143
Keyboard spyware?
(lemmy.ml)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 24 Aug 2023
143 points (96.7% liked)
Privacy
31919 readers
486 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
On Wayland, they probably still can. Wayland's core protocol doesn't allow it, but extensions to enable things like global hotkeys can almost certainly be used for shenanigans.
Also, if the keylogger is running under your user account, it can insert crafted
.desktopfiles wrapping around your apps,ptraceyour apps, you name it. Sandboxing as in Flatpak can stop this sort of thing, but if you run an app outside such a sandbox, and it's malicious, game over.But does it work without prompting the user?
Also, I'm not too familiar with how it works, but afaik global hotkeys on KDE are implemented by the display server/compositor/whatever it's called itself, and not sourced out to a different program.
Well, that's an interesting point, I haven't thought about that.
Right, but they're configured by an unprivileged program: the settings app. Presumably, a keylogger can pretend to be the settings app.
Couldn't the display server check if the app is actually the settings app by looking at it's executable's location? Not sure how reliable that is, but if it is, it could check if it is coming from somewhere in
/usrthat is also not writable by the current user.The display server has no way of verifying the process ID on the other end of the Unix-domain socket connection, and therefore cannot verify the executable image. It also cannot verify that the settings app hasn't had any malicious code injected with
ptrace,LD_PRELOAD, or the like, since the injected code can remove any traces of that before connecting to the display server.