Imagine if Jurassic Park was real and this happened...
Kids find a security flaw in Linux Mint by mashing keys
91–100 of 340 posts
Re: Kids find a security flaw in Linux Mint by mashing keys
#92In middle school long ago, I was using one of the library search computers. They ran Windows XP and were locked down to the point where you couldn't open anything except the software that was running and you had no access to the desktop. One day I was rapidly mashing the "Search" button in the native book-searching software they were using - for no reason at all - and it suddenly opened an Explorer window out of nowh…
Classic thing was to write file:///C:\ (or something similar, I do not remember it anymore) on computers with only kiosk mode IE on them to access the local file system. :)
Also powershell was usually unbanned in my experience even if the policy disabled cmd
Re: Kids find a security flaw in Linux Mint by mashing keys
#93Step 1: Gather timings of key presses from a lot of kids. 2: Use ML to learn how to simulate it. 3: Sell it as a service, labeling it KaaS. 4: Profit, then go to jail because of a misunderstanding. But seriously, is there such a tool to automate this?
People have been fuzzing user interfaces since the 80s. It was used for developing MacPaint and MacWrite in Apple's original Macintosh. Quote Wikipedia: > In 1983, Steve Capps at Apple developed "The Monkey", a tool that would generate random inputs for classic Mac OS applications, such as MacPaint [0]. The figurative "monkey" refers to the infinite monkey theorem which states that a monkey hitting keys at random on…
I frequently use the monkey bundled with the Android tool chain[0] to stress test my UIs. Have found numerous issues throughout the years by using it
Re: Kids find a security flaw in Linux Mint by mashing keys
#94For everyone linking the JWZ "I Told You So" post, the devs are aware of it and posted a response in the GitHub issue. I encourage everyone to read their side of the issue: https://github.com/linuxmint/cinnamon-screensaver/issues/354...
Re: Kids find a security flaw in Linux Mint by mashing keys
#95Unless there's something unbelievably wacky going on, this is why people use formal verification.
If you can describe your program as a state machine, you can ask an SMT solver to find any transitions that break stuff. Unfortunately it's a lot harder to do for software than hardware because of the plasticity people expect from the former, but works it was it's really nice.
Re: Kids find a security flaw in Linux Mint by mashing keys
#96Something about this exchange was extremely pleasing and calming to read, maybe I'm irony poisoned from overly loud social media. But this was so nice to read through.
A pleasant bugreport with no judgement or demands.
And a quick response by the maintainer who shows thank, is focused on a clear outcome, and shows the progress transparently.
I've seen too many bugreports where one, or both actors behave vastly different. This one here should be a reference for anyone involved in 'bugreports' in some way.
Re: Kids find a security flaw in Linux Mint by mashing keys
#97Mi kid got around the lock screen of my mac. Twice. It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months.…
My kid (3 years old then) found an issue in the MacOS lock screen as well. It didn't result in a bypass, but a "Spinning Beach Ball of Death". I could then reproduce it and even filed an issue, but only I could reproduce (and one funny response was: "Why would you want a screen shot of the screen sleeping? It would just be black." - well tell that to my kid): https://discussions.apple.com/thread/7598463
With the current version of MacOS I have (not the latest), one could still cause some havoc... E.g. filling the disk by recording a movie with sound. Command+Shift+5. When mashing the keys, sometimes after login a list of message shows up ("Can not save the screenshot at this location").
Re: Kids find a security flaw in Linux Mint by mashing keys
#98Earlier quoted context omitted.
Hah, just reminded me.. My daughter, whilst roaming in the US from the EU somehow managed to get unlimited data after her initial miserly roaming allowance was used up.. simply by switching airplane mode on and off repeatedly until data worked. I was stressing getting back home to a huge bill, but kept the "all chargeable services have been stopped" messages just in case. My final bill was £300+, zeroed. Phew!
Also reminds me of “impossible” bug reports, only to discover the way to reproduce them was just simply double clicking on links and buttons.
We had some race conditions that started appearing more often over time. Those race conditions could be triggered by rapidly firing events on a busy backend.
After long research, we found correlation with marketing moving their target from only students to 'older people'. Apparently the latter 'doubleclick' on links and buttons in webforms far more often. At least for us they did.
Re: Kids find a security flaw in Linux Mint by mashing keys
#99Earlier quoted context omitted.
It seems like most of the complaints I see about distros have actually been solved problems for years but held back by poor distro defaults. I have been recommending fedora to people for a while because their defaults are far more modern and sane rather than clinging on to python 2 and X11
Other commenters link to similar issues with Wayland screen lockers. So I am not sure how the current shiny fixes things. > python 2 In contrast to Wayland that can be installed in parallel to python 3. So the only reason to remove it is if you enjoy breaking working software.
The difference is that with Wayland there are no design issues that prevent you from implementing it reliably and securely; if it's broken it's an implementation problem that can be fixed.
Also:
> In contrast to Wayland
I don't think Wayland is what you think it is.
Re: Kids find a security flaw in Linux Mint by mashing keys
#100Earlier quoted context omitted.
Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693
X11 design flaws you say? https://github.com/swaywm/swaylock/issues/162 https://github.com/swaywm/swaylock/issues/158 https://github.com/swaywm/swaylock/issues/10
I’m not familiar with the details of the design flaw and whether or not Wayland fixes it, but those links don’t contradict this being an X-specific design flaw. I get the impression that swaylock is a direct port of i3lock, and thus stands a fair chance of being written and architected in an X style, rather than taking advantage of any superior form that Wayland may support but X didn’t.
Expressed otherwise: just because someone’s written one piece of bad software for Wayland doesn’t mean Wayland doesn’t allow you to write good software. (Whereas I get the impression from what I’m reading that X makes it impossible to write a good screen locker, if by that you require that it be crash-proof and use the usual platform toolkit for the UI.)
(Remember in this that I’m saying I don’t know. I’d like to hear if Wayland does have a good answer to this, or from anyone with definite knowledge that it doesn’t.)