Slashdot Mirror
X11/X.Org Security In Bad Shape
An anonymous reader writes "A presentation at the Chaos Communication Congress explains how X11 Server security with being 'worse than it looks.' The presenter found more than 120 bugs in a few months of security research and is not close to being done in his work. Upstream X.Org developers have begun to call most of his claims valid. The presentation by Ilja van Sprunde is available for streaming."
Aren't we going to replace it with Wayland or something really soon?
This is a good thing. This is the way it is supposed to work. This is how things get better. A little late, but it good to see this happening.
You must be new here. Nothing on Slashdot matters, including the people and the comments.
Every X11 server needs a rendering target. For some X11 servers, this is a video card. For others, it is a virtual frame buffer that gets served through X11VNC or XRDP. And on machines running Wayland, the X11 server will render to the Wayland compositor. Porting an application's GUI toolkit allows the application to bypass XWayland, but not all applications will be ported to Wayland immediately, especially proprietary software no longer under mainstream support and free software without a large enough user base. But once enough applications get ported, the more complex and less security-hardened parts of X11 will be paged in only while an X11 application is updating its window.
Since media.ccc.de seems down, this video is also on YouTube: https://www.youtube.com/watch?v=n9fANvt0IsM
Help Brendan pay off his student loans
Given that X is nearly 30 years old... it sounds more like a number of issues were not considered way back when (trust boundaries for one), and that those same mistakes/assumptions have been carried forward for much of this time.
Help Brendan pay off his student loans
Cue hord of posts demanding that Wayland must die as it can never replicate the mass security violations that X11 contains.
When you use an Insecure X11 Stack...
You are displaying windows WITH THE NSA!
Yet another reason why they need to whip Wayland into shape.
AntiFA: An abbreviation for Anti First Amendment.
I'm sorry. You were complaining about a news (Yes, news) story about a talk from CCC (Which is highly popular with, and immensely relevant for, nerds), posted on Phoronix (A website that devotes itself almost entirely to information, news and reviews on hardware and software from a Linux-based perspective), about a lot (120+) of security holes (Things that matter) in the X11/X.org servers (Which are the basis for (almost) all GUI-driven applications in Linux, *BSD and some of OSX).
By my count, that makes this story "News", "For Nerds", and "Stuff that matters". Oh, and the irony in posting that Phoronix is a "Link Farm" on /. is almost entirely palpable.
X had its day in the sun. I want a responsive and fast GUI with network connectivity being somewhere in 10th place. Make that socket/DRI/whatever they cooked up this year into a module so the rest of us don't suffer.
Only the State obtains its revenue by coercion. - Murray Rothbard
A presentation at the Chaos Communication Congress explains how X11 Server security with being 'worse than it looks.'
Still, at least you didn't just copy and paste, so points for that.
systemd is Roko's Basilisk.
It is not the way X works is particularly secure to begin with. Once an app has a connection to the X server, it has full control over the world of window, pixmaps and events on the server including of course all other apps.
Not that I have any faith in Wayland or Mir being any better, its developers coming from the X world in the first place, I am sure that they will make their new shiny systems vulnerable in the same ways.
"We mustn't be caught by surprise by our own advancing technology" -- Aldous Huxley
I intended to emphasize "more complex" rather than "less security-hardened". There's plenty of "more complex" legacy stuff in X11 that almost no modern application uses; most GUi toolkits nowadays just push pixmaps around. The featured article describes the effort to fix the "less security-hardened" part, but the only way to break with "more complex" is to ditch X11 in favor of something that does one thing (push pixmaps around) and does it well. Isn't that what the UNIX philosophy is supposed to be anyway?
Some were certainly considered but prohibited by law. Due to crypto export restrictions, it wasn't until the limits on Open Source were loosened that X was legally permitted to have any kind of meaningful security. The non-export version still had to talk to the exportable edition, after all.
Yes, X was (and is) incredibly sloppy by today's standards and yes a lot of that was due to poor decisions in the days of X10. (Yes, boundaries are a decision. MIT could have chosen any sort of access control list system they wanted, with yet another library handling it. You could have then substituted whatever you wanted, so long as the API remained the same. Pretty much futureproof, no significant extra coding, easier to maintain than what they actually did.)
The coding flaws - of which there were many - were often detectable by tools as ancient as lint.
But you must also remember, X10 and X11 were never intended as products. They were reference implementations of a protocol, not finished products intended for actual use. The different vendors were always "supposed" to provide their own.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Based on the Qt team's complete lack of willingness to fix security bugs apparently when you render with Qt, you're rendering with the NSA.
Then we would have X12, Wayland and Mir competing...redundant fragmentation over minor differences.
Given that X is nearly 30 years old... it sounds more like a number of issues were not considered way back when (trust boundaries for one), and that those same mistakes/assumptions have been carried forward for much of this time.
God I hate that word. If there is one word that I wish I could beat out of every developer, it's "assumption". I know they are necessary to an extent, but man do they come back to bite you in the ass every time...
I browse on +1 so AC's need not respond, I won't see it.
Apart from the Xorg hardware drivers it's using to blit it's composed framebuffer onto people's screens.
Wayland is a framebuffer compositor designed to replace a few features in X in a new (and incompatible) way in the interests of speed. It still relies on some stuff made for X, and IMHO that's some of the slowest stuff involved in putting things on the screen (eg. gtk), so it will be a bit of a struggle to get an obvious speed benefit unless improvements are made there as well or it gets it's own toolkit (which means it will start to resemble the complexity of X).
Meanwhile far less powerful hardware is turning up everywhere and is almost always on a network (eg. congested WiFi) that just does not have the bandwidth to take pixmaps put together by more powerful hardware
Then explain how well RDP has worked usably for me even across the Internet to a PC on what the cable company likes to call "slow DSL from the phone company". Is "congested Wi-Fi" worse than DSL's upstream? And explain how OnLive, Twitch, or any other sort of live streaming video works.
... running a massive service such as that with elevated privileges...
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
You're correct of course, nothing on Earth really matters. We all will die eventually and the whole universe may (will?) be gone one day. Luckily I can mostly forget that and get excited about little things that don't really matter.
As long as Wayland doesn't support remoting it will not replace anything. Remoting is needed for non-hobbyist heterogenic environments where you will have to be able to "run" Windows applications on *NIX boxes, and vice versa.
(Most of tailored business applications will never run reliably enough with wine. Also, it is often waste of resources to use fat clients where thin would sufficie. Except you can't do thin clients with Wayland...)
Wayland is so far from feature parity that it can be mostly seen as a joke - for corporate environments that is. When it does something like "ssh -X" and "voila, remote application is running", get back to talking about it. Before that stfu.
I only watched the beginning at this point, but the presenter says something that does not bode too well for the rest. Speaking about how it was bad that the client side parser was insecure, especially for setuid clients:
This code was written in the eighties with the assumption that the server is trusted so there is little validation on the client side.
Well, of course the server is trusted. This is the code which runs on your local workstation. If your input terminal is compromised, you're so hosed anyway that it's not really worth considering exactly what hole they will be using !
Fine. Then we'll call the X11 successor X13. Just like IPv4's successor is IPv6
Jokes aside, trademarks only apply in the same field of business (as can be seen in Apple Corps v Apple Computer). It is Wayland though.
"To any truly impartial person, it would be obvious that I am right."
Worse than X so far in my experience.
My experience differs: RDP tunneled over SSH responds better than X11 over the same tunnel, especially with these newer X11 GUI toolkits that just push lots of pixels to the X server. And no, Windows 8 isn't involved at all; I'm using Remmina on Ubuntu to view Terminal Services on Windows Server 2003.
I really do not think you supplied any more here than "something works so the other thing sux".
If you need, I can perform benchmarks for you of Ubuntu viewing an application on another Ubuntu machine over X11 and Ubuntu viewing the Windows version of the same application over RDP.
Wayland is more a replacement, rather than a successor, to X11. A successor would be backward compatible at least.
Change the "only" to "also" and you've got it. Throwing out what works in my workplace for the sake of fashion would impact on the core business and of course cost me my job.
Such thinking on your part and such personal attacks are of course juvenile, especially since what you are advocating is pre-alpha software with a window manager that cannot even iconify or resize windows yet.
You should be ashamed of yourself.
RDP's display model is, basically, GDI's; in fact the RDP layer appears to Windows as a display device driver exposing all the usual APIs. Which means that the client can push pixmaps across the link, get a handle to the opaque pixmap object (an HBITMAP in Windows parlance if I remember right), and then issue a draw call that just says "draw this pixmap" (or part of this pixmap).
For a lot of samey-looking GUI applications where elements like button backgrounds and borders are reused, this can add up to a huge savings in network traffic.
Of course, X can do this too; in fact the XRENDER extension can do Porter-Duff compositing of server-side pixmaps with an alpha channel. But if you compare RDP making full use of the Windows display model with X11 where the app developer coded it like a VGA video game and just scribbled into a frame buffer which it pushes to X for display on every update, then you're bound to think "holy shit, RDP is fast" and "holy shit, X is slow".
N4st0r, trixx0r h0bb1tz0rz! Th3y st0l3 0ur pr3c10uzz!
Ah, if that wasn't so funny, I wouldn't bother replying :-) Corporate? Neither I nor the security guy who discussed this are employed to work on Qt, we're from KDE and this is all in our own time. Boilerplate? Nope, in true Slashdot tradition it's just off the top of my head :-) Tons of alternatives? Name one. Even Linus has moved to Qt for its cross-platform abilities, no other toolkit comes close, and its our demanding standards that keeps people using Qt. We'll be around long after AC's like you have left.
The guy who raised the issue was told we don't view it as a security issue, and he agreed that it only affects apps running under setuid which we don't support. We asked him to open a bug report so we could deal with it through normal processes. He didn't. If he can't even be bothered to log a bug with Qt or KDE then why should we accord him the same respect as researchers who follow protocol and work with us to resolve real issues?
How did those benchmarks go?
Test procedure Connect to Windows or Ubuntu server using a display protocol forwarded through SSH and open Firefox. Navigate to an intranet page, enter my name and password, navigate to a page with a calendar, and hide and show the calendar. Result in Firefox for Windows over RDP Update completes in less than 200ms. Typing my username responds as fast as if it were local. Result in Firefox for Linux over X11 Not as painful as I had seen the last time I ran this test, but still takes about 1 second. Sometimes just typing my username lags noticeably.Understand what I'm writing about yet?
No, sorry :(
Does that mean that applications will support X IF I can compile them myself? [...] Or will any program built using a toolkit that supports both just run on either without any added difficulty?
I see no reason for the popular toolkits (GTK+ and Qt) to discontinue support for X11 in the near future. The toolkit could make X11 support a compile-time option, but then it's a matter of recompiling the toolkit, not the applications. An X11-focused distribution is likely to keep the X11 support option turned on in the distro's counterpart to USE flags.
I also see posts that someone has remote display working on Wayland posted on some GIT repository. But, what does one need to do to use it?
Once Wayland makes it into an end-user distribution, I'm about 90 percent sure that someone will post a remote desktop HOWTO within the first two weeks.