Slashdot Mirror
Skype Linux Reads Password and Firefox Profile
mrcgran writes "Users of Skype for Linux have just found out that it reads the files /etc/passwd, firefox profile, plugins, addons, etc, and many other unnecessary files in /etc. This fact was originally discovered by using AppArmor, but others have confirmed this fact using strace on versions 1.4.0.94 and 1.4.0.99. What is going on? This probably shows how important it is to use AppArmor in any closed-source application in Linux to restrict any undue access to your files."
This is why you should have shadow passwords, so that your encrypted password isn't stored in /etc/passwd.
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
.. only closed source applications? I don't think most people read the entire sources of open source applications that they use.
It's impossible to compromise teh Lunix's security. This is a known fact. Thus... the story must be false.
put the spyware in Kazaa...
Politics is Treachery, Religion is Brainwashing
Is a public file, as are virtually all the others in /etc.
What's it doing? Well, what libraries is it linked with? Perhaps it's converting your UID into a name among other things.
Deleted
Welcome our new password-reading spyware overlords
We already knows that Skype records a lot of other information including your BIOS : http://www.pagetable.com/?p=27
Which versions of Skype, 1.4 or all of them?
I think it is time to use SIP and force the 2 people I talk to to use SIP as well.
With closed source the chance that someone will uncover mischief, which they can only do by analysing the application's actual operation, is therefore much slimmer.
In summary, it's not that you can always trust open source above and beyond the equivalent closed source - it's just that it's generally much easier to do so.
Russian hackers are getting your passwords!
It'd be interesting to see what libraries skype links in. If it has anything built against mozilla libraries, or perhaps something else that might legitimately need to check user IDs for access information (say to /dev/whatever) or something like that.
Dunno about AppArmour, but there is no way in hell to distinguish between legitimate getpwnam, getpwuid, etc calls and reading the whole passwd file on a linux system using strace.
/etc/passwd you should not claim that it does something illegitimate.
Example:
strace on ls -laF immediately gives
open("/etc/passwd", O_RDONLY) = 4
Followed by quite a few reads out of it. So by the logic of the poster ls -laF is a horrible application doing horrible things to your system.
Unless you have read the source or single-stepped trhough the app with a debugger, examined the data and found that it does something nefarious like sending skype the whole of your
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
It is true that the same people were the main creators of Kazaa and Skype. However, those creators had nothing to do with the introduction of spyware into Kazaa. They are not to blame for what others did. The introduction of the spyware was included in Kazaa first after the program was sold from the creators.
Many of those files are perfectly legitimate for any application to read.
In any case, you don't need AppArmor to find what files something opens, just use strace.
/etc/passwd is likely accessed to lookup the full name of the user in the GECOS field.
But why Skype wants to access all firefox settings remains a mystery. But it might look for proxy information.
virtually *any* linux distribution uses shadowed passwords s oour encryted password is kept in a separate file. Anyone "rolling their own" should have the forsight to do the same.
Second: Any modern Linux system will use a shadow password file, its been years since I've seen a system use a regular password file.
I can't speak to the Firefox profile access, but if an application wants to look at the GECOS field to find your real user name, the only way to do that on a non-NIS (or other network authentication scheme) system is to look at /etc/passwd. This is also why shadow passwords should always be used, because /etc/passwd can't be locked down.
Paranoia without understanding how UNIX works is inappropriate.
And of course it phones home too. Voilà. Result: Either you are ok with that and you are one of these people that say "I have nothing to hide" (there's been a /. article about that too, more or less often), or you are not ok with it and should stop using it immediately.
/etc/passwd. This is how programs finds out your GECOS (real name) and or home directory, though I'd say that the latter should be done using getenv("HOME"), so as to change it temporarily (export HOME=~/somewhere_else).
But technically, anything that uses getpwuid(getuid()) uses
It is via /etc/passwd that you convert a UID to a user name.
In the research I did for my doctoral thesis, I found the shocking secret that getty and login and even init both read /etc/password and other files in /etc. My research has not yet found a valid reason for this. I am left feeling that Linux itself is spyware. My proposed solution is to only mount filesystems when a user is not logged in.
Worst attempt to pimp AppArmor ever. SELinux FTW.
what else did you expect from the shop that brought you kazaa?
They want their critical Unix vulnerability back.
Darn - all I have to do is cat /etc/passwd from a regular account... let's see... gee, the sysadmin on this machine is a dumbass - what sort of root password is "x"?
OMG its on Mac OS as well - the root password here is '*' - well, at least they've used a non-alphabetic character.
What's that you say Mr Sock... /etc/passwd is a public file and no security-conscious distro has actually stored passwords in there since the encryption was cracked (at least for dictionary words) sometime in the 80s?
Wake me up if Skype actually emails a readable copy of /etc/passwd to the black hats - even then, it shouldn't be enough to compromise a system (although a list of usernames might be handy).
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
Yeah, it's not quite kosher that the program reads this stuff, but what's more important is tracking what goes from the program back to Skype headquarters. Has anyone tried reading the traffic from it while not connected to a voice call, etc.? Want to get mad about something? Then at least ensure there's a valid and serious reason to do so.
what does it do with the data it reads?
finally, for one, welcome our new Skype Overlords?
It stores your username, home directory, default shell. Most applications read it at least once, to display your username based on current user id. Shadow passwords are usually in effect, so it's only rarely that this file contains encrypted passwords.
First you assume that the person(s) that read it would catch anything evil in it. It's not like the evil code is necessairily going to be in a function called doEvil(), it could be very cleverly hidden among legit functions so that most people would miss it. With good obfuscation it wouldn't be hard to make something that people would have to play with a debugger just to figure out what is going on, and as such miss it on anything less than a really intense code audit.
