Skip to content

New found Linux backspace bug is already largely fixed

December 18, 2015
Previously, one way to protect your computer was to take the backspace key with you.

One old way way to protect your Linux box was to take the backspace key with you.

It was widely reported on the web December 17 that for some 6 years, a flaw in the Linux Grub2 bootloader has made it possible to get around the password on many versions of the Linux operating system simply by pressing the backspace key 28 times at the login screen when the operating system asks for a username.

But with luck it’s already old news. Well before security researchers publicized the flaw on the web, they had rushed out their own emergency patch and notified the affected Linux versions, Ubuntu, Red Hat and Debian, which all quickly released patches fixing the Grub2 bug.

The most important thing for all Linux users to do is to perform a software update to their system, which, for most Linux distributions, is set to happen automatically in the background.

As of December 17, I was unable to replicate the backspace bug in a fresh install of Linux Mint-17.1 (64-bit), which is based on Ubuntu 14.04 (which uses a vulnerable version of Grub2). The closest I came in four tries was my second attempt when the screen went black after the 28th key press.

A Windows XP-like flaw found in Linux? How embarrassing!

Two Spanish researchers, Hector Marco and Ismael Ripoll, from the Cybersecurity Group at Polytechnic University of Valencia, discovered the backspace flaw (which they dubbed “Back to 28”) in the Grub2 bootloader, a version of the program that loads the Linux operating system at startup. In their findings, published on December 14, the pair say that the flaw was introduced into Grub2 back in December of 2009.

At the login screen, 28 presses of the backspace key causes a memory error in affected versions of Grub2, leading it to automatically launch the “Grub rescue shell”, a command line interface which completely bypasses the Grub2 password protection and leaves the computer wide open to the installation of malware or the theft and destruction of any and all user data.

The Grub2 flaw is another blow to the reputation of Linux as one of the most secure of operating systems — made all the more embarrassing because of the way that Linux users (myself included) have railed against the insecurity of Windows — in stark contrast to the rock-solid Linux!

Yet, truth be told, the Grub2 flaw is very similar to a well-known administrative privilege flaw in Windows XP which allows anyone to reboot XP with one key press into safe mode with command prompt, where a new password can be created without having to know the old one.

The backspace bug has allowed anyone to do much the same thing in Linux for years (ouch!).

Who knew cats could hack Linux just like Windows

cat-like-typing-detected

Linux users have nothing like PawSense, which has protected Windows users from cats since 2000.

There is no evidence of the Grub2 backspace flaw being exploited by either person or beast — I say that because, in this case, it appears that Linux users have had as much to fear from house cats and small children as grown-up hackers.

Unfortunately, smug and complacent Linux users have left themselves fairly defenseless against cats and kids. Linux appears to have only ever produced one keyboard locking utility written in Perl called Lock keyboard for baby (lk4b), Of course it’s Linux, so a person can always lock the keyboard in the command line terminal.

On the other hand, it has been long understood that random keyboard activity could play havoc with Windows and Mac computers and there are several keyboard lockout applications available for both of those platforms.

By far the most sophisticated type of application designed to protect a computer from cat-astrophes is the 15-year-old Windows-only PawSense payware that developed in parallel with Windows XP.

PawSense doesn’t lock the keyboard, it runs in the background and acts to detect and block the key strokes caused by cats walking on, laying on or just playing with the keyboard. And when it detects cat-tivity it also plays sounds that felines don’t fancy (such as the sound of a harmonica) in order to train them to shy away from the computer. Click the images to enlarge them.

Advertisements
Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: