Comment on Linux terminal keylogger in userspace Comments−bcoates13yIs there a way to send a secure attention command to su/sudo to protect against this?−Spidler13yWell, su/Sudo are suid bit programs, so that means LD_PRELOAD doesn't work on them−pea-tear13yThat's what this app does, it uses LD_PRELOAD to perform keylogging on both non-suid and suid apps.−iopuy13yEcho the LD_PRELOAD environment variable first and check for anything suspect.−lordlicorice13yUnless the shared object file also includes an override for the function that expands environment variables to lie about the true value of LD_PRELOAD.−est13ythe twist: echo is also hijacked...−iopuy13yOkay... just type "Export" then.−DannyBee13yokay, so now the getenv call is hijacked too. You can play this game all day, as long as the environment is stored in user space, you can get it and fake the output.−AYBABTME13yOne way I can think of would be with a 2-factor authentication, such as: http://wiki.gentoo.org/wiki/Google_Authenticator
Comments
Is there a way to send a secure attention command to su/sudo to protect against this?
Well, su/Sudo are suid bit programs, so that means LD_PRELOAD doesn't work on them
That's what this app does, it uses LD_PRELOAD to perform keylogging on both non-suid and suid apps.
Echo the LD_PRELOAD environment variable first and check for anything suspect.
Unless the shared object file also includes an override for the function that expands environment variables to lie about the true value of LD_PRELOAD.
the twist: echo is also hijacked...
Okay... just type "Export" then.
okay, so now the getenv call is hijacked too. You can play this game all day, as long as the environment is stored in user space, you can get it and fake the output.
One way I can think of would be with a 2-factor authentication, such as: http://wiki.gentoo.org/wiki/Google_Authenticator