Second, you assume the people who look at it aren't in on it. So maybe a couple people look at the code and find the evil bits. They contact the developer and ask what's up. The developer then lets them in to his cabal, who can use the evil bits for their own ends. The people decide they like this and don't tell anyone. The people who read the code have to be honest for this to work.
Third you assume that anyone other than the developer even bothers to look at the code. Not always a valid assumption, just because the code if you there doesn't mean anyone gives a shit. Maybe it is too complicated, maybe they just don't care, regardless the code being open is no guarantee that someone looked.
Fourth, you assume that the binaries are the same as the source. I'm betting at least some of the time, and probably more often than that, you install things from a binary package. It's easy and much faster than compiling everything. Great, but how do you know the source follows the binaries? It would be easy to release an untainted source, and then tainted binaries. That the checksums differed wouldn't be of any note, since it could just be that different compile options were used, or even a different compiler (for example using ICC since it generates more efficient binary code). As such no source audit would ever turn up the problems.
Finally, even if you compile your own, you assume that nothing else is in on it. I'll refer you to the classic Ken Thompson story http://cm.bell-labs.com/who/ken/trust.html. Some other program, and not just the compiler, could be in on inserting a trojan. It might never exist in source form, yet always get compiled in. Thus even a build from a verified source isn't a defense.
Really, what it comes down to is open source may give you a warm, fuzzy feeling but it isn't actually proof everything is on the level. Really, you have to test what the software actually does when it is run. You can't say "Well the source is open so it can't do anything evil," because you just don't know that. It's far more useful to analyze how the program acts on a system, than to look over the code.
After all, if looking at the code revealed everything, OSS would never have any bugs. You'd look at the code, see all the bugs, they'd all get fixed. Yet it does, nasty ones. My favourite is the BIND flaw discovered back around 2000 that was in essentially every version of BIND ever. Despite the fact that many people had looked at the code, nobody had ever noticed this. There was no ill intent, no conspiracy, it just wasn't something people saw.
As such the same could be done for something evil. Hide it well enough in the code, and nobody will notice it.
It is hard to compromise Linux security, but only if the user knows what he does.
You cannot deny the user to give away his own password in any system.
Patents Drive Free Software as Hurricanes Drive Construction Industry
I have a modest suspicion that skype is more than it seems. I don't believe in 98% of conspiracy theories (like 9/11 'it was a inside job bomb' crap), but this one is not entirely crazy.
I do know that the Intelligence Community people in the US and elsewhere were very concerned about declining abilities to track and trace communications used by their targets, as compared to conventional telecom, where they have quasi-official backdoors installed directly with the telecom companies.
Notice the extraordinary anti-decompiling and self-modifying nature of the skype code---even manages to thwart many popular *hardware debuggers* and virtual machine strategies. The protocol itself is extremely obscure and apparently encrypted. I don't have a link but I think this can be easily verified, as I saw a presentation online which detailed some attempts to understand skype. This was not just good 'ordinary' hackers, but appeared to be the work of very serious and very professional full time computer security people, i.e. state-supported grey hats.
The level of self-security and the investment necessary to pursue this seems totally disproportionate to any commercial needs. This reflects a very serious investment of talent and money.
So why is it there?
But the really unusual fact to ponder is this: Why did eBay buy skype, and at such a high price?
It makes no sense commercially for skype or eBay. I believe the reason is simple: to bring skype development and download servers and most importantly connection servers under U.S. jurisdiction. Once it is so, the government can now (thanks to our now imperial enabling acts) simply order eBay/skype to put in spyware and order them to never talk about it. Most probably the government approached US companies with this proposal and shopped around until it found one who would say yes.
A financial analyst might see something funky in eBay financials if they were clever, there no doubt has to be some payment or other compensation to eBay.
Now the reason for the hypersecurity is clear---to mask whatever data are going *OUT* from skype and whatever it is installing. For some reason I have the suspicion that uninstalling won't completely uninstall quite everything.
There is probably some kind of Manchurian Daemon ability too---if They find somebody they really want to track. Why? Because it makes sense that they'd want to do so.
Incorrect. Estonian hackers are stealing your passwords.
--Skype. The whole world can talk for free.-- Skype. The whole world can be spied on for $2 Billion
There are in reality many very reasonable reasons why a program might read your passwd file. There are in fact innumerable standard unix function calls that do just that (this has already been pointed out). Now, if I could be bothered looking at the strace its very easy to tell if its doing this via a libc/glibc function call or whether its implementing such a call internally. Even if its internal it could be because they've statically linked in a library that does getpw* calls - who knows.
/etc/passwd is world-readable doesn't mean you should share with the world! Just having usernames provides a hacker with tonnes of information about your systems for an attack point. "Oh look the user blah appears, that means he installed package x - i bet its the one with the security flaws". Or any number of other things that can be gleaned from /etc/passwd. I hope all your users set passwords that are non-predictable for example.
However, the point I WANTED to make was that just because
News at 11
Skype is a realtime app (in both a2d and d2a directions). Interrupt statistics, CPU loads etc are vital for the app to decide what quality of encoding/decoding it can afford to do.
/etc/{passwd,group} others have pointed out this is probably for the GECOS info of the current user. Should be easy to check using a debugger - just need to recompile the C library.
Regarding
To me, the oddest part is the wholesale reading of mozilla and firefox profiles.
Otherwise Skype ist dead for me. The outage was bad enough. There are many alternatives. Ekiga rulz for example.
Please, before you submit (or accept) an article about security to (or on) slashdot, make sure you understand rudimentary unix programming. There is no way any non-trivial unix program is going to NOT read /etc/passwd. /etc/passwd needs to be read for almost any trivial thing to be accomplished, such as finding out your home-directory so that .skype can be read, or for displaying ownership of files in a file-dialog.
Now, as to why skype needs to read firefox configuration files, I have no idea. I haven't used skype, so I don't know what it does. But most likely this is done, because some users asked for a certain "integration" feature, whether it's bookmarks or plugins, or whatever...
The firefox profile is a little weird, but programs read /etc/passwd all the time to get the running user ID and groups. If you are not using shadow passwords, you should be, and all normal Unix distros are. Want to know a secret? If you use LDAP, it will query LDAP to find out your UID and GID also. It's normal. /etc/shadow is a different story. Root is the only one that can read that file, and if you are running skype as root, you're foolish.
I'd suggest that anyone with concern about skype on linux simply add a user to the system called "xskype" or similar. Run skype as that user, and it will be contained to only what that user has access to. Problem solved.
boycott slashdot February 10th - 17th check out: altSlashdot.org
Skype has some pay features that come with interesting provisions. For example, you can buy a SkypeIn phone number cheaply for personal use. If you're a business, you pay a different rate for a number that you can use, say, from multiple sites (for example, for follow-the-sun customer service). Temp directory and hardware information are two things that are very rarely the same...
as /etc/passwd can be read by a regular issue, probably just poking for *IDs and ~home. Is there likely a more elegant/less intrusive way for Skype to find what it's looking for? Probably so, but we'll never know as long that they only make binary blobs available. It's a tough call to break down and used closed source, but sometimes functionality trumps the politics. I don't like using the blobs nVidia provides, but I want my eye candy. I don't care for Adobe Flash, but so much content is based on it I chose to make my life easier. I'm not a Skype user so I can't judge, but doesn't Ekiga do ths job pretty well? Does the Skype client only accept calls from other Skype clients?
There is an official Skype Firefox extension. IIRC it recognises phone numbers in web pages and makes them into links so that you can call them more easily. Skype is probably looking for it's extension.
# cat
Damn, my RAM is full of llamas.
Any application may read /etc/passwd and other files there. In fact Skype may just read it to find its own UID/GID and doing it in this way is prefectly acceptable. There are two things that every halfway secure Unix system does to secure /etc/passwd 1) shadow-passwords, i.e. that actual encrypted passwards are in /etc/shadwo, which is not readable except for root and 2) salting, which makes dictionary attacks against encrypted passwords much, much harder.
Symmary: Nothing to see here, except some people that do not undertsand Unix security.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Nice try,
Debian uses shadow passwords. It's one of the questions in the installer.
I stopped using Skype just a short time ago, mainly because of eBay's attitude toward AMD64 support:
http://forum.skype.com/index.php?showtopic=93068
Since then I have found that there are already standards based open source replacements for Skype, mainly SIP and Ekiga. In contrast to Skype they got video conferencing and you can get a public telephone number for free.
Also I started to think about what would be needed for the german "Bundestrojaner" and compare it to Skype:
- it is installed on a majority of systems
- it is protected against decompilation / debuggers
- it bypasses almost any firewall
- it uses encryption for network traffic
- it may send lots of data even when not making a call
- it might have already been deployed by the NSA
- eBay has a history of cooperating with federal agencies
Tom
First: NetBSD isn't a Linux distro.
Second: Debian uses shadow passwords.
Third: There's nothing wrong with reading /etc/passwd. POSIX even has an API for accessing it in user code. See the man pages for getpwuid, getpwnam, getpwent, setpwent and endpwent. For example, everytime you do "ls -l", it uses information from /etc/passwd.
In any case, there's really no excuse for not using shadow passwords.
Maybe not
It shows how important it is to secure your system, whether Linux, Windows, or any other, against trusting any app too much with resources not created by, or explicitly granted to, the trusted app.
It also shows that it's too hard to trust closed source apps on any platform, even when closed source is the default status.
It also shows that AppArmor can protect you from untrustworthy apps, unless it won't run on your platform (like Windows).
It also shows why Linux is more trustworthy than is Windows, especially when Linux is used with open source apps, which are the default, which can be inspected by lots of people for trustworthiness.
That kind of untrustworthiness also shows that Skype cannot be trusted not to spy on all your phone conversations and address books. I know I don't trust it. This latest "secret prying" behavior erodes any trust that's misplaced in giving it access to your personal data, including media (that includes your conversations).
--
make install -not war
This has already been mentioned, but in the Unix world it is standard to read the passwd file for some things, and in all modern Unix like OS's (yes, this includes NetBSD and Debian), it does not contain password information. (BSDs don't have an /etc/shadow file like a Linux distro, but they have for example /etc/master.passwd)
/etc/passwd
/etc/passwd, but also made it so that important information that user apps need goes there. This was a design mistake, and it has been corrected in all modern systems.
Try it yourself: $ cat
You'll find information about user names, UIDs, GIDs, home directories, shells, "real name", etc. But no passwords.
If it wasn't this way, there'd be no reliable way to get your username as a string, for example, since the system call API only provides getuid(), which returns an integer.
Basically: The original Unix used to put encrypted passwords in
Google about the infamous InterBase backdoor.
It was a good database engine produced by Borland, but it contained a backdoor that allowed anybody to gain access to all data. They forgot about that detail and after eight years published its source code on the Net. It took a bunch of months for a single developer to find the backdoor (and it was a database engine, not a small desktop app!) and make it public.
This is why, at least on my planet, only fools use closed source software to manage sensitive information.
> not every distro of linux uses shadow passwords (think debian or netbsd)
/etc/debian_version /etc/shadow /etc/shadow
leen@debian64:~$ cat
4.0
leen@debian64:~$ ls -lA
-rw-r----- 1 root shadow 1171 2007-08-17 01:41
New things are always on the horizon
Because this could never happen to a company like say Microsoft or Google who even have offices in countries where the enemy live and tens of thousands of employees!
You are an idiot; the argument has always been that because more people can see the source code there is a higher chance that bugs and exploits will be caught (which I think we can all agree happens effectively in the Open Source community) - not that open source stops all of these attack vectors.
Go back to spreading your FUD to the twelve year olds on those other technology websites and leave this one for the grown ups.
I ate your fish.
Install them, yes.
Run them, no.
Retard troll, at least get the terminology right.
If only there were an open-source version of Linux. What am I saying, that's Communism!
You'll find that nearly all programs will access /etc/passwd in some way. I'm willing to be that nowhere in the code that skype wrote do they actually specifically call out /etc/passwd as a file, but just a system call to check permissions or even a file lookup will have the system check /etc/passwd. This isn't all that unusual. As for the Firefox stuff, I couldn't say but it would be a bad idea to put some smarts in to look for proxy info and such that might help it auto setup. To be fair nothing you mentioned is all that out of the ordinary.
That, sir, is a very good point. In fact it's such a good point, it makes me wonder why no one has ever suggested such a thing before, here on Slashdot.
Fortunately, there is a simple fix, readily suggested by the exemplary record set by The Microsoft Corporation. All we need to do is change the file "/etc/passwd" to be "/etc/.passwd". That way, the file will no longer show up on directory listings. And, since no one on earth is clever enough to think of running "ls -a", that means that no one will know where the password file is, so no one will be able to break in. Security Through Obscurity FTW!
Furthermore, if we apply this policy rigorously throughout the whole of the Linux operating system, I'm sure we can make Linux' security record every bit a good as Windows in no time at all.
Don't let THEM immanentize the Eschaton!
SIP, if I remember, requires so many open ports you may as well not try unless you're sitting on a real Internet IP address, with no firewall, at both ends.
I believe there's something else you can use instead, some Asterisk-specific but somewhat widely-supported protocol, a bit simpler, only requires one port. There's also Jabber/Gtalk -- I know Kopete supports that now, among other clients. I don't know exactly how the voice works, but it is nice to be able to have one or more central servers to connect to, so at least your endpoints can be behind whatever firewall/NAT people have set up.
But Skype is actually the technically best solution I've seen, and I wish there was an open source alternative, or an open spec. It actually uses some UDP tricks to allow you to open a connection directly between the two endpoints, requiring no bandwidth from Skype, even if both endpoints are firewalled and NAT'ed. It does require at least one publicly-accessible server, but only for the initialization.
Of course, for conferences, I'd have to recommend mumble, which looks to be intending to replace TeamSpeak and Ventrillo for voice chat in games.
Don't thank God, thank a doctor!
Programs don't read /etc/passwd to get passwords (nobody stores 'em in there any more), they read /etc/passwd to map between user ids and user names. Chalk this up to the most overhyped nothing I've seen posted to /. for a while...
AppArmor isn't ubuntu's design to link to Ubuntu package. It is Novell's software, and like should have given them credit.
Instead, we have again Ubuntu users claiming everything and not doing anything but copying (yes I know GNU)
"Third: There's nothing wrong with reading /etc/passwd."
Actually, there is, but for the entirely opposite reason. If you read passwd you'll miss any network based users, such as users authorized over LDAP, kerberos, or others.
getpwent and company, on the other hand, will get you those. As would getent or similar command line utility.
Third: There's nothing wrong with reading /etc/passwd. POSIX even has an API for accessing it in user code. See the man pages for getpwuid, getpwnam, getpwent, setpwent and endpwent. For example, everytime you do "ls -l", it uses information from /etc/passwd.
There are legitimate reasons for a command like ls to want to connect a bunch of UID's and usernames. Making the same argument for a program like skype that should only ever have to read one (or possibly two) config files is a bit more of a stretch. When you consider the fact that ls generally doesn't broadcast stuff allover an internal p2p network at unknown machines, the difference is even more important (especially if you're slightly paranoid about security).
uhh, woody had shadow passwords and probably even before that
He mentioned the libc calls already. Those calls will use whatever method is appropriate for obtaining user information. On a default installation, this will be reading /etc/passwd.
No, you DO NOT INSTALL ANYTHING APART FROM SYS AS A ROOT! You only give them privileges, open ports, etc.
Linux users are nowadays just as stupid as mainstream.
/etc/passwd can be read by any user
1. A *LOT* of software looks in /etc/passwd because you can get uid, gid, homedir etc. from there (try grep $USER /etc/passwd - go on)
2. Passwords are very rarely stored in /etc/passwd these days.
3. I've written scripts that touch firefox profiles for stuff as innocuous as protocol handlers..yeah, erm.
4. Why is AppArmor a link to an ubuntu wiki? Are Ubuntu about to invent AppArmor like they invented networkmanager et al?
This is like a blast of deja vu...in the early 1990's the ISP Prodigy was accused of stealing information from their users, based on bits of personal information that some users found in their cache files (due to the client using uninitialized disk space, reclaimed from previously deleted files by the OS). Much paranoia and very little enlightenment followed in online discussions. See e.g. http://en.wikipedia.org/wiki/Prodigy_(ISP)#Spyware -like_behavior
Have you read my blog lately?
Furthermore skype will try to install the firefox extension if you want it to, so reading your firefox profile isn't "unnecessary" as the article title claims...
+5, Truth
Now, that should be modded funny. Bravo, sir. I was about to feel your indignation until you let us in on the joke with refering to /. as a site for grown ups. You should be commended.
Notice, there has been response of substance, just the attacks and misdirection.
Please respond to Linux security issues without misdirecting to MS, or attacking the poster.
Your response in...3...2...1...
Politics is the art of looking for trouble, finding it everywhere, diagnosing it incorrectly and applying the wrong fix.
This is just one too many hits against Skype. I'd rather use Vonage.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
It would be nice if enough people contributed and used http://www.openwengo.org/ so that it becomes a better alternative.
A nice exemple of some big companies believig in free software and trying to do it right.
Estonian hackers would say "ei" (pronounced 'ay-ee' for you English speakers) not "nyet" ;-)
San Francisco values: compassion, tolerance, respect, intelligence
Reading /etc/passwd is necessary for a lot of things, like convert between uid and username, for example. It's not like there is only password in the file. Any person with a bit clue about Unix would know that.
If the poster is not stupid, I'd think the only reason he posted this is because he wanted to promote apparmor. And it's still stupid.
Wow, you guys were seriously trolled. HAND.
I mean, NetBSD as a distro of Linux? Come on, don't make it so easy for them!
are belong to us!
But, linux is more secure. These things are protected. No one is writing exploits for linux.
Oh, wait, it isn't, they aren't, and they are.
Wait, who said no one is writing exploits for Linux? People write exploits for everything. No software is 100% secure, and anyone who claims the opposite is a fool.
In fact, with all that open source, isn't it easier to see what is going on so I can write a better exploit?
Open code allows anyone to do security audits to patch vulnerabilities before they can be exploited. Patches also tend to propagate faster because of their public nature, and the fact that anyone with sufficient knowledge about the issue can write and apply those patches himself. On the other hand, when a vulnerability is found in closed software, you have no choice but to patiently wait for the vendor to fix it, which may take some time depending on various factors such as PR and the perceived priority of the vulnerability to the vendor's eyes.
Isn't it easier for me to, say, sneak a corporate or national spy into the development team and compromise the project?
You seem to imply that it would be harder to do the same in a non-open project. At least in an open project the code can be audited by anyone. When you get proprietary software you can't inspect it yourself unless you're a member of the project. And if said project is compromised, you can't do anything.
With millions of lines of code, do you think we could keep an Iranian or Chinese spy from getting malicious code into the project?
Chinese spy? I'm not even going to bother replying to this one.
Hypothetical:
- Start a project for a civilian equivelent of a military application
- Form a project team
- Accept a programmer from a country that has very specific ideology driven agendas against much of the western world
- Wonder why the government won't switch to the OS of your desire
Again, the same thing could happen for a closed project, and with greater repercussions, so your argument is meaningless.
Now, the REAL reasons why some governments don't switch to open source:
- Lack of understanding of the movement
- Switching technologies is expensive, especially when the vendors of the current one has made sure it would be difficult to switch by disregarding standards
- Misinformation from corporate interests that see open source as a threat to their current business model instead of embracing it, or people like you
But, wait, linux is more secure. These things are protected. Nobody is writing exploits.
Made-up bullshit again.
Ohh yea? Get this. When you set up your account on a Linux system your password is stored, encrypted in a file called /etc/shadow. Seems a bit shady to me. What are they doing with it? Encrypting it so you don't know that's what's happening and then storing it.
Paying taxes to buy civilization is like paying a hooker to buy love.
NetBSD uses shadow passwords too. Check your facts at the door.
man nsswitch.conf
Why would anybody respond to such an obvious troll with "substance"?
And to add to that: if /etc/passwd was supposed to be soooo guarded, it wouldn't be 644.
Readable to all.
Congratulations on including more profanity than actual content in your post...
/etc/passwd to find the user's home directory, which is true.
Oh, here's a hint: "Hacking something up" involves, in Bash, simply accessing $HOME. In Perl, it's $ENV{HOME}. Even in C, it's something like getenv("HOME").
If that's your idea of "hacking something up", you've clearly never been a programmer. If you really think accessing the 8th element of the array returned by getpwent() is more readable than the above, you're also clearly retarded.
Or is it the lack of documentation? Bullshit. I just did a 'set | grep sanity' at the commandline, found I have HOME=/home/sanity. Took far less time than it'd take to Google for "Standard POSIX way to find the home directory without pissing off Anonymous Cowards."
Note also that I said "it could be innocent." I didn't even say that environment variables was a better or easier way. I just said that nobody has to read
Don't thank God, thank a doctor!
No security at all!
/Some/noob/wrote/this/app :-P
Want to run as Bob? Easy:
USER=Bob
I strongly recommend a reading of "The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments" http://www.nsa.gov/selinux/papers/inevitability/. Whether it's AppArmor or SELinux or something else, it's well past time to start requiring mandatory access controls on our OSes.
Actually, it is much more sensitive part of information than /etc/passwd. /etc/passwd gives away the real name at most. ~/.mozilla gives away practically everything about internet activity of a person. I think this is the thing to worry about.
There is a stanard libc library for reading in /etc/password you dolts, you shouldn't have passwords in there anyway. You need things like this to find out the users shell, home directory, etc. Cry me a river, dictionary attack? I mean, make a decent password and use one of the many tools available to notify you of that stuff. Nothing, is secure, security is just a means of slowing people down.
The saddest poem
The passwd file stores hashes of the passwords. There is nothing sinister about reading the passwd file in order to do authentication - how the hell else must you do it?
Excuse me, but please get off my Pennisetum Clandestinum, eh!
As long as there is no grand drop in network speed, I'm not worried.
If you mod this up, your slashdot background will turn into a beautiful sunset!
Law abiding citizens have nothing to fear
Path based security is a joke and anyone with any respect in the security field will tell you so.
Furthermore, if we apply this policy rigorously throughout the whole of the Linux operating system, I'm sure we can make Linux' security record every bit a good as Windows in no time at all.
/"
No, that won't do at all. If you want to make Linux's security approach that of Windows, you'll need something like, "chmod -R 777
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
It's WINEPREFIX. Same concept, though -- by default it's ~/.wine, but if I want it to go somewhere else, I can.
An example of practical use: I believe IEs4Wine does this, because Internet Explorer doesn't generally like having multiple versions on the same Windows. So it just creates multiple fake Windows installs, and switches between them with WINEPREFIX.
Cedega actually provides a GUI for this. You can install each game in its own "game folder", each of which is a fake Windows. Thus, no one game that runs on Cedega can possibly be incompatible with another game, or interfere with it in any way -- unless you want them to (obviously you can install multiple things onto the same "game folder", including patches and mods to a game you already have there).
Don't thank God, thank a doctor!
The proper way to get information about the user, such as his name, his home directory, etc is to call the function getpwuid() in a manner like: getpwuid(getuid()), it returns the following struct:
Sure it has the user's password listed there (in some format), but this is the proper way to retrieve all the other data also found here. All good applications which save settings per user or try to be more friendly towards the user will call getpwuid() and in turn end up reading
If you think a program reading
As for reading Firefox files, I'm not sure what it's doing, but Skype does offer Firefox integration right? Surely it's not too hard to imagine it's trying to figure out your configuration and check for conflicting plugins, and the like.
You can be an insane coder too, read: Insane Coding
There's nothing wrong with reading /etc/passwd.
Is there? Is there not? How should I know?
In an open source project, one could take the source and if it's FUD, debunk it immediately. Maybe there is a legit reason to read the passwd, maybe there is not. Do I know? No. Can I find out? No. It's closed source. I just know that it does. But what does it do with my passwords? Nobody knows but Skype's makers.
That's the core problem with closed source. I cannot trust it. Maybe it has a good reason to access the passwd file. But do you expect the best or worst? As a security expert, I expect the worst by default until proven wrong. Everything else is playing russian roulette with your system security. You can't just trust a program intrinsically until proven wrong, because when you're proven wrong, it usually is too late.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No, no, no! That wont do at all. Then everybody could make changes to all the files. It should be "chmod -R 774 /", and then you add every user to the admin group, except for the guest user.
How does closed-source program really affect the use of AppArmor? When was the last time the average Linux user had gone through code to make sure that it is doing things as advertised? When was the last time someone verified that the binary package they got from the distribution is the result of the open source code?
You can't mix ideology with due diligence.
#0 0xf7ddc5b3 in getuid () from /lib32/libc.so.6 /usr/lib32/libX11.so.6 /usr/lib32/libX11.so.6 /usr/lib32/libX11.so.6 /usr/lib32/libX11.so.6
/lib32/libc.so.6 /usr/lib32/libX11.so.6 /usr/lib32/libX11.so.6 /usr/lib32/libX11.so.6
#1 0x44a325d5 in _XimLocalOpenIM () from
#2 0x44a30f2a in _XimOpenIM () from
#3 0x44a30c70 in _XimRegisterIMInstantiateCallback () from
#4 0x44a16828 in XRegisterIMInstantiateCallback () from
#0 0xf7ddc5b3 in getuid () from
#1 0x44a325d5 in _XimLocalOpenIM () from
#2 0x44a30f2a in _XimOpenIM () from
#3 0x44a1687a in XOpenIM () from
The profile thing is a bit different though... The needle in the skype is much worse by comparison, =)
Congratulations for have the only sane, informative post on this thread after many many pages of scrolling. Is there any way we can mod this as a six?
"Everything is adjustable, provided you have the right tools"
I guess I'm just old and they have every second of my life cataloged and critiqued already, but isn't Skype just trying to identify unique users? I use Skype for business so I'm fine with any identity-verification tools they may use. You don't know how annoying it is to be fooled and do some programming for an imposter for free because you didn't have $70 for a full background check.
We all know teh Lunix is impregnable and flawless. Anyone who comes into our sacred temple of Lunixness and says otherwise needs to be modded down into the flames of hell.
How dare you speak ill of teh Lunix or Firefux!! All FOSS is perfection by design!! May our Master and Savior teh Lunis strike you down!!!
> In an open source project, one could take the source and if it's FUD, debunk it immediately.
But since it's a closed source project, one can throw out wild unsubstantiated allegations with no need to back them up.
When I use Open Source apps, I do so knowing that there are many developers and hobbyists that have looked over the code, so I know that there aren't any glaring security flaws.
Assumption is the mother of all fuck-ups.
Consciousness is a myth. Trust me.
Good point, but it's not as simple as you seem to think. For large and far-reaching projects like Linux (the kernel) or Samba, yes, there are many hobbyists who have looked over the code. Not so for small projects, little novelty programs or handy-to-use utilities; there, any hobbyists would probably not go over the code with a fine-toothed comb, and just read over the gist of the code more to understand it than to make sure it's not doing something nasty. You'd be relying on the developers, but if they had malicious intent, it's not like they're going to announce that their open source program has a trojan embedded.
You know what I would do, if I wanted to do something nasty? Suppose for a moment I was strongly motivated to exploit other people's computers using open-source software --say I was paid to bring a DDOS attack against some arbitrary website as part of a protection racket, or something. I'd write an open-source program; given enough time and motivation, I might even fork off some useful but immature OSS program. I'd embed some nasty stuff in there, add features to make lots of people want it. (Example: I take the on-screen clock in KDE (or GNOME) and make it announce the time out loud --kinda "cool" but doesn't take that much development effort.) I would upload it to some reputable site, like SourceForge. I might even fabricate a "development team", complete with different email addresses for various team members.
Do you really think other people are going to read over my source code? Only those people who are interested in extending and contributing to my sources would do so. That would take at least a few months, and before that, I'd probably have recruited a sizeable botnet.
Even if someone did look over the source code, the malicious part of it might not be that easy to spot. Check out the Underhanded C contest where people write innocent-looking programs that do subtle but nasty things. I remember the inaugural contest, which was to make a simple, straightforward vote-counting program that would give George Bush more votes, but ONLY on November second, and not any other date. I thought, "How could someone possibly sneak something underhanded in there, and not have the malicious code stick out like a sore thumb? Haven't people heard of syntax highlighting?" And then, lo and behold, there were programs that did exactly as requested, looking for all the world like an innocent program, with no obvious funny-looking-code on syntax highlighting, and counted the votes correctly on November first and third, but on November second, suddenly George Bush got more votes! The winning program used a pointer overflow and took advantage of the fact that the word "second" (as in "November second") had one more letter than "first" or "third", creating a buffer overflow only when the date string was too long. Since then, there have been three more contests.
That brings me to my somewhat off-topic point: I wish we could have some mechanism for peer review, a corps of OSS programmers (probably volunteers) who would go over code and sign it as reviewed. For example, someone might say, "I've reviewed the GUI portion of GNOME Evolution, and didn't see anything malicious." He would GPG-sign the source code, and we the community could evaluate this based on how well-known the programmer is --Bruce Perens might have more credibility than Ann Onymous Coward, for example. We might establish a database of reviewed pieces of code. And someone spotting some funny behaviour might put in a request to revi
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
This is just a little bit reminding me of RealPlayer. Yet another reason to use free software and ONLY free software. When will people get it?
Do some research, perhaps? This is not mysterious sekret info...
Standard C library functions read
Unfortunately many people are far quicker to cry and scream in public about things they don't understand, than put in a bit of effort trying to understand what's going on first.
We live, as we dream -- alone....
Sure, you could use AppArmor (tm, R, etc). ...or you could use SELinux...
Let the flamewar begin!
The Right Reverend K. Reid Wightman,
As has been stated 10 million times above, they're not reading /etc/passwd. They're calling the C/Posix API function getpwuid(). Why? Because it is the safest way to find the user's home directory - in order to locate a firefox profile. They probably check $HOME as well.
Why check the firefox profile? Because they can look at your proxy settings, to see if it needs to use a socks4 or socks5 proxy at all.
This is all part of their "just works" auto-configuration. It is far from the end of the world.
Which is a more reasonable explanation?
1) Skype is data mining stuff to create a giant database of user names and firefox profiles; or
2) Skype is doing its best to "just work" with your network configuration if possible.
Option #2 explains all of the "suspicious" activity quite nicely. #1 is absurd if you think about it.
Why link to an Ubuntu page that mentions what a good idea it would be have a project that builds from AppArmor, when instead you could have linked to... AppArmor itself?
Please refrain from being so lame in future. AppArmor.
No no, my good man... you are confused! It is MS whose response to Windows security issues comes in 321+ days... Linux responses and patches to security vulnerabilties come much much faster!
Fuck The What?
to keep it simple stupid: - /etc/passwd: almost every prog reads this to turn uid into username, etc....
- firefox profile: it is a read of the proxy settings (automatic proxy detection). i tested this, test it for yourself, change your proxy settings to something different and skype wont connect, on the right proxy settings it connects via http through the firewall (bad enough)
so the article is almost complete nonsense, despite the fact that one thing is obviously true: closed source can do harm, dont use it ! the question is not what skype can and does read, but u can easily imagine what a bad program can do with your profile settings in your home directory (read plain text passwords / keys locally stored....) for skype there is still no evidence at all that it does something bad. but i wont use it just because it is closed source !
Skype is a nicely crafted piece of software that usually just works. I'm not going to just defend them, sometimes companies do stupid stuff, but you have to weigh the business side of things, what do they stand to gain vs. lose by grabbing passwords and stuff like that? For Voip, they are probably the undisputed leader. For video conferencing, I'd say the same. if you're looking at platform to platform solutions rather than iChat and MSN chat, they have no peers. It's theirs to lose, why would they risk it all for something that isn't even their primary focus?
First, let's address your issue:
I really, really fail to see how any of this has a security implication when we are talking about Skype learning where to store its ~/.skype dir or whatever.
I mean, yes, there are cases where you should not touch the environment. Accessing config files is not one of them; in fact, plenty of apps deliberately include commandline switches to change that kind of thing. Having the user change their name doesn't seem to be a security implication either, unless there's any parts of Skype that are setuid root, which would be pretty stupid.
However, good job for missing the point (like the other guy, who actually did give me a /. ID...)
Here is what I said:
You may be a programmer, but you really need to work on that reading comprehension. Why is it that every time I post an alternate way of doing something, everyone assumes I'm advocating it?
Don't thank God, thank a doctor!
"Third: There's nothing wrong with reading /etc/passwd. POSIX even has an API for accessing it in user code. See the man pages for getpwuid, getpwnam, getpwent, setpwent and endpwent. For example, everytime you do "ls -l", it uses information from /etc/passwd." There are legitimate reasons for a command like ls to want to connect a bunch of UID's and usernames. Making the same argument for a program like skype that should only ever have to read one (or possibly two) config files is a bit more of a stretch. When you consider the fact that ls generally doesn't broadcast stuff allover an internal p2p network at unknown machines, the difference is even more important (especially if you're slightly paranoid about security).
Skype needs to find the username of the user it is bieng installed for and the location of that user's home directory. Both of those are contained in /etc/passwd. Further, it probably checks the contents of directories, so presumably the side-effects of using ls are not out of order here, either.
I expect the most common -- That it's just looking up homedirs or usernames. If you really didn't trust it, chroot it or run it in a virtual machine. You can trust it just fine then.
It's also not as if theres some secure encrypted path from your HD to your CPU. You can strace it or disasm it all the same. Not as clear as reading C, but also tells you exactly what its doing (as opposed to trying to follow obfuscated code with intentional but easy to miss exploits).
Pain lasts, kid. Its how you know you're alive. Sometimes I think this growing up thing is just pain management-TheMaxx
Not really. Once you login to your linux computer, the environment variables USER and HOME get set to your username and home directory respectively. If Skype can't find a config file with your skype username/password (which is probably why it needs to know your home directory) then it can always ASK you for that info. Finally, even if this was a valid reason to look in /etc/passwd, it still doesn't explain the need to rifle through all the other files. If you read through the list in the article, it's quite impressive. Some of them I can cobble together an excuse in my head (it needs to check /dev/snd so that it knows how to deal with your sound card). Others make no sense to me at all (why does it need to sift through my firefox pluggins? What does it need with my .Xauthority file?). And some, like /etc/passwd just seem like a poor choice for how to get info that is already available through other means. /etc/passwd itself, things like ls need it since you may use ls to look at stuff that isn't always yours (try ls -l /dev). If you run skype, you're making a phone call, not listing the /dev tree. If it wants to find out who you are, there are other ways that aren't going to seem so fishy.
As for
But you know they couldn't just stop at /etc/passwd. *nix done the MS way:
/
/bin
/home
/lost+found
/tmp
/lib is hidden to keep the user from manually installing conflicting versions of libraries (as all libs have had version numbers removed)
$uname -a
Microsoftix
$ls
Release Notes:
All other directories have been hidden as they could either confuse the user or the user could render the system inoperable.
All files have permissions 774 and all users are members of group "root".
Before cd'ing into any hidden folder, Microsoftix's patented "SafeDir" will prompt the user "Are you sure? (Y/N?". Please note Microsoftix SafeDir uses MSTK to display its confirmation dialog. As such, you can only cd into hidden directories from within the X environment. This shouldn't be a problem, as Microsoftix does not support consoles outside of the X environment.
Not really. Once you login to your linux computer, the environment variables USER and HOME get set to your username and home directory respectively. If Skype can't find a config file with your skype username/password (which is probably why it needs to know your home directory) then it can always ASK you for that info. Finally, even if this was a valid reason to look in /etc/passwd, it still doesn't explain the need to rifle through all the other files. If you read through the list in the article, it's quite impressive. Some of them I can cobble together an excuse in my head (it needs to check /dev/snd so that it knows how to deal with your sound card). Others make no sense to me at all (why does it need to sift through my firefox pluggins? What does it need with my .Xauthority file?). And some, like /etc/passwd just seem like a poor choice for how to get info that is already available through other means.
As for /etc/passwd itself, things like ls need it since you may use ls to look at stuff that isn't always yours (try ls -l /dev). If you run skype, you're making a phone call, not listing the /dev tree. If it wants to find out who you are, there are other ways that aren't going to seem so fishy.
We don't know exactly what Skype is doing with these files except that the program (or its calls) does open them. As far as USER and HOME go, they aren't guaranteed to be anything like correct, and it would be a bad practice to rely on them, especially when there already exist proper system calls for determining the UID of the user. As covered in other posts, mapping that UID to a username would require /etc/passwd, and that is what it is for.
Any program that creates sound is going to either have to open a sound device file or send signals to your mixer of choice (esd/alsasound/etc) so it's not unusual that this program opens those files. Skype uses a Firefox plugin, which would explain why it needs to access those. Your .Xauthority file is potentially opened every time you use an X11 application. And like we said before listing files will probably call the same stuff as ls which will result in opening the /etc/passwd file.
It's not necessarily that the program needs information from all of these files, but rather that opening these files is part of how an application like this works on Linux.
"Security Through Obscurity FTW!"
Fuck The What?
For Teh Win
Yeah, Fuck The World came first, as a slogan, but this seems to have supplanted it.
Fuck the Wumpus was the critically acclaimed, though much less popular sequel to Hunt the Wumpus
Play Command HQ online
Way ahead of you. Gimme a few, it's a fair lot of asm.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Ever if this alert was an error, I think it's good to have some of this kind sometimes : if anyone think about putting a trojan in a closed sources app for linux, he will think about it twice.
So if that's really an error, I won't be one of those who blame its authors... :)
NetBSD/linux has used shadow passwords since they forked from Slackware in '87. next time pry the dicks out of your mouth long enough to supply at least a little bit of oxygen to your dizzy, ruined brain.
We've secretly replaced Slashdot with new Folgers Crystals - let's see if it notices.
>You know what I would do, if I wanted to do something nasty? Suppose for a
>moment I was strongly motivated to exploit other people's computers using
>open-source software --say I was paid to bring a DDOS attack against some
>arbitrary website as part of a protection racket, or something. I'd write an
>open-source program; given enough time and motivation, I might even fork off
>some useful but immature OSS program. I'd embed some nasty stuff in there, add
>features to make lots of people want it. (Example: I take the on-screen clock
>in KDE (or GNOME) and make it announce the time out loud --kinda "cool" but
>doesn't take that much development effort.) I would upload it to some reputable
>site, like SourceForge. I might even fabricate a "development team", complete
>with different email addresses for various team members.
Open-source apps on sourceforge don't really get that many users
compared to windows shareware like WinAmp or AIM. Linux use is definitely still
under 10%. Your KDE clock would be going after %0.01 of 10%-- and it's the bad 10%,
the users who actually know how to examine network traffic and source code.
netstat, System Monitor, and nmap are your friends.
I agree with the concept of networks of trust, and code reviews. If you are the NSA,
no doubt you need line-by-line review of code. Most people are not the NSA, and
are content with firewalls and some common sense.
"Any connection between your reality and mine is purely coincidental." -Slashdot
You are correct. If you re-read the forums and scan for the comments from the Skype staff (ignoring the troll responses), they confirm that they're reading the prefs.js for proxy settings. Doesn't explain why it looks at the plugins, but it's a start. They could tighten it down by adding a "search for proxy" option in the skype pref for proxy so that it doesn't waste as many resources (or as much of privacy nuts' time).
Use my userscript to add story images to Slashdot. There's no going back.