1

What the most harmful thing can malware program started as separate limited user account do if it has access to the X server?

Network and filesystem things are already considered by chroot and netfilter.

It obviously can lock the screen and I will need to switch to other vt and kill it manually. Can it for example disrupt other GUI programs on the same X server (access a root terminal in nearby window)?

I know that it is safer to run it in separate X server, for example, in Xtightvnc or even some virtual machine, but how dangerous is to just run it like other programs?

Improve this question

3 Answers 3

Reset to default
1

If you've already gone to the trouble of setting up a separate X server, have you considered running the program inside a nested X-server like Xnest. Then, you would completely isolate the malicious program in its own X envrionment. Or if you want to be absoutely safe, you might even consider something VirtualBox for a whole other VM.

Improve this answer
0

Once a program has access to the X server it can virtually do everything you can do with a mouse and a keyboard. This will not be limited to this application's window should it have one, but could affect other running applications.

There are tons of applications to help people with accessibility-related problems assisting them to use the keyboard or the mouse to control their X sessions. Why should malware not do that and just pretend to be you?

Improve this answer
1
  • Example: groups.csail.mit.edu/uid/sikuli It's not a virus, it's a GUI scripting engine that you can use to script arbitrary actions, like clicking on GUI buttons and typing in text boxes and stuff. I'm just providing it as an example of what capabilities a malicious program would have access to.
    – Ryan C. Thompson
    Commented Mar 27, 2010 at 22:21
0

Install Zephyr and then :

Zephyr -ac -screen 800x600 -br -reset -terminate :2 &

to run a nested/isolated x session.

Jim

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .