing the lock screen, I haven't seen it behave in an insecure way.

Re: Kids find a security flaw in Linux Mint by mashing keys

#116

Post by andi999 » Wed, Jan 20, 2021, 12:21 PM UTC

toast0 wrote: post #70

josefx wrote: post #66

Earlier quoted context omitted.

> and yes, you'd have to deal with fragmentation, Why not just require that it is there? Is there even a valid reason for someone to keep the extension out unless it is to give another "this is the reason X sucks" speech?

Because, IIRC, xscreensaver is launched on demand (idle timer, power management), and that's a terrible time to detect the extension and tell a user that they won't be able to resume their session, because their Xserver is too old. Also, because of piecemeal releases, and remote X. You might update Xscreensaver, but not your X server or desktop environment. You might have a dedicated X terminal which can't easily hav…

What is todays alternative to remote sessions?

Re: Kids find a security flaw in Linux Mint by mashing keys

#117

Post by sbarre » Wed, Jan 20, 2021, 12:23 PM UTC

Illniyar wrote: post #84

gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

This happens to me regularly with macOS too, so perhaps it's harder then you imagine.

Yep, also happens to me on my macOS 10.15 iMac..

It will go to sleep, then when I wake it up, I get a flash of my desktop before the lock screen shows..

Too fast to write anything down by hand, but you could certainly point a 60fps camera at it and get something I'm sure.

Re: Kids find a security flaw in Linux Mint by mashing keys

#118

Post by slim » Wed, Jan 20, 2021, 12:32 PM UTC

tauntz wrote: post #64

Mi kid got around the lock screen of my mac. Twice. It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months.…

my kid got around a locked cash box yesterday. it's amazing how much security is tied to ingrained behavioural patterns

Re: Kids find a security flaw in Linux Mint by mashing keys

#119

Post by Anthony-G » Wed, Jan 20, 2021, 12:40 PM UTC

segfaultbuserr wrote: post #24

diegoperini wrote: post #5

Step 1: Gather timings of key presses from a lot of kids. 2: Use ML to learn how to simulate it. 3: Sell it as a service, labeling it KaaS. 4: Profit, then go to jail because of a misunderstanding. But seriously, is there such a tool to automate this?

People have been fuzzing user interfaces since the 80s. It was used for developing MacPaint and MacWrite in Apple's original Macintosh. Quote Wikipedia: > In 1983, Steve Capps at Apple developed "The Monkey", a tool that would generate random inputs for classic Mac OS applications, such as MacPaint [0]. The figurative "monkey" refers to the infinite monkey theorem which states that a monkey hitting keys at random on…

Thanks for sharing that story. It's probably the reason why Netflix decided to use "monkey" for the name of their tool to randomly terminate service instances: https://netflix.github.io/chaosmonkey/

Re: Kids find a security flaw in Linux Mint by mashing keys

#120

Post by smolder » Wed, Jan 20, 2021, 12:40 PM UTC

gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

I don't dispute the bad design, but FYI, there was also a very recent exploit for accessing bitlocker drives on Windows without login credentials, making use of accessibility features on the lockscreen.