What stops malicious code spoofing a Ctrl+Alt+Del login form by allowing only part of the phrase?

Question

According to this answer from a question:

when you press Ctrl+Alt+Del, you can be sure that you're typing your password in the real login form and not some other fake process trying to steal your password.

But let’s say an attacker clones an identical login page on Windows, where ‘Ctrl+Alt+Del is required’.

The malicious code allows either Ctrl+Alt or Alt+Del, so when a victim presses Ctrl+Alt+Del, and it works, the victim assumes it is legitimate, so they enter their password.

Am I missing something fundamental about how this system works, and is this scenario possible?

Answer 1

As soon as you invoke the secure attention sequence, Windows shows a full screen view on a dedicated desktop, hiding all other potentially spoofed windows (similar to the UAC dimming screen). Therefore the user can be confident in the authenticity of the login screen, assuming the system is not compromised in other ways (e.g. the keyboard itself becomes compromised and overrides the SAS).

However, once the user enters the correct password and the login screen dismisses, the spoofed screen may show up again, which can cause confusion and might compromise unsuspecting users.

Keep in mind that due to the many other ways the system can become compromised and nullify the guarantees, using the SAS is no longer considered a valuable practice in the modern security landscape. It can be a good defense-in-depth measure, but in itself it does not offer significant security benefits, and can hurt usability. Microsoft no longer enables the relevant security policies by default, in new deployments.