4 ms·

Since I was at college in the second half of the 90s, we still had unix text consoles for reading emails so my favourite prank was to tell others in my dorm tha

Since I was at college in the second half of the 90s, we still had unix text consoles for reading emails so my favourite prank was to tell others in my dorm that I had worked out how to remotely log in from the dorm (we had to use a computer room back in them days!) and with my 10 line Turbo Pascal program created a fake login screen like looked identical to the normal one. After capturing a password, I would explain to each person that maybe it wasn't quite working so "sorry", so they were none the wiser that they had given me their passwords. I didn't do anything with the passwords, it was just interesting how easy it was to get away with.

dspillett 3y ago
Someone was discovered to be collecting passwords that way on our universities VT terminals (I'm old enough that at Uni plain text terminals were still a thing, though they were generally used just as terminals for email & such when the lab rooms full of PCs were fully occupied) by leaving what looked like a login prompt on-screen. Someone with much tech knowledge immediately saw it wasn't quite right (that is how the issue was found) but these were terminals used by the general populace not just us CompSci students so the vast majority of the users were not at all technical (what we might assume almost everyone knows these days was still new fangled magic to the average student back then, for many arriving at Uni was their first encounter with having an email account for instance). To my knowledge they never worked out who did it, or how long it had been going on for other than “may have been months”, because the fake login app would exit and logout after sending off the captured credential, and next time it was run it was done from one of the captured accounts, so only the very first capture would have been done by the culprit's own account (even that maybe not if they'd guessed or stolen a password by other means first). Captured credentials were sent to a popular high volume usenet newsgroup so they couldn't track who was reading the result that way. Also, no evidence of the attacker actually using the compromised credentials for anything else, so it was possibly someone “playing” to see what they could do rather than a more malicious intent. It became standard practise (“enforced” by notices in large all caps text) to reset terminals before logging in to be more sure that was a real login prompt.

dspillett 3y ago

Someone was discovered to be collecting passwords that way on our universities VT terminals (I'm old enough that at Uni plain text terminals were still a thing, though they were generally used just as terminals for email & such when the lab rooms full of PCs were fully occupied) by leaving what looked like a login prompt on-screen. Someone with much tech knowledge immediately saw it wasn't quite right (that is how the issue was found) but these were terminals used by the general populace not just us CompSci students so the vast majority of the users were not at all technical (what we might assume almost everyone knows these days was still new fangled magic to the average student back then, for many arriving at Uni was their first encounter with having an email account for instance). To my knowledge they never worked out who did it, or how long it had been going on for other than “may have been months”, because the fake login app would exit and logout after sending off the captured credential, and next time it was run it was done from one of the captured accounts, so only the very first capture would have been done by the culprit's own account (even that maybe not if they'd guessed or stolen a password by other means first). Captured credentials were sent to a popular high volume usenet newsgroup so they couldn't track who was reading the result that way. Also, no evidence of the attacker actually using the compromised credentials for anything else, so it was possibly someone “playing” to see what they could do rather than a more malicious intent. It became standard practise (“enforced” by notices in large all caps text) to reset terminals before logging in to be more sure that was a real login prompt.