I want to ask you about what I think is a pretty obvious security hole and what can be done about it.

Suppose my library has a room containing network-connected workstations serving Linux. You log on to them by typing your username and password. I create a program that mimics the login screen and sends the username and password typed to a server I control. The program then logs out.

I login to my library account and run this program and then I leave the computer. Next person comes along, logs in and voila! I now have this persons credentials. I can repeat this process as many times as I want and after I've gotten someone else's credentials I don't even need to login to my own account, making it impossible to track the phishing attack to me.

This above is obvious and I wonder why people aren't worried about it?

  • As F. Hauri's excellent answer notes, while it may be possible – even easy – to do this, it's trivially easy for admins to detect who's doing it (as some students found out to their cost when they tried this on terminals in a "computer lab" when I was at university in the mid 80s – so it's nothing new!)
    – TripeHound
    Jan 28, 2019 at 11:16

3 Answers 3


The security professionals are worried about this but this is an area of security which already has a working (good enough) solution. The solution is part of the Operating System and its function is to protect what shows up on the login page from compromise. In other words you cannot easily run a program you want instead of the default OS login page and log credentials this way.

There are social engineering attacks which mimic this scenario, for example once logged in you may be able to run a program which to an end user looks like a login screen. It isn't possible to make it look exactly like that special screen because of built in graphical "modes" that are part of OS protection, but it can be made to look close enough to fool an inexperienced user into providing their login information and someone capturing it maliciously. These attacks are more used in phishing and logins into web based services than a local terminal workstation in your library.

Additionally other attacks can accomplish the same goal without running a special program on the system, for example someone could rig the keyboard to record electrical signals as a key logger, though it may not be trivial either.

Whether the security measure is applied against these attacks is also a function of risk of attack succeeding. Some environments will have better security budgets than others and apply varying degrees of protection.

  • 1
    Users on a shared library are inexperienced. Even on a library for an IT course...
    – ThoriumBR
    Jan 28, 2019 at 0:55

I don't think you described a security hole

It's something like building a fake web page for bank accounts. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on with your account (so you are a member of trusted users).
  2. Then run a script (shell or compiled binary) that clears the screen and prompts a fake login screen.
  3. You leave the room and free your place for the next user.
  4. If the next user (victim) hits his credential, your script stores all data, then logout.
  5. Your victim needs to re-enter his credential in order to be logged in. This could alert them.

But, what if the next user is suspicious and hit Ctrl+C, for example? If they see another login start immediately, this becomes very suspicious! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on to the same host, then run w, read username, then ps --user bjorn, and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometimes, to see who is connected when nobody is in the room?

The procedure you describe is very old and there is a lot of ways for alerting sysadmins!

  • A lot of shared terminals use auto-logout, based on inactivity timeout.

  • If not, commands like w and who, which you could run in crontab, will list all connected users, at midnight for example.

  • Also, duration of your connection could be read in log files.

    • So if someone understands his credential was stolen, it's very easy to see who was connected immediately beforehand - the once the victim had to hit his credential twice - if they remember.

    • If not: by timestamp, the user who logs out just a few seconds, exact time to hit the victim's credential (a second time).

    • If the next user is alerted because of having to hit his credential twice and tells a sysadmin, you could be discovered immediately, before you read the collected data!

    • So anyway, you're wrong saying:

      making it impossible to track the phishing attack to me

      This is not only possible, it could be really easy for experienced sysadmin.

R.E.S.P.E.C.T. If you like to use this room and hope to be able to use it for a long time, be careful or better: Ethical!


The first thing to do before login on any shared terminal is some first wrong connection. In order to wake the terminal and reset the tty, hit Return approximately ten times until the terminal resets and prompts a new login screen.


This above is obvious and I wonder why people aren't worried about it?

Many people are. As mentioned in previous answers there are various security measures within Operating Systems to mitigate such issues.

In regards to your specific example it actually seems the least of your worries. Software security measures are not bulletproof, and if one has physical access then all bets are off (in most cases, there are exceptions).

It seems an attacker has little incentive to merely gain credentials to such a system when they could happily install a keylogger or RAT (Remote Administration Tool), they could easily have a hardware logger in the keyboards if they were so dedicated.

Anyhow, I would advise never doing anything that you deem sensitive on public computers, such as your library computers, as such attacks described are commonplace.

In regards to the possibility, I am sure, if dedicated, you could easily pull this off. The question is, why would you want to?

Furthermore, be sure to stay on the right side of the law. What you are describing would be a crime in most countries and could land you a prison sentence.

making it impossible to track the phishing attack to me.

Nothing is impossible to track.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .