0

I want to ask you about what I think is a pretty obvious security hole and what can be done about it.

Suppose my library has a room containing network-connected workstations serving Linux. You log on to them by typing your username and password. I create a program that mimics the login screen and sends the username and password typed to a server I control. The program then logs out.

I login to my library account and run this program and then I leave the computer. Next person comes along, logs in and voila! I now have this persons credentials. I can repeat this process as many times as I want and after I've gotten someone else's credentials I don't even need to login to my own account, making it impossible to track the phishing attack to me.

This above is obvious and I wonder why people aren't worried about it?

  • As F. Hauri's excellent answer notes, while it may be possible – even easy – to do this, it's trivially easy for admins to detect who's doing it (as some students found out to their cost when they tried this on terminals in a "computer lab" when I was at university in the mid 80s – so it's nothing new!) – TripeHound Jan 28 at 11:16
2

The security professionals are worried about this but this is an area of security which already has a working (good enough) solution. The solution is part of the Operating System and its function is to protect what shows up on the login page from compromise. In other words you cannot easily run a program you want instead of the default OS login page and log credentials this way.

There are social engineering attacks which mimic this scenario, for example once logged in you may be able to run a program which to an end user looks like a login screen. It isn't possible to make it look exactly like that special screen because of built in graphical "modes" that are part of OS protection, but it can be made to look close enough to fool an inexperienced user into providing their login information and someone capturing it maliciously. These attacks are more used in phishing and logins into web based services than a local terminal workstation in your library.

Additionally other attacks can accomplish the same goal without running a special program on the system, for example someone could rig the keyboard to record electrical signals as a key logger, though it may not be trivial either.

Whether the security measure is applied against these attacks is also a function of risk of attack succeeding. Some environments will have better security budgets than others and apply varying degrees of protection.

  • 1
    Users on a shared library are inexperienced. Even on a library for an IT course... – ThoriumBR Jan 28 at 0:55
2

I don't think your describe a security hole

I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.

If I clearly understand your exploit:

  1. You first log on your account (so you are member of confident users)
  2. Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
  3. You leave the room and free your place for next user.
  4. If next user (victim) hit his credential, your script store all datas then logout.
  5. Your victim need to re-enter his credential in order to be logged. This could alert them.**

But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspicious! So next time, instead of Ctrl+C, they could use another tty: Ctrl+Alt+F3, to log on same host, then run w, read username, then ps --user bjorn and so on...

Could they read your script (or disassemble your binary)?

What if some admin hit w, sometime, for looking who is connected when nobody are in the room...

The procedure you describe is very old and there is a lot of way for alerting sysadmins!

  • A lot of shared terminal use auto-logout, based on inactivity timeout.

  • If no, commands like w and who, you could run in crontab, will list all connected user, at midnight, for sample.

  • At all, duration of your connection could be read in log files.

    • So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
    • If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
    • If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!
    • So anyway, you're wrong saying:

      making it impossible to track the phishing attack to me

      This is not only possible, It could be really easy for experienced sysadmin.

R.E.S.P.E.C.T. If you like to use this room and hope to be able use them for a long time, be carfull or better: Ethical!

Finaly

The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.

1

This above is obvious and I wonder why people aren't worried about it?

Many people are. As mentioned in previous answers there are various security measures within Operating Systems to mitigate such issues.

In regards to your specific example it actually seems the least of your worries. Software security measures are not bulletproof, and if one has physical access then all bets are off (in most cases, there are exceptions).

It seems an attacker has little incentive to merely gain credentials to such a system when they could happily install a keylogger or RAT (Remote Administration Tool), they could easily have a hardware logger in the keyboards if they were so dedicated.

Anyhow, I would advise never doing anything that you deem sensitive on public computers, such as your library computers, as such attacks described are commonplace.

In regards to the possibility, I am sure, if dedicated, you could easily pull this off. The question is, why would you want to?

Furthermore, be sure to stay on the right side of the law. What you are describing would be a crime in most countries and could land you a prison sentence.

making it impossible to track the phishing attack to me.

Nothing is impossible to track.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.