Linux terminal keylogger in userspace

Re:Linux terminal keylogger in userspace by bcoates on Sunday December 16, 2012 @11:47PM (#4930879)

Is there a way to send a secure attention command to su/sudo to protect against this?

[ Parent | on HN ]

Re:Linux terminal keylogger in userspace by Spidler on Monday December 17, 2012 @02:34AM (#4931273)

Well, su/Sudo are suid bit programs, so that means LD_PRELOAD doesn't work on them

[ Parent | on HN ]

Re:Linux terminal keylogger in userspace by pea-tear on Monday December 17, 2012 @04:09PM (#4934377)

That's what this app does, it uses LD_PRELOAD to perform keylogging on both non-suid and suid apps.

[ Parent | on HN ]

Re:Linux terminal keylogger in userspace by iopuy on Monday December 17, 2012 @12:18AM (#4930939)

Echo the LD_PRELOAD environment variable first and check for anything suspect.

[ Parent | on HN ]

Re:Linux terminal keylogger in userspace by lordlicorice on Monday December 17, 2012 @12:21AM (#4930943)

Unless the shared object file also includes an override for the function that expands environment variables to lie about the true value of LD_PRELOAD.

[ Parent | on HN ]

Re:Linux terminal keylogger in userspace by est on Monday December 17, 2012 @12:46AM (#4930996)

the twist: echo is also hijacked...

[ Parent | on HN ]

Re:Linux terminal keylogger in userspace by iopuy on Monday December 17, 2012 @12:53AM (#4931011)

Okay... just type "Export" then.

[ Parent | on HN ]

Re:Linux terminal keylogger in userspace by DannyBee on Monday December 17, 2012 @02:13AM (#4931217)

okay, so now the getenv call is hijacked too. You can play this game all day, as long as the environment is stored in user space, you can get it and fake the output.

[ Parent | on HN ]

Re:Linux terminal keylogger in userspace by AYBABTME on Monday December 17, 2012 @01:49AM (#4931123)

One way I can think of would be with a 2-factor authentication, such as: http://wiki.gentoo.org/wiki/Google_Authenticator

[ Parent | on HN ]