Are there any exploits that would allow a user to "spoof" a screen capture system?

Question

We have a security system installed that takes pictures of the client user's screen and sends them to a server. The pictures are saved until they get to the point where they are old enough to be deleted. It's been useful for an investigative tool when we need to find out if a user has been up to suspicious activity. The majority of our users on our network are standard user accounts with no special access. With our machines being primarily Windows 7.

As an administrator of this system, I was wondering if this can potentially be "spoofed". As in, a user can exploit the client to send pictures of what he/she desires.

Edit : I'm referring to the user being able to exploit the system and send the image they want sent while doing something else. I'm not referring to being able to create a window in full screen mode.

Answer 1

Yes, long as the user of the computer gains appropriate access to write to memory of your capturing software.

The attacker could use API hooking to spoof the screenshot. http://www.codeproject.com/Articles/30140/API-Hooking-with-MS-Detours Just same method used in malware and gamehacking.

You'll want to ensure the user doesn't gain administrator rights and can't use OpenProcess API on your protected processes.

Answer 2

If you're asking if a user could display an arbitrary screen, then yes. Any software that can display a full-screen image (ie: display an image not in a window, but that displays over the full real-estate of the screen) is capable of spoofing your system. Most photo editing software can do this, as can pretty much any video playback software, or even web browsers. I could photoshop up a credibly accurate image of a normal desktop with whatever else I wanted to display. If you are asking if the user could cause the capture system to capture one image while the same user was actually doing something else, then this depends on your image capture software. Without administrator privileges, probably not directly on the workstation. I would probably have to attack the system by hooking up one of my own computers to the network and intercepting the network requests of the server to the client. It probably wouldn't be too hard for me, if I had access to your network, to hook up a laptop and sniff your network to find out the protocol your central server is using to request screenshots, and then build some software that responded as if it were one of the workstations and give back an image of my choosing. Your system needs to do bidirectional authentication with some sort of protocol that is not subject to man-in-the-middle attacks, like SSL.

Answer 3

Yes, that sounds quite spoofable. Take some screenshots of usual activity at the appropriate delay, then have something display the next one every time a screenshot is taken. Apart from that, it depends on the privileges the user has, and on what you mean by “suspicious activity”. A USB stick preloaded with anything and masquerading as some document, for example, wouldn’t have to run visibly.