I don't think your describe a security hole
I'ts something like building a fake web page for bank account. Criminal, prohibited, but not hard to create.
If I clearly understand your exploit:
- You first log on your account (so you are member of confident users)
- Then run a script (shell or compiled binary) who clear the screen and prompt a fake login screen
- You leave the room and free your place for next user.
- If next user (victim) hit his credential, your script store all datas then logout.
- Your victim need to re-enter his credential in order to be logged. This could alert them.**
But, what if next user is suspicious, hit Ctrl+C, for sample? If they see another login start immediately, this become very suspicious! So next time, instead of Ctrl+C, they could
tty: Ctrl+Alt+F3, to log
on same host, then run
w, read username, then
ps --user bjorn and so on...
Could they read your script (or disassemble your binary)?
What if some admin hit
w, sometime, for looking who is connected when nobody are in the room...
The procedure you describe is very old and there is a lot of way for alerting sysadmins!
A lot of shared terminal use auto-logout, based on inactivity timeout.
If no, commands like
who, you could run in crontab, will list all
connected user, at midnight, for sample.
At all, duration of your connection could be read in log files.
- So if someone understand his credential was stolen, It's very easy to see who was connected immediately before - the once the victim had to hit his credential two time - if they remember.
- If not: by timestamp, the user who logout just a few seconds, exact time to hit victims's credential (a second time).
- If next user is alerted because having to hit his credential two time and tell to sysadmin, you could be discovered immediately, before you read collected datas!
So anyway, you're wrong saying:
making it impossible to track the phishing attack to me
This is not only possible, It could be really easy for experienced sysadmin.
R.E.S.P.E.C.T. If you like to use this room and hope to be able use them for a long time, be carfull or better: Ethical!
The first thing to do before login on any shared terminal is some first wrong connection. In order to wake terminal and resetting tty, by hitting Return, approx ten time, until terminal reset and promt a new login screen.