Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
8 added 278 characters in body
source | link

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.
  5. Your victim need to re-enter his credential in order to be logged. This could alert them.**

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspicious! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in the room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
    • If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!
    • So anyway, you're wrong saying:

      making it impossible to track the phishing attack to me

      This is not only possible, It could be really easy for experienced sysadmin.

R.E.S.P.E.C.T. If you like to use this room and hope to be able use them for a long time, be carfull or better: ethical.Ethical!

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.
  5. Your victim need to re-enter his credential in order to be logged. This could alert them.**

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspicious! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in the room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
    • If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!

If you like to use this room and hope to be able use them for a long time, be carfull or better: ethical.

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.
  5. Your victim need to re-enter his credential in order to be logged. This could alert them.**

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspicious! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in the room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
    • If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!
    • So anyway, you're wrong saying:

      making it impossible to track the phishing attack to me

      This is not only possible, It could be really easy for experienced sysadmin.

R.E.S.P.E.C.T. If you like to use this room and hope to be able use them for a long time, be carfull or better: Ethical!

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

7 added 7 characters in body
source | link

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.
  5. Your victim need to re-enter his credential in order to be logged. This could alert them.**

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspectsuspicious! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in the room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
    • If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!

If you like to use this room and hope to be able use them for a long time, be carfull or better: ethical.

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.
  5. Your victim need to re-enter his credential in order to be logged. This could alert them.**

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspect! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
    • If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!

If you like to use this room and hope to be able use them for a long time, be carfull or better: ethical.

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.
  5. Your victim need to re-enter his credential in order to be logged. This could alert them.**

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspicious! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in the room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
    • If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!

If you like to use this room and hope to be able use them for a long time, be carfull or better: ethical.

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

6 added 20 characters in body
source | link

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.
  5. Your victim need to re-enter his credential in order to be logged. This could alert them.**

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspect! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
    • If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!

If you like to use this room and hope to be able use them for a long time, be carfull or better: ethical.

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspect! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).

If you like to use this room and hope to be able use them for a long time, be carfull or better: ethical.

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.
  5. Your victim need to re-enter his credential in order to be logged. This could alert them.**

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspect! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
    • If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!

If you like to use this room and hope to be able use them for a long time, be carfull or better: ethical.

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

5 added 20 characters in body
source | link
4 added 20 characters in body
source | link
3 added 20 characters in body
source | link
2 added 20 characters in body
source | link
1
source | link