Linux terminal keylogger in userspace • Hacker News Board

Re: Linux terminal keylogger in userspace

#31

Post by zx2c4 » Mon, Dec 17, 2012, 4:20 PM UTC

winter_blue wrote: post #29

zx2c4 wrote: post #14

Earlier quoted context omitted.

Aside from the fact that that's a horrible habit, even following those steps, you couldn't have missed it. Anyway, enough of this discussion. Let's talk about the actual keylogger -- Comments? Questions? Suggestions?

Just want to add first of all that I generally read the ReadMe first. -- Besides that, what do you (zx2c4) think of Linux? Do you think it's a safe platform? I think it still has a long way to go. _Most_ programs require root access to install; and even ones that don't need root still have access to all user files. This is a but of problem. Contrast this with iOS, where every app has local storage and one app cannot…

Linux can be made reasonably safe. Grsec, PaX, seccomp, hardened toolchain... I'm fine with Linux.

Re: Linux terminal keylogger in userspace

#32

Post by winter_blue » Mon, Dec 17, 2012, 6:23 PM UTC

winter_blue wrote: post #29

zx2c4 wrote: post #14

Earlier quoted context omitted.

Aside from the fact that that's a horrible habit, even following those steps, you couldn't have missed it. Anyway, enough of this discussion. Let's talk about the actual keylogger -- Comments? Questions? Suggestions?

Just want to add first of all that I generally read the ReadMe first. -- Besides that, what do you (zx2c4) think of Linux? Do you think it's a safe platform? I think it still has a long way to go. _Most_ programs require root access to install; and even ones that don't need root still have access to all user files. This is a but of problem. Contrast this with iOS, where every app has local storage and one app cannot…

For some strange reason, zx2c4, the comment you made under mine is dead. (Try logging out and seeing if it's visible.)

I don't know if you've been banned. If you have, that would bee very strange. Why would someone do that? Were they pissed at the fact you shared potential dangerous code that could be used to infiltrate the OS run by many HNers?

Or you might have hit some sort of reply-depth. (Just guessing here.)

Re: Linux terminal keylogger in userspace

#33

Post by pea-tear » Mon, Dec 17, 2012, 9:09 PM UTC

Spidler wrote: post #19

bcoates wrote: post #2

Is there a way to send a secure attention command to su/sudo to protect against this?

Well, su/Sudo are suid bit programs, so that means LD_PRELOAD doesn't work on them

That's what this app does, it uses LD_PRELOAD to perform keylogging on both non-suid and suid apps.

Re: Linux terminal keylogger in userspace

#34

Post by teeja » Tue, Dec 18, 2012, 1:54 PM UTC

Isn't is curious when OS's don't keep track of non-system software ... when it's installed, what process installed it, whether that process was under local control, any other info to indentify the source ... and to list that information on demand any time any user wants it?

What's up with that? It's as though we're happy that we can be infiltrated at any time. It's not like people don't put weeks and months into "me-too" websites ... but there's never been any major motion in the direction of making the existence of surreptitious mods available at a key-click?

Such apps may exist, but I've never run across one for any platform explicitly designed to help anyone root out what's been installed without their knowledge. It CAN'T be that hard. Link it up to an open online knowledge-base that will nix false flags ...

Re: Linux terminal keylogger in userspace

#35

Post by wbl » Tue, Dec 18, 2012, 2:23 PM UTC

winter_blue wrote: post #29

zx2c4 wrote: post #14

Earlier quoted context omitted.

Aside from the fact that that's a horrible habit, even following those steps, you couldn't have missed it. Anyway, enough of this discussion. Let's talk about the actual keylogger -- Comments? Questions? Suggestions?

Just want to add first of all that I generally read the ReadMe first. -- Besides that, what do you (zx2c4) think of Linux? Do you think it's a safe platform? I think it still has a long way to go. _Most_ programs require root access to install; and even ones that don't need root still have access to all user files. This is a but of problem. Contrast this with iOS, where every app has local storage and one app cannot…

But that kills any hope of having an email client attach files made by other programs with the current implementation.

Re: Linux terminal keylogger in userspace

#36

Post by csense » Wed, Dec 19, 2012, 8:42 AM UTC

vy8vWJlco wrote: post #15

Logging in as root from a virtual console (ie, a login prompt spawned directly from init) shouldn't give away the root password, even with something like this in place. Someone would have needed root access already to interfere with that since init (getty, etc) and X all run as root. Of course, the moral is still to use root as little as possible...

On a system that uses sudo (like Ubuntu's standard account setup), having access to a non-root administrative user account (with sudo privileges) is equivalent to having root access. And nobody can fool themselves into thinking this isn't the case, because the account is explicitly flagged as "this account can become root."

Because the exploit in the article exists, on a system that uses su, having access to a non-root administrative account (that accesses root regularly through su) is equivalent to having root access. But it's not as obvious that this is the case.

This means the sudo setup is more secure (with respect to this exploit), because it doesn't pretend to have a level of security it doesn't actually have.