I don't think you described a security hole
It's something like building a fake web page for bank accounts. Criminal, prohibited, but not hard to create.
If I clearly understand your exploit:
- You first log on with your account (so you are a member of trusted users).
- Then run a script (shell or compiled binary) that clears the screen and prompts a fake login screen.
- You leave the room and free your place for the next user.
- If the next user (victim) hits his credential, your script stores all data, then logout.
- Your victim needs to re-enter his credential in order to be logged in. This could alert them.
But, what if the next user is suspicious and hit Ctrl+C, for example? If they see another login start immediately, this becomes very suspicious! So next time, instead of Ctrl+C, they could
tty: Ctrl+Alt+F3, to log
on to the same host, then run
w, read username, then
ps --user bjorn, and so on...
Could they read your script (or disassemble your binary)?
What if some admin hit
w, sometimes, to see who is connected when nobody is in the room?
The procedure you describe is very old and there is a lot of ways for alerting sysadmins!
A lot of shared terminals use auto-logout, based on inactivity timeout.
If not, commands like
who, which you could run in crontab, will list all connected users, at midnight for example.
Also, duration of your connection could be read in log files.
So if someone understands his credential was stolen, it's very easy to see who was connected immediately beforehand - the once the victim had to hit his credential twice - if they remember.
If not: by timestamp, the user who logs out just a few seconds, exact time to hit the victim's credential (a second time).
If the next user is alerted because of having to hit his credential twice and tells a sysadmin, you could be discovered immediately, before you read the collected data!
So anyway, you're wrong saying:
making it impossible to track the phishing attack to me
This is not only possible, it could be really easy for experienced sysadmin.
R.E.S.P.E.C.T. If you like to use this room and hope to be able to use it for a long time, be careful or better: Ethical!
The first thing to do before login on any shared terminal is some first wrong connection. In order to wake the terminal and reset the tty, hit Return approximately ten times until the terminal resets and prompts a new login screen.