Hi Chris, I can still reproduce this. I just booted an USB key with a live Debian stable image from https://cdimage.debian.org/debian-cd/current-live/amd64/bt-hybrid/debian-live-10.0.0-amd64-standard.iso.torrent on the affected hardware (Lenovo IdeaPad Yoga 13 with an ELAN touchscreen). It booted to a TTY, so I apt-get installed xserver-xorg, openbox, slim, chromium, xtrlock, started a graphical session, and I could reproduce the problem: run chromium, run xtrlock, press one finger on the screen (the mouse pointer with the padlock icon moves to that finger), then interact with chromium with the other fingers.
The problem is not actually limited to multitouch events in Chromium (i.e., not just pinch and zoom), as I can e.g. minimize chromium by tapping the minimize icon with the second finger while the first finger "holds" the xtrlock icon, and generally interact with the chromium interface (though not all interface elements work, for some reason). I can only see this problem with chromium; I cannot interact with other windows (e.g., xterm, firefox) in this way. This may be linked to the fact that the chromium window is not decorated, i.e., it does not have the openbox decorations. Are you sure you tried to reproduce it with multiple fingers as above? Are you sure you are using a touchscreen with multitouch support? Now that I notice this is not limited to multitouch events, this looks to me like a genuine vulnerability affecting xtrlock when such hardware is present (or can be plugged in): an attacker can, e.g., completely mess around with the chromium settings while the session is "locked" by xtrlock. -- Antoine Amarilli
signature.asc
Description: PGP signature
