1

assuming the following:

  • publicly reachable webserver - administered via SSH
  • no X window system installed and no X11 forwarding through SSH
  • attacker has gained access and is able to run a shell as my regular non-root admin user

Can they obtain the passwords I type at the command line, e.g

  • sudo
  • ssh-add some_priv_key
  • passwords to access git repositories etc.

If so, are there any precautions I can take to minimise this keylogging risk?

3

attacker has gained access and is able to run a shell as my regular non-root admin user

If this is the same account as you use to do privileged operations with sudo then the attacker could make changes to your environment which make you run a different binary. In the simplest case this would be changing PATH so that just typing sudo would actually not run /usr/bin/sudo but some rigged /home/admin/.attacker/sudo. This attacker provided sudo implementation could then sniff your password and then just start the real sudo.

But one can make it more stealth, like changing your profile so that it spawns an attacker provided shell with included key logging. Or just run script to log every input and output.

If so, are there any precautions I can take to minimise this keylogging risk?

Don't allow local users on the system. General hardening of the system. Limit the users with special privileges (like ability to sudo) to only some well-protected accounts.

  • thanks, have you heard of this kind of thing occurring in the wild? I mean webservers are comprimised all the time - but logging admins keystrokes is not something I've heard about.. – the_velour_fog Dec 6 '17 at 7:17
  • @the_velour_fog: I did not see lots of deeper reports describing how some system was owned so I don't know if such keylogging happens in the wild. But, rigging binaries and misusing the trust in PATH are not unheard attacks. And, many systems allow privilege escalation attacks so it might be easier to just directly go to root using such an exploit instead of waiting for the admin to enter credentials. – Steffen Ullrich Dec 6 '17 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.