What the most harmful thing can malware program started as separate limited user account do if it has access to the X server?

Network and filesystem things are already considered by chroot and netfilter.

It obviously can lock the screen and I will need to switch to other vt and kill it manually. Can it for example disrupt other GUI programs on the same X server (access a root terminal in nearby window)?

I know that it is safer to run it in separate X server, for example, in Xtightvnc or even some virtual machine, but how dangerous is to just run it like other programs?


If you've already gone to the trouble of setting up a separate X server, have you considered running the program inside a nested X-server like Xnest. Then, you would completely isolate the malicious program in its own X envrionment. Or if you want to be absoutely safe, you might even consider something VirtualBox for a whole other VM.


Once a program has access to the X server it can virtually do everything you can do with a mouse and a keyboard. This will not be limited to this application's window should it have one, but could affect other running applications.

There are tons of applications to help people with accessibility-related problems assisting them to use the keyboard or the mouse to control their X sessions. Why should malware not do that and just pretend to be you?

  • Example: groups.csail.mit.edu/uid/sikuli It's not a virus, it's a GUI scripting engine that you can use to script arbitrary actions, like clicking on GUI buttons and typing in text boxes and stuff. I'm just providing it as an example of what capabilities a malicious program would have access to. – Ryan C. Thompson Mar 27 '10 at 22:21

Install Zephyr and then :

Zephyr -ac -screen 800x600 -br -reset -terminate :2 &

to run a nested/isolated x session.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.