Hack In Paris 2015: a Nice X11 Backdoor

Real-world use case

You want a field report on a notable security conference: I look back at Hack In Paris 2015, which I attended as a partner.

Backdooring X11 with class

I want to share with you a talk by Matias Katz, an Argentinian hacker, who showed us how to backdoor X11. I liked the concept of natively using a system function tied to Linux. His disconcerting ease in pulling it off also convinced me. The X11 backdoor allows access to a locked computer through Dbus (a middleware). It's true that a large number of Linux distributions use this exact mechanism. My article recaps the overall concept of the attack.

Foreword: the context

Matias introduced himself and quickly managed to lighten the mood. Here is the presentation slide:

https://static.exagon.me/fichiers/11/matias\_katz\_backdooring\_x11.pdf

He explained that X11 is not a protocol but a piece of software, and asked the audience who had an encrypted hard drive. Many raised their hands. He continued his explanation and reminded us of the basics: our encrypted computer isn't at risk until the moment it's decrypted. That's the moment it becomes vulnerable. In his approach, he gives an example: when we step away for a few minutes, we often lock the computer instead of turning it off. In fact, it's precisely in that kind of moment that we're most vulnerable, since the decryption phase has already been initialized. The idea being that all that's left to do is find the password. The injection method itself isn't explained in the talk.

The overall mechanism

Using the OS's native functions (DBUS and UUID) to look for the presence of new devices takes 0.1s. DBUS sits high up in the system (root privilege) and associates directly with the kernel. For reference, it's available across several X Managers, which increases the reach of this attack. The unlocking method is genuinely hardware-based, which leaves little trace of the intrusion because:

• It's not checked by antivirus software.
• It's a silent execution method that doesn't raise suspicion.
• It's available on every computer.

He demonstrated two hardware methods with two scripts:

1. With a USB key: it had to stay permanently connected, otherwise the session would lock again.
2. With a Jack audio output: here the effect was the opposite, unlocking the session with the jack headset. What stands out most is the specific pattern created: device plugged in for one second, unplugged for 3 seconds, plugged in for one second. The effect is quite striking, and it works perfectly.

You'll get the chance to see the demonstration in the video that Hack In Paris will publish on its YouTube channel.

How to avoid getting caught out?

The recommended fix is to remove Dbus, but that's a real constraint since it would mean switching to a different XDM, or alternatively, you could disable your screen lock, which isn't practical at all! In the end, a lot of us Linux users are exposed, unless you turn off your machine at the slightest bit of downtime (provided it's encrypted). Falling victim to this backdoor method isn't limited to Linux users, since winDBus exists on Windows too.

The final word

Since the injection method isn't explained and you first need to be root on the machine, we still have some breathing room. So you'll understand that your coworker won't be eavesdropping on you anytime soon.