First, before I get answers containing information that I already know, yes, I'm aware that the superuser can reset passwords, and yes, I know that the superuser can log in as other users without knowing their passwords.

I also know it's possible to crack an encrypted password with special programs. I'm talking about directly gaining the password a user types in, as plain text, without the need to decrypt anything.

Of course, a general keylogging program can do this, I assume, but there would be a lot of junk in the output that was not related to passwords, and it may even have safety features built in to prevent this use.

Is it possible for root to put a keylogging program on a machine, that is activated specifically when a user changes their password, and "intercepts" the information before it gets encrypted? It could then send this information to a secret file in root's home directory.


4 Answers 4


Yes, of course.

The superuser can replace the programs that read the user's password (login, passwd, …) by versions that do their job, plus write the password out to a log.

The superuser can also replace the kernel by a kernel that modifies the way programs like ls, md5sum, lsof, etc. work so that they report the modified programs looking like the normal ones, so that it would be impossible to detect that the system has been modified from the inside. You could still detect the modification by looking carefully from the outside, e.g. looking at a disk image.

The superuser can even go further and modify some firmware on one of the system's main peripherals so that it injects the malware when the system boots. This represents a considerably higher level of sophistication, but it's possible, at least in principle.

If you don't trust a computer's administrator, don't type your password there.


It depends on how users change their passwords. If they just use passwd it's not hard for root user to replace an actual passwd binary with a compromised equivalent. Most people don't have a habit of obsessive checking whether passwd is a binary or a shell script or whether it comes from a legitimate source. But finally, the most important thing is that users should understand that root is the most powerful user and they cannot 100% trust the machine that does not belong to them.


Easy as 1-2-3:

  1. Get source code of shell the user is using
  2. Modify such that either everything is logged or just characters after passwd
  3. Compile and replace existing shell
  • 1
    @ArkadiuszDrabczyk pointed out that it's even more easy: just modify passwd.
    – user236012
    Mar 9, 2015 at 23:41
  • I made my comment an answer because it looks like it could be an answer. Mar 10, 2015 at 0:28

Theoretically yes. The superuser can modify anything in the running System. That means also the Kernel and all binaries related to logging in, e.g. adding a call that sends the password to a website prior to it being hashed.

In practice, this is useless, as you have pointed out yourself, which is why something like this will probably never happen.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .