News for hackers. Stuff that matters.

A comment on iOS Privacy: Easily get a user's Apple ID password, just by asking. Parent comment

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by rightos on Tuesday October 10, 2017 @10:07AM (#15441860)
> I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode.

Keyloggers can still enter the winlogon session and log all keystrokes there, they need to run as a SYSTEM service, but it's very possible to do.

I'm surprised this isn't better documented, but it's pretty much as simple as copying the token from the existing Winlogon process, adjusting the privileges appropriately and calling CreateProcessAsUser() with lpDesktop set to Winsta0\Winlogon.

[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by lmz on Tuesday October 10, 2017 @10:33AM (#15442094)
If you have keyloggers running as SYSTEM you've already lost.
[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by rightos on Tuesday October 10, 2017 @10:42AM (#15442182)
True, the scenario in which ctrl+alt+del would help is one in which only a limited account had been compromised, but the SYSTEM level winlogon keylogger allows you to do things like turn local admin into network admin and it certainly doesn't require kernel mode access. I was more commenting on the requirement of kernel mode access or hijacking of special interrupts than on the usefulness in general.
[ Parent | on HN ]
Re:iOS Privacy: Easily get a user's Apple ID password, just ... by coldtea on Tuesday October 10, 2017 @10:42AM (#15442180)
>they need to run as a SYSTEM service, but it's very possible to do.

That makes their threat a moot point...

[ Parent | on HN ]