Usually I only install open source programs on my linux box because I don't trust closed source applications. Recently I had to use Dropbox for a university project. I created a separate linux account named work and run (as work) dropbox without installation via a python script. The script also created a symbol in the system tray that provides a GUI for some of Dropbox's functions.

The other day I had to do some maintenance so I opened a virtual terminal (konsole on KDE) and entered my root password for su.

Is there a chance the Dropbox application could have captured my root password?

I use Fedora 20 with KDE 4.14.3.


Short answer: Yes.

In the "olden days", it was possible to effectively prevent any other X application from reading a specific input by grabbing it. While this can still be done to this day, the XI2 protocol specification seems to suggest that this can't be done any more (see the description of Raw Events around line 2220). Thus under X alone you are not safe any more - at least not in the usual simple setups. See also the discussion under my answer to How to let a daemon prompt for a password (in Xsession, keyloggersafe)? and the AskUbuntu Q&A referenced there. Needless to say, no terminals are actually doing that - which is why applications like OpenSSH or GnuPG come with their own UI helpers, that grab keyboard (although as mentioned above, it doesn't really help that much these days).

What you could do though would be running an application under a different X server, e.g. a nested X server like Xephyr or Xnest, or VNC based one like Xvnc. Wayland protocol should also provide some protection against eavesdropping.

Apart from the above, the application could have also tried to exploit an unpatched security hole in your system and thus gain elevated privileges. Or do something easier, like putting a su and sudo wrappers into your path before the system ones and thus intercepting the passwords (thanks @Joshua for the comment).

| improve this answer | |
  • Like, say, redirecting sudo to ~/.evil/sudo and grabbing your pw. – Joshua Jan 14 '15 at 0:14
  • You were never safe under X - grabbing the device just prevents input events from being generated, it doesn't protect against a program such as xspy from constantly polling the keyboard to get which keys are pressed at that moment. – alanc Jan 15 '15 at 22:29
  • @alanc do you have a link to the source? – peterph Jan 18 '15 at 17:12
  • @peterph for xspy? The original website is gone, but the Internet Archive has a copy saved at web.archive.org/web/20090207115718/http://www.acm.vt.edu/… – alanc Jan 20 '15 at 22:06
  • Neither xnest nor xephyr will protect you; events bubble up to their window like normal. – goldilocks Sep 29 '15 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.