Slashdot Mirror
X11/X.Org Security In Bad Shape
An anonymous reader writes "A presentation at the Chaos Communication Congress explains how X11 Server security with being 'worse than it looks.' The presenter found more than 120 bugs in a few months of security research and is not close to being done in his work. Upstream X.Org developers have begun to call most of his claims valid. The presentation by Ilja van Sprunde is available for streaming."
Aren't we going to replace it with Wayland or something really soon?
Jesus christ. ANOTHER Phoronix post? Isn't this news for nerds - stuff that MATTERS? Phoronix is a link farm where very few posts matter.
This is a good thing. This is the way it is supposed to work. This is how things get better. A little late, but it good to see this happening.
Every X11 server needs a rendering target. For some X11 servers, this is a video card. For others, it is a virtual frame buffer that gets served through X11VNC or XRDP. And on machines running Wayland, the X11 server will render to the Wayland compositor. Porting an application's GUI toolkit allows the application to bypass XWayland, but not all applications will be ported to Wayland immediately, especially proprietary software no longer under mainstream support and free software without a large enough user base. But once enough applications get ported, the more complex and less security-hardened parts of X11 will be paged in only while an X11 application is updating its window.
X Windows was never designed with security in mind. The fact that it's insecure is no surprise.
Since media.ccc.de seems down, this video is also on YouTube: https://www.youtube.com/watch?v=n9fANvt0IsM
Help Brendan pay off his student loans
Given that X is nearly 30 years old... it sounds more like a number of issues were not considered way back when (trust boundaries for one), and that those same mistakes/assumptions have been carried forward for much of this time.
Help Brendan pay off his student loans
Cue hord of posts demanding that Wayland must die as it can never replicate the mass security violations that X11 contains.
When you use an Insecure X11 Stack...
You are displaying windows WITH THE NSA!
Yet another reason why they need to whip Wayland into shape.
AntiFA: An abbreviation for Anti First Amendment.
Could it be time for X12?
Cue hords of posts demanding that X11 must die because Wayland does everything better.
X had its day in the sun. I want a responsive and fast GUI with network connectivity being somewhere in 10th place. Make that socket/DRI/whatever they cooked up this year into a module so the rest of us don't suffer.
Only the State obtains its revenue by coercion. - Murray Rothbard
A presentation at the Chaos Communication Congress explains how X11 Server security with being 'worse than it looks.'
Still, at least you didn't just copy and paste, so points for that.
systemd is Roko's Basilisk.
It is not the way X works is particularly secure to begin with. Once an app has a connection to the X server, it has full control over the world of window, pixmaps and events on the server including of course all other apps.
Not that I have any faith in Wayland or Mir being any better, its developers coming from the X world in the first place, I am sure that they will make their new shiny systems vulnerable in the same ways.
"We mustn't be caught by surprise by our own advancing technology" -- Aldous Huxley
I intended to emphasize "more complex" rather than "less security-hardened". There's plenty of "more complex" legacy stuff in X11 that almost no modern application uses; most GUi toolkits nowadays just push pixmaps around. The featured article describes the effort to fix the "less security-hardened" part, but the only way to break with "more complex" is to ditch X11 in favor of something that does one thing (push pixmaps around) and does it well. Isn't that what the UNIX philosophy is supposed to be anyway?
Some were certainly considered but prohibited by law. Due to crypto export restrictions, it wasn't until the limits on Open Source were loosened that X was legally permitted to have any kind of meaningful security. The non-export version still had to talk to the exportable edition, after all.
Yes, X was (and is) incredibly sloppy by today's standards and yes a lot of that was due to poor decisions in the days of X10. (Yes, boundaries are a decision. MIT could have chosen any sort of access control list system they wanted, with yet another library handling it. You could have then substituted whatever you wanted, so long as the API remained the same. Pretty much futureproof, no significant extra coding, easier to maintain than what they actually did.)
The coding flaws - of which there were many - were often detectable by tools as ancient as lint.
But you must also remember, X10 and X11 were never intended as products. They were reference implementations of a protocol, not finished products intended for actual use. The different vendors were always "supposed" to provide their own.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Since Wayland is another freedesktop.org project, it will no doubt be integrated into systemd over the next year. What else can be integrated into systemd... how about ssh?
systemd is the best argument yet for legalizing postnatal abortion. I know, let's integrate celestia into systemd!
Based on the Qt team's complete lack of willingness to fix security bugs apparently when you render with Qt, you're rendering with the NSA.
Cue hords of posts demanding that X11 must die because Wayland does everything better.
What's the point of X12/Wayland if it didn't?
What's the point of X12/Wayland if it didn't?
...exactly!
Isn't this how FOSS is supposed to work?
Now security issues will be examined and fixed.
"X12/Wayland"
X12 it's not. Wayland is a total re-write. Outside of compatibility shims it's a different design and not X anything. Just call it Wayland and be done with it.
Given that X is nearly 30 years old... it sounds more like a number of issues were not considered way back when (trust boundaries for one), and that those same mistakes/assumptions have been carried forward for much of this time.
God I hate that word. If there is one word that I wish I could beat out of every developer, it's "assumption". I know they are necessary to an extent, but man do they come back to bite you in the ass every time...
I browse on +1 so AC's need not respond, I won't see it.
Apart from the Xorg hardware drivers it's using to blit it's composed framebuffer onto people's screens.
Wayland is a framebuffer compositor designed to replace a few features in X in a new (and incompatible) way in the interests of speed. It still relies on some stuff made for X, and IMHO that's some of the slowest stuff involved in putting things on the screen (eg. gtk), so it will be a bit of a struggle to get an obvious speed benefit unless improvements are made there as well or it gets it's own toolkit (which means it will start to resemble the complexity of X).
Meanwhile far less powerful hardware is turning up everywhere and is almost always on a network (eg. congested WiFi) that just does not have the bandwidth to take pixmaps put together by more powerful hardware
Then explain how well RDP has worked usably for me even across the Internet to a PC on what the cable company likes to call "slow DSL from the phone company". Is "congested Wi-Fi" worse than DSL's upstream? And explain how OnLive, Twitch, or any other sort of live streaming video works.
X12? That's an Electronic Data Interchange standard. Nothing to do with the X Window System.
... running a massive service such as that with elevated privileges...
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
As long as Wayland doesn't support remoting it will not replace anything. Remoting is needed for non-hobbyist heterogenic environments where you will have to be able to "run" Windows applications on *NIX boxes, and vice versa.
(Most of tailored business applications will never run reliably enough with wine. Also, it is often waste of resources to use fat clients where thin would sufficie. Except you can't do thin clients with Wayland...)
Wayland is so far from feature parity that it can be mostly seen as a joke - for corporate environments that is. When it does something like "ssh -X" and "voila, remote application is running", get back to talking about it. Before that stfu.
I only watched the beginning at this point, but the presenter says something that does not bode too well for the rest. Speaking about how it was bad that the client side parser was insecure, especially for setuid clients:
This code was written in the eighties with the assumption that the server is trusted so there is little validation on the client side.
Well, of course the server is trusted. This is the code which runs on your local workstation. If your input terminal is compromised, you're so hosed anyway that it's not really worth considering exactly what hole they will be using !
Fine. Then we'll call the X11 successor X13. Just like IPv4's successor is IPv6
Worse than X so far in my experience. Maybe it's improved with Win8 but I doubt it. The "entire desktop" thing instead of single applications can be a big speed hit and while RDP is supposed to do that how many implementations actually do? Who forks out the cash for that extra feature? It seems to be very rare to me.
So you are comparing speed - let's lower that bar a bit more. It may work badly on dialup but stuff on X does actually work even under such terrible conditions. RDP was not designed to cope with such situations so it's amusing that people keep trying to compare the two. After all these years it's still a tossup between original VNC and current RDP.
So this "but RDP works on a fast network connection" (which even slow DSL is) is supposed to mean what exactly? X, VNC and everything doing the same job should work with so much bandwidth or it's a badly flawed solution for remote access.
I really do not think you supplied any more here than "something works so the other thing sux". It seems misleading to me.
Clearly you're not a detail kinda guy. If you'd done your homework (lmgtfy) X13 is a commercial Business Management software product. Their lawyers might have something to say about about that.
If your next suggestion is X14, that's a bathroom cleaner – cue the jokes for that in 3... 2... 1...
X15, a rocket plane. Jokes about it being slow in 3... 2... 1...
X16. Maybe we should just cut to jokes about calling the damn thing X-whatever. In 3... 2... 1...
But the real issue is you're apparently missing the point (or in denial) that the successor to X11 is Wayland. Like it or not.
Jokes aside, trademarks only apply in the same field of business (as can be seen in Apple Corps v Apple Computer). It is Wayland though.
"To any truly impartial person, it would be obvious that I am right."
Worse than X so far in my experience.
My experience differs: RDP tunneled over SSH responds better than X11 over the same tunnel, especially with these newer X11 GUI toolkits that just push lots of pixels to the X server. And no, Windows 8 isn't involved at all; I'm using Remmina on Ubuntu to view Terminal Services on Windows Server 2003.
I really do not think you supplied any more here than "something works so the other thing sux".
If you need, I can perform benchmarks for you of Ubuntu viewing an application on another Ubuntu machine over X11 and Ubuntu viewing the Windows version of the same application over RDP.
Another detail guy. I wrote nothing about trademarks for X14 or X15. IOW, tell me something I/we don't know!
Picking a name that will be the butt of jokes transcends anything to do with trademarks. Marketing 101: you don't want a name that people are going to laugh at.
Wayland is more a replacement, rather than a successor, to X11. A successor would be backward compatible at least.
Change the "only" to "also" and you've got it. Throwing out what works in my workplace for the sake of fashion would impact on the core business and of course cost me my job.
Such thinking on your part and such personal attacks are of course juvenile, especially since what you are advocating is pre-alpha software with a window manager that cannot even iconify or resize windows yet.
You should be ashamed of yourself.
RDP's display model is, basically, GDI's; in fact the RDP layer appears to Windows as a display device driver exposing all the usual APIs. Which means that the client can push pixmaps across the link, get a handle to the opaque pixmap object (an HBITMAP in Windows parlance if I remember right), and then issue a draw call that just says "draw this pixmap" (or part of this pixmap).
For a lot of samey-looking GUI applications where elements like button backgrounds and borders are reused, this can add up to a huge savings in network traffic.
Of course, X can do this too; in fact the XRENDER extension can do Porter-Duff compositing of server-side pixmaps with an alpha channel. But if you compare RDP making full use of the Windows display model with X11 where the app developer coded it like a VGA video game and just scribbled into a frame buffer which it pushes to X for display on every update, then you're bound to think "holy shit, RDP is fast" and "holy shit, X is slow".
N4st0r, trixx0r h0bb1tz0rz! Th3y st0l3 0ur pr3c10uzz!
A government branch created this shite by infecting developers with the C and C++ abominations.
What we need are memory-safe languages to squash at least 50% of these bugs: Algol, Spark Ada, Modula-2.
Sorry to break this to you my dear Americans, but your technology is also fucked at the conceptual level !
Kind regards
Deutscher Informatiker.
Can you say "Enabling Technologies" ?
Brought to you by a friendly Admiral with billions in his pockets. And millions of users.
You are responding in the best tradition of Corporate Bull$hit. The guy showed you some glaring examples of incorrect memory management, probably exploitable, and what do you do ? Not fixing, talking shite.
Or do you dispute his claims ? If yes, please state this clearly instead of posting a boilerplate of generic bureaucratese.
You know what ? Nobody needs to use Qt. There are tons of alternatives and your behaviour will be sufficient to nail Qt's coffin shut.
How did those benchmarks go?
Test procedure Connect to Windows or Ubuntu server using a display protocol forwarded through SSH and open Firefox. Navigate to an intranet page, enter my name and password, navigate to a page with a calendar, and hide and show the calendar. Result in Firefox for Windows over RDP Update completes in less than 200ms. Typing my username responds as fast as if it were local. Result in Firefox for Linux over X11 Not as painful as I had seen the last time I ran this test, but still takes about 1 second. Sometimes just typing my username lags noticeably.Understand what I'm writing about yet?
No, sorry :(
Does that mean that applications will support X IF I can compile them myself? [...] Or will any program built using a toolkit that supports both just run on either without any added difficulty?
I see no reason for the popular toolkits (GTK+ and Qt) to discontinue support for X11 in the near future. The toolkit could make X11 support a compile-time option, but then it's a matter of recompiling the toolkit, not the applications. An X11-focused distribution is likely to keep the X11 support option turned on in the distro's counterpart to USE flags.
I also see posts that someone has remote display working on Wayland posted on some GIT repository. But, what does one need to do to use it?
Once Wayland makes it into an end-user distribution, I'm about 90 percent sure that someone will post a remote desktop HOWTO within the first two weeks.