8

Before this semester, to use any computer across campus, you had to log into Windows with a username and password.

This semester, when the computers start up they auto-login to an account (with let's say the username "Dogs"). They are always logged in as this account; the Log off option is disabled in the start menu.

I just checked that you can run an arbitrary .exe under the "Dogs" account by downloading the AutoHotKey binary and writing a "Hello world!" script. It is very easy to write a simple keylogger in AHK although I have not!

AutoHotKey is just my example test. I'm worried that a arbitrary .exe can be executing in the background.

Is there some security that my simple test is not hitting which makes my campus setup safe? Or should I be worried about typing my Facebook password in?

  • 5
    Yeah, you should be VERY worried about typing ANY password into it. I wouldn't even plug my usb into this computer. Consider it an extremely hazardous environment. – DarkLighting Oct 5 '15 at 18:35
8

Your school lacks some of the most basic requirements for security. Never use credentials for remote logins on a system you're not in complete control of and have full knowledge of its level of protection.

Shared computers such as libraries, schools, etc. should never allow access to USB devices for boot, autoplay or execute access. All devices should be scanned automatically when devices are connected. Users should have very limited access and if files are allowed to be downloaded and saved, they should be temporary and not allowed to be executed. It is not difficult to secure a workstation. What is difficult is to get the person in charge of it to make an effort if they have not already. I would report what you have found but I would not report that you have tested the system with AHK and I would remove any instances of anything you have put onto the system. Being a good samaritan is not always healthy. And, there is nothing on FB that is so important that you cannot wait until you are on a secure system to access it.

I would not make any effort to fix what you perceive as possible issues. You are not paid to support that system and depending on policies, you could be putting your liberty at risk. It is a tool for you to use, nothing more. Report your concerns and let the school deal with it.

3

Any shared-use computer that is not under your control (and even, in certain respects, those which are) should be considered untrustworthy for any purposes beyond those which serve the organization which administers them.

That means, if the computer belongs to the school, only use the system for school-related activities and only in conjunction with accounts designated specially for school-related purposes. Aside from maintaining personal security, this also will help avoid potential missteps on social media or other sites that may draw undesired attention from school network administrators.

2

As a norm, you should never, EVER, EVER! put credentials on a public computer. Fortunately, big companies like Facebook, Twitter, Google allow you to revoke the account cookies and exit any ongoing sessions. Yet, there is still the risk of getting your password caught by a keylogger. If you do not mind checking your active sessions on your accounts often, you shouldn't use that computer with credentials. Also, aside from bad security policies, you should always been on the lookout for hackers in your school. It is getting vicious these days.

You can check the running processes but the keylogger may be disguised as systemimportantdonotdelete.exe which i would never delete.

Stay safe ;)

  • Might also want to use 2-phase authentication for the likes of Google, Facebook, and other big sites, such that even with the password compromised, you have some security/time to change it – user2813274 Oct 6 '15 at 1:58
  • I do not keep cookies so, everyday i use the 2PA :). But now that i think, if the pc is compromised, it may steal your cookies and reuse them. The session will stay open and you have to revoke it if i am not mistaken. – BrunoMCBraga Oct 6 '15 at 10:01
2

Agree 100% with other answers about not trusting the computer, but you can’t trust it even if it did require a login, as if I can touch a computer I can own it. (Put a key logger inside of the keyboard for example.)

Two factor logon etc do not help much, as the computer may be connecting to a fake website, along with fake certificates. (https cannot be trusted, if you are not in 100% control of the computing you are using.) The fake website can then use your two factor logon details to connect to the real website.

However you may find that these computers are setup to deleted any change/new files from their hard disk every time they are started up. It is easy to test this by seeing if your change to the OS is still there after a reboot.

Such a setup can work very well, as it allows any student to set the machine up in the way they wish while stopping them messing the machine up for the next user.

  • 1
    +1 For "However you may find that these computers are setup to deleted any change/new files from their hard disk every time they are started up.", at the 2 universities I have taken a course this was the practice used. Such a system is rather safe from a software standpoint, hardware keylogging is of course still possible. DO CHECK FOR UNEXPECTED DEVICES! report any left behind, for example USB-sticks, to support staff. – Selenog Oct 6 '15 at 11:00
  • @Selenog, not if someone hacks the bios password and/or change the boot sector on the hard-disk. "rather safe" is a overstatement, I would still not trust the machine to type by bank password into. – Ian Ringrose Oct 6 '15 at 11:34
  • @lan Ringrose true I wouldn't online bank on it though mine does not use a password. Kind of depends on your definition of "rather safe", for me it seems safe enough to check personal email, though I wouldn't check my work email on it. – Selenog Oct 6 '15 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy