Wait, What? Kids Found A Security Flaw in Linux Mint By Mashing Keys!

[Lightwreather]

Summary

The myth is that if you want a super secure password, you let your cat run over your keyboard. But, in a recent incident, a security flaw was discovered by two harmless kids by simply mashing the keyboard.

 

Quotes

Quote

 

I’m sure many of you must have taunted the kids to try unlocking your computer after you lock it (I did that a lot).

Similarly, two kids of wanted to hack in to their dad’s Linux desktop. Surprisingly, they actually did what they said. They unlocked access to the computer!

The GitHub issue describes this incident as follows:

A few weeks ago, my kids wanted to hack my linux desktop, so they typed and clicked everywhere, while I was standing behind them looking at them play… when the screensaver core dumped and they actually hacked their way in! wow, those little hackers…

 

My thoughts

Hilarious, but never fear, seems that it is now fixed

 

Sources

https://news.itsfoss.com/security-flaw-in-linux-mint-kids/

[Drama Lama]

wöaräalkadflöadflsfadateatr<wsfok

 

and now I hacked your computer

 

the kids overloaded the screensaver of the Cinamon Desktop envoirment by typing the letter "ē"

 

so it guess it's a flaw that could be in all Distros using Cinamon but not in Mint versions using other Desktop envoirments like Gnome or Mate.

 

Spoiler

sauce:

https://www.heise.de/news/l-f-Spielende-Kinder-hackten-Linux-Mint-5028653.html

( it's German but Google translate will probably help you )

 

Edited January 20, 2021 by Drama Lama

[Lightwreather]

28 minutes ago, Drama Lama said:

and now I hacked your computer.

Please don't take anything valuable.

Jokes aside, yea It could've very well been part of the DE.

[LAwLz]

Apparently it's a bug introduced with Cinnamon 4.2. So it might affect other distros that use the same DE. Not sure if there are any big distros using Cinnamon by default (other than Linux Mint) but it's something to keep aware of. If you use Cinnamon, you probably want to upgrade.

[Drama Lama]

14 minutes ago, LAwLz said:

If you use Cinnamon, you probably want to upgrade.

[Master Disaster]

For those looking for a more technical analysis, here's a breakdown from one of the Mint dev team

Quote

Quick update on this.

• It seems to affect all distros and to be a regression from https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361444f4b60501ebf67b9
• This commit came in as a fix for CVE-2020-25712

https://security-tracker.debian.org/tracker/CVE-2020-25712
https://ubuntu.com/security/CVE-2020-25712

We need to understand the xserver code a little bit more and check some of the later commits upstream to understand whether this is something to be fixed in xorg or caribou, and if it's to be fixed in xorg whether it's already fixed in their master version or not.

There's an update in Ubuntu 20.04 (Mint 20.x) which backports xorg 1.20.9 towards focal... that backport actually messed up and missed the CVE fix (which is present in the groovy version), so upgrading to this temporarily fixes this issue. When Ubuntu realize this mistake they'll backport the CVE fix again and this will break again.

Afaik this affects all distributions. On our side we could verify it affects Mint 20x and LMDE 4, and we're pretty sure it affects 19x and 18x as well.

 

Quote

We have two different issues:

• In all versions of Cinnamon, the on-screen keyboard (launched from the menu) runs within the Cinnamon process and uses libcaribou. Pressing ē crashes Cinnamon.
• In versions of Cinnamon 4.2 and higher, there's a libcaribou OSK in the screensaver. Pressing ē there crashes the screensaver.

 

Quote

Cinnamon crash reproduced in Mint 18.3.
Screensaver crash reproduced in Mint 19.3.
Screensaver crash reproduced in Mint 20 with xserver-common 1.20.8-2ubuntu2.2~18.04.4 (Ubuntu's 1.29 mistakenly forgot to include the CVE fix and overrid it, so as a side effect 1.29 fixes this issue in Mint 20.x right now but that's not an acceptable solution).
Screensaver crash reproduced in LMDE 4.

 

Quote

Oddly enough: since yesterday, we haven't been able to reproduce the crash here. Pressing ē on the on-screen keyboard, or changing the keyboard input language and pressing anything, both just result in characters being added to the password input. The only package change since my comment earlier in the issue was to upgrade NVIDIA drivers from 450.80.02 to 450.102.04. That did include an upgrade of xserver-xorg-video-nvidia-450 which sounds like it could be related, but I am skeptical. Pretty strange.

 

So the bug stems from a fix for another bug in Xserver, I guess that explains why nobody picked it up until it made it into the wild.

 

Pretty funny it was found by kids mashing keys on their dads laptop though

[Guest]

That's certainly a weird one.

[Spindel]

Still more secure than Windows XP where you booted into failsafe mode and created a new admin account and you had full access to the computer  

[Master Disaster]

2 minutes ago, Spindel said:

Still more secure than Windows XP where you booted into failsafe mode and created a new admin account and you had full access to the computer  

I remember walking into a pretty big pawn shop chain here in the UK and unlocking every computer they had on the shop floor using this method. God knows what people did to them after I left.

[cj09beira]

36 minutes ago, Spindel said:

Still more secure than Windows XP where you booted into failsafe mode and created a new admin account and you had full access to the computer  

thant the heavens for that "vulnerability" though as i forgot my password multiples times and that is how i go back in

[akio123008]

1 hour ago, Drama Lama said:

screensaver of the Cinamon Desktop

which is why you use KDE I guess haha

[Drama Lama]

56 minutes ago, Master Disaster said:

Pretty funny it was found by kids mashing keys on their dads laptop though

And he wasn't to reproduce it by himself

[Spindel]

1 hour ago, cj09beira said:

thant the heavens for that "vulnerability" though as i forgot my password multiples times and that is how i go back in

That thing (among others) in Windows XP was so stupid I wouldn't even class it as a vulnerability but rather call it a feature. 

[Bananasplit_00]

So all its all of cinnamon... Hope this gets patched quick

[Dutch_Master]

49 minutes ago, Spindel said:

That thing (among others) in Windows XP was so stupid I wouldn't even class it as a vulnerability but rather call it a feature failure. 

There, I corrected it for you

[MageTank]

So all those hackers in the movies mashing random keys weren't faking it after all... The more you know.

[wamred]

This is the best thing I have heard all day.

[rcmaehl]

 

 

If you have physical access to a device, the device's security is or eventually will be screwed.

[williamcll]

Just like in the movies.

[BuckGup]

That's twice now. I remember the first time a kid just hit the spacebar 13 times for the password and it worked. Every UNIX distro was affected by it too

[rcmaehl]

 

 

OH GEEZ

 

[n0stalghia]

Thanks, Latvia

[sub68]

huh this is a weird bug but at least its caught with kids not actual hackers

 

[sub68]

5 minutes ago, gabrielcarvfer said:

They've probably found it and a way to exploit it. 

yep thats how life works

[SkilledRebuilds]

15 hours ago, Master Disaster said:

I remember walking into a pretty big pawn shop chain here in the UK and unlocking every computer they had on the shop floor using this method. God knows what people did to them after I left.

Msconfig..... and set 1 CPU thread and 2GB MaxRam*

Making Potatoes!!!

*quite evil really