Slashdot Mirror
Turns Out That Snaps Are Not Secure In Ubuntu With X11 (softpedia.com)
prisoninmate quotes a report from Softpedia: According to Matthew Garrett, a renowned CoreOS security developer, and Linux kernel contributor, Canonical's new snap package format is not secure at all when it is used under X.Org Server (X Window System), which, for now, it is still the default display server of the Ubuntu 16.04 LTS (Xenial Xerus) operating system. The fact of the matter is that X11's old design is well-known for being insecure, and Matthew Garrett took the time to demonstrate this by writing a simple snap package that can steal data from any other X11 software, in this case anything you type on the Mozilla Firefox web browser. As more developers will provide snaps for their apps, Canonical needs to do something about the security of snaps in Ubuntu when using X11 or switch to the Mir display server. In the meantime, the security of snaps remains unaffected for the Ubuntu Server operating system, which is usually used without a display server. Canonical has officially released Ubuntu 16.04 LTS, which is now available to download for those interested.
Snaps for apps? What in the fuck
A program on a computer can access the data of another program on the same computer?
Why is this supposed to bother me?
This is nothing new. X11 is fundamentally insecure. Yes, another application can send input to your xterm that's su'd to root. Nothing new.
So first we get a "hey, the new ubuntu is due tomorrow" story, then a "new ubuntu released" story, and now this "hey, the new ubuntu is not secure" story.
Can we tone down the ubuntu stories a little bit?
But my submission about the Firebird SQL database version 3.0's release, arguably the most important release in their 14-year history, didn't make it. (it's here, by the way)
i never caught on to the whole docker container/snap package thing anyways. since when did it get so hard to set things up by yourself? also, if your package manager sucks balls, then you need to find a new distro. stop putting up with crap.
"snaps" is a new package format for applications on Ubuntu. It is basically a package with dependencies, bundled together and meant for running in a container (docker or lxc I suppose?) which means that the OS is protected from it.
However, since the application has access to X11 window server it has access to the facilities in it including monitoring keystrokes and mouse gestures sent to other X11 applications. So essentially a "snaps" can be a trojan keylogger.
The article/blog does _not_ explore if X11's "untrusted client" feature would help.
"All those eyes on the code" didn't help here or on Google Chrome's Open SORES code used to make malware out of it http://it.slashdot.org/story/15/10/20/1254225/efast-malware-hijacks-browser-with-chrome-clone
If you have some software in a deb, and put that software in a snap, then you have increased your security slightly, but not much. If that software is then put on a Wayland or Mir desktop then you have increased the isolation of it a lot. .deb then you ran it's installation script as root. If it was bad then you are toast already.
If your software is in a
Snaps can be installed without being root, into the user home directory. This is an increased level of ability to run untrustworthy software. This whole exercise is so that open source systems can run untrustworthy proprietary paid for apps without the untrustworthy apps being a huge risk to the peer-reviewed code and other proprietary apps.
Snaps are *not* a step backwards, but they don't get all the way to the end goal by themselves. They may have been over-sold slightly by Canonical because they are mainly for the phone which runs Mir, plus things like Firefox on the desktop which are trustworthy.
Does XEvilTeddy still work over an SSH connection with ssh -X instead of ssh -Y? If not, then the problem is rather easily solvable, and the means to solve it have been there for years.
Let me check...
git clone configure make autoconf apt-get install blah blah oh wow a separate package for xtest wow you managed to save posivily kilobytes for the 0 people who would install x11-dev but not xtest-dev blah blah make oh ffs it needs to be installed this is annoying. Oh hey didn't check your code paths, build build blah
DONE!
OK...
ssh 127.0.0.1 -o 'ForwardX11Trusted no'
aaaand...
Oh look it doesn't work.
So no, X11 is, yet again not fundementally broken. It has a "default allow" policy, but mechanisms have existed for decades to add security to it. The main failing for ubuntu was not enabling the long-established security protections.
SJW n. One who posts facts.
...so long as its not running as root. That is kind of the whole point of OS's with user priviledge levels, file system permissions and protected virtual memory. Thats not what containers are for. I could explain but just go google FFS.
Honestly this sounds like Snaps in general are horribly insecure on their own.
Do not look at laser with remaining good eye.
If you run Ubuntu Server, you're not using X.org. If you're running Ubuntu 16.04 on the desktop, you're probably not using any snap packages (except maybe Firefox). By the time desktop applications start to be packaged in snappy form, Ubuntu will be using Mir as the display server instead of X.org.
And Wayland does the same thing.
Not to mention the simple fact probably the #1 question for Ubuntu Server is "How do I install a GUI?"
And Wayland has the same feature... No, bug... No, feature!! IT'S INSECURE AAAAAHHHHH!
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
So it's an issue that's being addressed, and snaps do provide security for non-graphical apps. It's unfortunate that it's being implied that the security benefits are more universal than they are but it's a subtle point that is difficult to emphasize. When trying to promote a new release, you want to emphasie the new features, not the subtle non-features.
Here's how!
Start gnome-terminal
$ xinput list
Virtual core pointer id=2 [master pointer (3)]
Virtual core XTEST pointer id=4 [slave pointer (2)]
VirtualBox mouse integration id=9 [slave pointer (2)]
ImExPS/2 Generic Explorer Mouse id=11 [slave pointer (2)]
Virtual core keyboard id=3 [master keyboard (2)]
Virtual core XTEST keyboard id=5 [slave keyboard (3)]
Power Button id=6 [slave keyboard (3)]
Sleep Button id=7 [slave keyboard (3)]
Video Bus id=8 [slave keyboard (3)]
AT Translated Set 2 keyboard id=10 [slave keyboard (3)]
Find the id of the keyboard (10 in this case)
$ xinput test 10
open another gnome-terminal
$ sudo ls
[sudo] password for AC:<password>
Watch the scancodes in the first terminal. OMG there's ur password! (for brevity just listing keypress)
key press 39
key press 30
key press 40
key press 32
key press 65
key press 46
key press 39
key press 36
key press 58
key press 44
key press 42
key press 14
key press 18
key press 33
key press 30
key press 28
key press 52
Open a gui app as root
Type something
OMG there's muh typing!
There you have it, your very own keylogger. It works on all systems with X11 because by default nobody locks it down.
Snaps are Ubuntu's desperate attempt to be trendy and cool like those new kids with the phones and tablets.
X11 programs can see other programs' events. That's even true if I install the program from a .deb or a tarball, no? So WTF does this problem have to do with a package format?
(Oh, and if calling me ignorant/lazy or saying LMGTFY helps you explain it, fine. I'll take your assholiness as long as you have answers.)
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I blame systend
Seriously, i don't know what motivates Canonical to reinvent the package manager.