Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

  1. #1
    Join Date
    Dec 2008
    Beans
    Hidden!

    Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    I have seen this in some previous version of ubuntu also, snapshots are showing a lucid desktop.

    In screenshot.png, just below the mouse pointer, you can see a small bar just above the lower panel on the left side.

    Screenshot-1.png shows this bar in the lower right hand corner, with the lower panel autohidden.

    If I do a mouse hover-over the pointer changes to index-finger hand mouse pointer, leaving me to believe this is some kind of window.
    Cant track it down, does not show up on 'ps', cannot close it, only solution is to logout or reboot.

    Am quite worried this might be some hidden execution, pixel exploit, keylogging, etc.

    Cannot always reproduce this, but it does show up every now and again. Anybody else seen this and willing to offer an explanation?

    Give me a list of things to check on the next time I see this, would love to find out what process is at work here.

    dr. thefugitive
    Attached Images Attached Images

  2. #2
    Join Date
    Dec 2008
    Beans
    Hidden!

    Re: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    self bump...

  3. #3
    Join Date
    Aug 2011
    Beans
    91

    Re: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    Probably the dumbest idea going - but is there a window open in the workspace below you? I've had incidents where a window has ended up just showing on workspace 1, but the rest of it is on a different workspace.

    Dumb idea I know...

  4. #4
    Join Date
    Dec 2008
    Beans
    Hidden!

    Re: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    @MrLeek

    Dumb? Don't know, but so far its the only idea out there.
    Well its certainly a possibility I will check into the next time this bar appears.
    If you do look at the second screenshot, you can see that it would possibly be extended into the workspace to the right, not the one below it.
    Do not believe there were applications running next door, but I will have to wait for this condition to recreate itself to be sure.
    Perhaps this may point to an error within the workspace switcher framework.
    Thanks for the ideas.

    Any other takers?

    -DrTheFugitive

  5. #5
    Dangertux is offline Chocolate Ubuntu Mocha Blend
    Join Date
    Jun 2011
    Location
    Atlanta Georgia
    Beans
    1,771
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    The assumption that a compromised system has something "noticeably" wrong with it is by and large incorrect. That being said what you are seeing is not indicative of anything other than a graphical glitch or missed place window. That does not necessarily mean the system is not compromised, but if it is I highly doubt that glitch is in any way related to the compromise.

  6. #6
    Join Date
    Jun 2010
    Location
    ~
    Beans
    Hidden!

    Re: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    If it is a window that is focusable, try
    Code:
    HOLD Alt, then press TAB
    to cycle through the list of focusable items. Then try
    Code:
    Alt-F10
    which is the shortcut to Maximize the window... It might be worth a shot.
    CADWEB Advance Toolkit Utility: http://cad.webatu.com/
    Homesite: http://digitalmagican.comze.com/

  7. #7
    Join Date
    Dec 2008
    Beans
    Hidden!

    Re: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    @Dangertux

    Right, I understand this. I was recalling some older MS bugs where graphical files could be manipulated maliciously to execute other code, and I am trying to nail down what process is working here, in order to verify that it is not any kind of exploit. Even if its a browser that is staying open, thereby potentially compromising the system, I would like to be able to find it.

    Is there some way for me to retrieve the raw mapping for X11 someway, in order to figure out exactly what it is I am looking at?
    This is the type of thing I am trying to accomplish with this post, as well as find out if any other users have already had a similar issue to this and know what is going on there already.


    -DrTheFugitive

  8. #8
    Join Date
    Dec 2008
    Beans
    Hidden!

    Re: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    @emiller12345

    To date, it has not appeared to have been a focusable window, I will however attempt your suggestions, with the alt-f10 maximize, the next time this issue arises.

    -DrTheFugitive

  9. #9
    Join Date
    Sep 2011
    Location
    London
    Beans
    Hidden!

    Re: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    Is there some way for me to retrieve the raw mapping for X11 someway, in order to figure out exactly what it is I am looking at?

    Hi Drbrando

    You might get some use from xlsclients and xprop.

    Code:
    xprop _NET_WM_PID
    Then click on the window: will show the process ID of the owner of the window, even if it's not a focusable window. (An example program whose window doesn't accept focus is the demo 'xeyes'). xprop without argument will print lots of different things, including the window id.

    Code:
    xlsclients -l
    will show the list of clients connected to this X display, including their command lines and so on.

    You'll get less information if the X clients are remote, but you probably have that switched off in your system.

    Any use?

    Kind regards,
    Jonathan.

  10. #10
    Join Date
    Dec 2008
    Beans
    Hidden!

    Re: Unclosable Window - Possible Exploit or Just Screen Aliasing Problem?

    Quote Originally Posted by Jonathan L View Post

    You might get some use from xlsclients and xprop.

    Code:
    xprop _NET_WM_PID
    Then click on the window: will show the process ID of the owner of the window, even if it's not a focusable window. (An example program whose window doesn't accept focus is the demo 'xeyes'). xprop without argument will print lots of different things, including the window id.

    Code:
    xlsclients -l
    will show the list of clients connected to this X display, including their command lines and so on.

    You'll get less information if the X clients are remote, but you probably have that switched off in your system.

    Any use?

    Kind regards,
    Jonathan.
    Overall, I have now been able to remedy this situation upon when it is presented. I am still trying to determine the security ramifications of the process remaining open, as far as applications such as preserving anonymity, data leakage and such.

    @Jonathan
    I was able to retrieve a PID for a similar looking unclosable window. Apparently, it was a process for firefox-bin, which for whatever reason did not want to close from the application. -SIGTERM successful, thank you and have a nice day!

    @emiller
    I will try your method next time, to see, it may be a simpler solution.

    Thank you all, will post analysis before closing thread.

    -Dr.TheFugitive

    EDIT: Adding tags mozilla, firefox to thread.
    Last edited by drbrando007; November 26th, 2011 at 12:13 AM. Reason: Update thread relevance.

Page 1 of 2 12 LastLast

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •