5 ms·

Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read

Older school even -- instead of logging out of (real hardware) terminal sessions, exec a program which prints `login: ` and disables keyboard interrupts. Read peoples creds and store somewhere, then issue a 'wrong password' msg and exit, resulting in the real login message. People will just assume they made a typo and continue as if nothing happened. I've argued before for a genuine out-of-band independent display on machines which can only be written to by some very high privilege process.

jsmith99 8y ago
That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.
- baddox 8y ago
  Similarly, the iPhone X requires double-pressing the power button to complete a purchase using Face ID. Previously, with Touch ID, the authentication action itself was also sufficient to establish intent (placing the finger on the sensor). But with Face ID, any app could just pop up the purchase window and Face ID would see your face. Incidentally, this is why Face ID is strictly worse than Touch ID in my opinion.
  - fgkramer 8y ago
    Maybe is up to implementation? I've got an X and the intent to pay pops up the native pay modal, which still requires you to double press the power button AND to be authenticated. So what you say never really happens.
  - joe5150 8y ago
    how is it worse? touch id’s serving as authentication and approval for payment was actually exploited as a scam. I don’t see how this could be done with face id. https://www.wired.com/story/iphone-touch-id-scam-apps/ https://www.wired.com/story/iphone-touch-id-scam-apps/
    - baddox 8y ago
      That’s fair. I never encountered anything like that. In my experience Touch ID was faster, more reliable, and more versatile (e.g. able to be activated with the phone lying on a table without peering over it with my face).
      - hvidgaard 8y ago
        I happen to be in a situation where I have a phone with Face ID and one with Touch ID. Touch ID with wet or slightly dirty fingers are not good. I've been doing some gardening over Easter and Touch ID is barely working because my fingers are more rough than they normally are. Face ID on the other hand, works just as expected. It doesn't work optimally if I'm lying down, but that's not a problem for me personally.
- mimi89999 8y ago
  Yes, but it isn't very effective because if the computer is left with the login screen visible after Ctrl+alt+del opened in a full screen browser, users will simply proceed directly to typing their credentials. Then an endless logging in dialog could be presented, so that the user thinks it is a problem with the computer.
  - geuszb 8y ago
    Hmm not if your users are trained to press Ctrl-Alt-Del again... The login screen would also allow them to order the OS to log off the current session too.
- vectorEQ 8y ago
  now i know why it makes me type that every time :D guess i never wondered. thanks!
dalore 8y ago
We did just that with our Novell Network school computers. Show a fake login prompt. Write down what gets entered, show wrong password and exit to real prompt.
- sizzle 8y ago
  What did you do with the passwords you captured? Sounds unethical... You'd definitely be facing criminal charges if you got caught doing this today I'd imagine.
antihero 8y ago
Back in the day I made a near-perfect copy of the RM (UK school IT supplier) login page in Visual Basic 6, and had it run on computers with RunServices registry entry. Had a team of mates with custom floppy disks going around installing it on as many PCs as we could. It would log the supplied user/pw to disk, then display the "wrong password" error, then quit, then exposing the real login screen.
- sizzle 8y ago
  What did you do with the passwords you captured? Sounds unethical... You'd definitely be facing criminal charges if you got caught doing this today I'd imagine.
  - cmcaine 8y ago
    > Criminal charges Heh, I don't think so. Teachers don't like to send their pupils to court for silly things. They'd just get told why not to do it again and probably get some detention and stuff. At a uni, the consequences might be more severe.
    - sizzle 8y ago
      Yeah it's not like you did anything illicit like change grades or wreak havoc on the network by mass formatting computers, unless you intentionally left out those parts ;)
      - yiyus 8y ago
        As long as you do not start a thermonuclear war with Russia you should be ok.
CodeWriter23 8y ago
Mine would log you in. Of course the OS (Oasis) had a way to exec the login program and feed it the password. I stole the teacher’s password and then changed it. He busted me by booting up the system from floppy and typed in the commend to format the hard drive and waited for me to return to the lab after school. I asked him what he was doing and he said he had no choice but to reinstall from scratch because someone changed the password. He then moved to hit the Enter key. Not wanting my fellow students to lose their projects, I confessed. I logged him in and he changed the password. He then gave my account admin privileges. I guess I had earned them.
- mastef 8y ago
  Interesting reaction. What was the thought process behind it? E.g. what did you use them for
  - CodeWriter23 8y ago
    I became the help desk. It seemed like an elevated status but in reality it meant I got some of the drudgery piled on to me. Password changes, adding students, disk quota increases and such.
- windsurfer 8y ago
  Why would someone that could boot a system from floppy have to "format the hard drive" instead of just setting a new password?
  - CodeWriter23 8y ago
    The instructor had the only admin account and I had changed the password to his account; he was locked out.
jloughry 8y ago
That exists: look for 'trusted path'. It was a feature of compartmented mode workstation (CMW) operating systems like Trusted Solaris and lives on in the requirement to use Ctrl-Alt-Del to call up the Windows login prompt. In Trusted Solaris (TSOL) it was a dedicated area of the screen—along the bottom—where no user mode process was allowed to write; the OS displayed a special symbol there (sort of like the padlock in a web browser) when the user was interacting directly with the OS. Some CMW systems even implemented that functionality in hardware, electronically compositing windows from different physical frame buffers to the video display. Ctrl-Alt-Del is actually in hardware, too (or it used to be); the keyboard interface on the first IBM PC detected that specific key combination and toggled the reset line on the CPU (or maybe it was an interrupt; I forget). Every subsequent PC-compatible machine, to this day, has the same functionality built in to the hardware, on the A20 reset line. It's mostly vestigial today.
teh_klev 8y ago
This was how I gained full sysadmin access to our college's VAX 11/780 mini computer in late 1986. This machine ran pretty much everything from accounting to exam marking. There were three terminals that the admins would logon to pretty much regularly on the "student" side of the computer room. I knocked up a script to run on these three terminals that looked exactly like the standard login and mailed me the credentials entered before displaying the standard "incorrect username/password" (and then silently logoff). The risk for me, had the IT team been a bit more up on their game, was spotting my account being logged into these three terminals for long periods of time with me no-where to be seen :) I kept silent about this until years afterwards for fear of being chucked out of college, which to be honest would've been a good thing seeing as the course was a waste of time.
- bena 8y ago
  I mocked up something similar on a VAX system at school as well.

jsmith99 8y ago

That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.

baddox 8y ago
Similarly, the iPhone X requires double-pressing the power button to complete a purchase using Face ID. Previously, with Touch ID, the authentication action itself was also sufficient to establish intent (placing the finger on the sensor). But with Face ID, any app could just pop up the purchase window and Face ID would see your face. Incidentally, this is why Face ID is strictly worse than Touch ID in my opinion.
- fgkramer 8y ago
  Maybe is up to implementation? I've got an X and the intent to pay pops up the native pay modal, which still requires you to double press the power button AND to be authenticated. So what you say never really happens.
- joe5150 8y ago
  how is it worse? touch id’s serving as authentication and approval for payment was actually exploited as a scam. I don’t see how this could be done with face id. https://www.wired.com/story/iphone-touch-id-scam-apps/ https://www.wired.com/story/iphone-touch-id-scam-apps/
  - baddox 8y ago
    That’s fair. I never encountered anything like that. In my experience Touch ID was faster, more reliable, and more versatile (e.g. able to be activated with the phone lying on a table without peering over it with my face).
    - hvidgaard 8y ago
      I happen to be in a situation where I have a phone with Face ID and one with Touch ID. Touch ID with wet or slightly dirty fingers are not good. I've been doing some gardening over Easter and Touch ID is barely working because my fingers are more rough than they normally are. Face ID on the other hand, works just as expected. It doesn't work optimally if I'm lying down, but that's not a problem for me personally.
mimi89999 8y ago
Yes, but it isn't very effective because if the computer is left with the login screen visible after Ctrl+alt+del opened in a full screen browser, users will simply proceed directly to typing their credentials. Then an endless logging in dialog could be presented, so that the user thinks it is a problem with the computer.
- geuszb 8y ago
  Hmm not if your users are trained to press Ctrl-Alt-Del again... The login screen would also allow them to order the OS to log off the current session too.
vectorEQ 8y ago
now i know why it makes me type that every time :D guess i never wondered. thanks!

dalore 8y ago

We did just that with our Novell Network school computers. Show a fake login prompt. Write down what gets entered, show wrong password and exit to real prompt.

sizzle 8y ago
What did you do with the passwords you captured? Sounds unethical... You'd definitely be facing criminal charges if you got caught doing this today I'd imagine.

antihero 8y ago

Back in the day I made a near-perfect copy of the RM (UK school IT supplier) login page in Visual Basic 6, and had it run on computers with RunServices registry entry. Had a team of mates with custom floppy disks going around installing it on as many PCs as we could. It would log the supplied user/pw to disk, then display the "wrong password" error, then quit, then exposing the real login screen.

sizzle 8y ago
What did you do with the passwords you captured? Sounds unethical... You'd definitely be facing criminal charges if you got caught doing this today I'd imagine.
- cmcaine 8y ago
  > Criminal charges Heh, I don't think so. Teachers don't like to send their pupils to court for silly things. They'd just get told why not to do it again and probably get some detention and stuff. At a uni, the consequences might be more severe.
  - sizzle 8y ago
    Yeah it's not like you did anything illicit like change grades or wreak havoc on the network by mass formatting computers, unless you intentionally left out those parts ;)
    - yiyus 8y ago
      As long as you do not start a thermonuclear war with Russia you should be ok.

CodeWriter23 8y ago

Mine would log you in. Of course the OS (Oasis) had a way to exec the login program and feed it the password. I stole the teacher’s password and then changed it. He busted me by booting up the system from floppy and typed in the commend to format the hard drive and waited for me to return to the lab after school. I asked him what he was doing and he said he had no choice but to reinstall from scratch because someone changed the password. He then moved to hit the Enter key. Not wanting my fellow students to lose their projects, I confessed. I logged him in and he changed the password. He then gave my account admin privileges. I guess I had earned them.

mastef 8y ago
Interesting reaction. What was the thought process behind it? E.g. what did you use them for
- CodeWriter23 8y ago
  I became the help desk. It seemed like an elevated status but in reality it meant I got some of the drudgery piled on to me. Password changes, adding students, disk quota increases and such.
windsurfer 8y ago
Why would someone that could boot a system from floppy have to "format the hard drive" instead of just setting a new password?
- CodeWriter23 8y ago
  The instructor had the only admin account and I had changed the password to his account; he was locked out.

jloughry 8y ago

That exists: look for 'trusted path'. It was a feature of compartmented mode workstation (CMW) operating systems like Trusted Solaris and lives on in the requirement to use Ctrl-Alt-Del to call up the Windows login prompt. In Trusted Solaris (TSOL) it was a dedicated area of the screen—along the bottom—where no user mode process was allowed to write; the OS displayed a special symbol there (sort of like the padlock in a web browser) when the user was interacting directly with the OS. Some CMW systems even implemented that functionality in hardware, electronically compositing windows from different physical frame buffers to the video display. Ctrl-Alt-Del is actually in hardware, too (or it used to be); the keyboard interface on the first IBM PC detected that specific key combination and toggled the reset line on the CPU (or maybe it was an interrupt; I forget). Every subsequent PC-compatible machine, to this day, has the same functionality built in to the hardware, on the A20 reset line. It's mostly vestigial today.

teh_klev 8y ago

This was how I gained full sysadmin access to our college's VAX 11/780 mini computer in late 1986. This machine ran pretty much everything from accounting to exam marking. There were three terminals that the admins would logon to pretty much regularly on the "student" side of the computer room. I knocked up a script to run on these three terminals that looked exactly like the standard login and mailed me the credentials entered before displaying the standard "incorrect username/password" (and then silently logoff). The risk for me, had the IT team been a bit more up on their game, was spotting my account being logged into these three terminals for long periods of time with me no-where to be seen :) I kept silent about this until years afterwards for fear of being chucked out of college, which to be honest would've been a good thing seeing as the course was a waste of time.

bena 8y ago
I mocked up something similar on a VAX system at school as well.