3 ms·
> just need to be able to execute code on their computer Hmm, so privilege de-escalation... You can just install a keylogger at that point, so I don't see the
by ggggtez 8y ago
> just need to be able to execute code on their computer
Hmm, so privilege de-escalation... You can just install a keylogger at that point, so I don't see the problem.
- gnud 8y agoNot always. With 2FA a key-logger isn't enough, since the 2nd factor can't be replayed. A valid session cookie might be enough, though.
- koolba 8y agoReplayed later no, but a naive TOTP implementation will likely allow you to reuse an code more than once as long as you log in within the 30-second x N-lookback window.
- RL_Quine 8y agoCapture a token, use it yourself, and show the user an error so they generate a new token.
- shittyadmin 8y agoDepends how the encryption works - you only need to compute the cookie database key once. Of course, regardless of what they do, you could probably just run a quick Frida (https://frida.re/ https://frida.re/) script to patch into Chrome and dump the key to disk when the decryption function is called. From the 10 immutable laws of security: Law #1: If a bad guy can persuade you to run his program on your computer, it's not solely your computer anymore.
- Ayesh 8y agoI forgot to bookmark the link, but I think I read someone cracking the TOTP secret from a couple OTPs with their timestamps known.
- cypherg 8y agoguessing you've never tried to deploy a user-mode keylogger on MacOS. Usually doesn't end well...at all. Not to mention PSPs.
- deleted 8y ago[deleted]
- ggggtez 8y agoIf you prefer, as a local physical user you can also install a physical keylogger between the keyboard and computer. Or replace the executable with one that is backdoored, and read the cookies directly from memory. The point is that you pwned the computer already, and this is just one of dozens of things you could already do with that privilege.