[LUG] Secure Shell?

[Kevin Lucas <kevin.lucas@xxxxxxxxxxxxxxxxxx>]

Just been reading the LinuxUser mag and tried this from Joanna Rutkowska
It shows how insecure a root shell can be

in a terminal 
do 

( you need the package "xorg-x11-apps" to do this)

[kevin@kevinspc ~]$ xinput list
â Virtual core pointer                          id=2    [master pointer  (3)]
â   â Virtual core XTEST pointer                id=4    [slave  pointer
(2)]
â   â Microsoft Microsoft Wireless Optical Mouse 1.0A  id=9    [slave
pointer  (2)]
â Virtual core keyboard                         id=3    [master keyboard (2)]
    â Virtual core XTEST keyboard               id=5    [slave  keyboard
(3)]
    â Power Button                              id=6    [slave  keyboard
(3)]
    â Power Button                              id=7    [slave  keyboard
(3)]
    â ov519                                     id=8    [slave  keyboard
(3)]
    â AT Translated Set 2 keyboard              id=10   [slave  keyboard
(3)]
    â i2c IR (HVR 1110)                         id=11   [slave  keyboard
(3)]



note the AT id = 8
 type in 

xinput --test 8

then in a root terminal type some commands

and see the keyboard codes as root types 
remember you are just a normal user ?

perhaps in a bash script you could redirect the output of xinput to
Dev/null or just Never install the Xorg-X11-apps


-- 
Regards

Kevin Lucas
Minions Post Master(Sub) 
Eleven Years in the Making!
www.minionsbandb.co.uk
www.tearooms.minionsbandb.co.uk
FaceBook Minions_shop
Po House, Minions,
Liskeard Cornwall 
PL14 5LE
01579363386


-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq