can a super user steal passwords from other users with keylogging?

Question

First, before I get answers containing information that I already know, yes, I'm aware that the superuser can reset passwords, and yes, I know that the superuser can log in as other users without knowing their passwords.

I also know it's possible to crack an encrypted password with special programs. I'm talking about directly gaining the password a user types in, as plain text, without the need to decrypt anything.

Of course, a general keylogging program can do this, I assume, but there would be a lot of junk in the output that was not related to passwords, and it may even have safety features built in to prevent this use.

Is it possible for root to put a keylogging program on a machine, that is activated specifically when a user changes their password, and "intercepts" the information before it gets encrypted? It could then send this information to a secret file in root's home directory.

Answer 1

Yes, of course.

The superuser can replace the programs that read the user's password (login, passwd, …) by versions that do their job, plus write the password out to a log.

The superuser can also replace the kernel by a kernel that modifies the way programs like ls, md5sum, lsof, etc. work so that they report the modified programs looking like the normal ones, so that it would be impossible to detect that the system has been modified from the inside. You could still detect the modification by looking carefully from the outside, e.g. looking at a disk image.

The superuser can even go further and modify some firmware on one of the system's main peripherals so that it injects the malware when the system boots. This represents a considerably higher level of sophistication, but it's possible, at least in principle.

If you don't trust a computer's administrator, don't type your password there.

Answer 2

It depends on how users change their passwords. If they just use passwd it's not hard for root user to replace an actual passwd binary with a compromised equivalent. Most people don't have a habit of obsessive checking whether passwd is a binary or a shell script or whether it comes from a legitimate source. But finally, the most important thing is that users should understand that root is the most powerful user and they cannot 100% trust the machine that does not belong to them.

Answer 3

Easy as 1-2-3:

1. Get source code of shell the user is using
2. Modify such that either everything is logged or just characters after passwd
3. Compile and replace existing shell

Answer 4

Theoretically yes. The superuser can modify anything in the running System. That means also the Kernel and all binaries related to logging in, e.g. adding a call that sends the password to a website prior to it being hashed.

In practice, this is useless, as you have pointed out yourself, which is why something like this will probably never happen.