Intro
We’ve been audited again. My most faithful followers will recall the very popular and educational article on SSL ciphers that cane out of our previous audit. So I guess audits are a good thing – helps us extend our learning.
This time we got dinged on that most ancient of protocols, X Windows. So this article is aimed at all those out there who, like me, know enough about X11 to get it more-or-less working, but not enough to claim power user status. The X cognescenti will find this article redundant with other material already widely available. Whatever. Sometimes I will post an article as though it were my own personal journal – and I like to have all my learning in one easy-to-find place.
The details
The findings amount to this: anyone in our Intranet can take a screen shot of what the people using Exceed are currently seeing. The nice tool (Nessus) actually provided such a screen shot to back up its claim, so this wasn’t a hypothetical. At Drjohn’s we believe in open source, but we do have our secrets and confidential information, so we don’t want everyone to have this type of access.
Here is some of the verbatim wording:
Synopsis The remote X server accepts TCP connections. Description The remote X server accepts remote TCP connections. It is possible for an attacker to grab a screenshot of the remote host. Solution Restrict access to this port by using the 'xhost' command. If the X client/server facility is not used, disable TCP connections to the X server entirely. Risk Factor Critical CVSS Base Score 10.0 (CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C) References CVE CVE-1999-0526 ... Hosts drjms.drjs.com (tcp/6002) It was possible to gather the following screenshot of the remote computer. ... |
So in my capacity as old Unix hand I was asked to verify the findings. This turned out to be dead easy. Here are the steps:
– pick a random Linux machine which has xwd installed
> xwd -debug -display drjms.drjs.com:2 -root -out drjms.xwd
> cat drjms.xwd|xwdtopnm|pnmtopng > drjms.png
The PNG file indeed showed lots of interesting stuff from a screen capture of the user’s X server – amazing.
I should mention that tcp port 600 maps to X Server display 0, 6001 to 1, 6002, to 2, etc. That’s why I set my display to drj…com:2 since port 6002 was mentioned in the findings as vulnerable.
My advice: don’t use
> xhost +
or whatever is the equivalent to that in Exceed onDemand.
Guilty
Now I have to admit to using xhost + in just this way in my own past – so convenient! Now that I see how dead easy it makes it to get a screenshot – in fact I tested the whole thing against my own XServer first – I will forego the convenience.
Conclusion
This is the danger in knowing something and some things, but not enough!
References
But I still stand by use of xhost + in the privacy of your home network, as for instance I show it in my Raspberry Pi without a monitor acticle.
I picked off that command set from this interesting article: https://www.linuxquestions.org/questions/linux-general-1/commanding-the-x-server-to-take-a-png-screenshot-through-ssh-459009/