[Full-disclosure] Reminder: XGrabKeyboard is not a security interface

From: Florian Weimer (fw_at_deneb.enyo.de)
Date: 05/31/05

  • Next message: Florian Weimer: "[Full-disclosure] A short warning on the X11 Editres protocol" 
    To: security-announce@lists.enyo.de, bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Date: Tue, 31 May 2005 23:27:11 +0200

    Some application authors assume that the XGrabKeyboard function can be
    used to obtain exclusive access to the keyboard, to prevent other X11
    clients on the same display from eavesdropping key presses (such as
    passwords). It's been known for some time that this is not the case
    (for example, Casper H.S. *** mentioned this in a November 1994
    posting, <3afddh$1hq@mail.fwi.uva.nl>): clients can poll the keyboard
    using XQueryKeymap. A tool called "xspy" demonstrates this.

    Recent versions of the xterm manpage contain a carefully worded
    warning at the end of the paragraph quoted below:

    | The xterm menu (see MENUS above) contains a Secure Keyboard entry
    | which, when enabled, attempts to ensure that all keyboard input is
    | directed only to xterm (using the GrabKeyboard protocol request).
    | When an application prompts you for a password (or other sensitive
    | data), you can enable Secure Keyboard using the menu, type in the
    | data, and then disable Secure Keyboard using the menu again. This
    | ensures that you know which window is accepting your keystrokes. It
    | cannot ensure that there are no processes which have access to your
    | X display that might be observing the keystrokes as well.

    But there are other applications (quintuple-agent, to name just one)
    whose documentation or source code indicates that the authors think
    that XGrabKeyboard prevents keyboard sniffing from other X clients.
    It doesn't, and end user documentation should not suggest that it is
    safe to run trusted and untrusted clients on the same X11 display.

    The X Security Extension prevents the use of XQueryKeymap by
    non-trusted clients. However, little beyond that is known about its
    effectiveness.
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Florian Weimer: "[Full-disclosure] A short warning on the X11 Editres protocol"