On Windows one can enforce pressing Ctrl+Alt+Del to fire an interrupt that brings up the login window.

When logging onto a console of a Linux computer: How can I tell if this login is a real one or a mocked up on to steal my credentials?


Assuming that you want to be protected against other normal users of the system (if the adversary has root access, all bets are off), your could in principle use a secure attention key:

An operating system's Secure Attention Key is a security tool which is provided as protection against trojan password capturing programs. It is an undefeatable way of killing all programs which could be masquerading as login applications. Users need to be taught to enter this key sequence before they log in to the system.

(Linux 2.4.2 Secure Attention Key (SAK) handling, Andrew Morton, 18 March 2001)

This related U&L question may be of interest: How can I find the Secure Attention Key (SAK) on my system and can I disable it?

| improve this answer | |
  • What could happen when SAK will be activated with an X server switched on? – Incnis Mrsi Sep 11 '15 at 15:48
  • @IncnisMrsi: I've tried that; it seems to be roughly equivalent to Ctrl+Alt+Backspace assuming you haven't disabled that. I do remember that it seemed a bit buggier, though, but I can't recall any specifics. – Kevin Sep 11 '15 at 15:51
  • I hit it frequently on my vtty, and after some time, the login didn't come back. That feels buggy, but +1 for an actually every-day-useful SysRq. – bot47 Sep 11 '15 at 15:56
  • @Kevin: So if a user ran a legitimate X server (that necessarily is euid = 0, at least on PCs) on a tty≠7, its configuration has SAK disabled, then SAK isn’t that undefeatable as kernel docs claim? Suppose an emulated GUI DM runs on it. – Incnis Mrsi Sep 11 '15 at 15:57
  • @IncnisMrsi: I think what it actually does is kill everything in your session and relaunch the "correct" thing, whatever that may be. So if tty=7, you get a brand-new X, otherwise you get login, etc. This is buggy because some fancy DEs like GNOME don't like being killed out of nowhere. But if your attacker has euid=0, you've already lost anyway. – Kevin Sep 11 '15 at 16:02

First of all, I'm not sure you can be over confident of the Ctrl+Alt+Del login window on Windows, this is also the role of a virus/trojan to hijack interruption, and implementing it is very possible.

Second, if such mechanism is implemented both on Windows/Linux, it means that administrator privileges are surely compromised.

In Linux, if someone wrote a fake shell to display a prompt and catch your credentials, I guess basic Ctrl+C or Ctrl+Z can be enough, if those signals are not caught to discover the trick. Also entering wrong credentials several time can help you to see any deviation from normal timer behaviour.

Switching between different console like also increase the probability to discover the trick.

But in any case you can not be sure 100% on any kind of system of trustworthiness of your login prompt/window.

| improve this answer | |

You can use ctrl+alt+F1...F7 to go into other tty, and log in from there. You can also use ctrl + z or ctrl + c. However, if someone is trying to steal your login and password using this method, it's still possible that you're being cheated on. Depends on what OS you're using, who had access to it and what kind of access did he have.

Generally, you can never be 100% sure, but if someone did this, I would assume he already has root access - so your login data would be meaningless to him.

| improve this answer | |
  • 3
    If I were to set up such a trap, I would definitely have my program run on every tty. Keep in mind that those you access with the control keys aren't particularly safer. – John WH Smith Sep 11 '15 at 14:35
  • Fair point; this was the best what came to my mind. – MatthewRock Sep 11 '15 at 14:37
  • Can some magic sysrq help you? – bot47 Sep 11 '15 at 15:35

A user (even not root) having a physical access to the console can do such a con trick.

Log in through ssh and check which processes operate on a virtual console you want to log in locally. Whether is it getty (for a TUI tty) or other legitimate display manager? Has it UID = 0?

If any of two is false, then the hostname login: banner is certainly forged. But, as state answers already written, it doesn’t help against a wrongdoer having his/her privileges already escalated to root.

| improve this answer | |

Short answer: you can't tell.

But if the login prompt command has been replaced, it means that the attacker has root access on the machine. In this case he/she could as well:

  • have installed a keylogger to steal your password. You can mitigate the problem by using unique password, so the attacker won't be able to access other online services you use;
  • login as you (or as any other user) on the machine, simply by changing the password, or access your (or anyone else's) files.

Therefore worrying whether the login prompt is legitimate or not is a moot point.

As a general rule, you should not login to a machine which you think might be compromised.

| improve this answer | |
  • 8
    I could design a program which imitates the behaviour of a login prompt, and run it in every TTY without root privileges (as myself). If done correctly, it would be impossible to distinguish the real prompt from the program's output, inviting you to enter your credentials. However, note that it would take root privileges to authenticate you (making the trap completely transparent), so if the login fails and you're sure you didn't make a typo... you may assume you've been trapped (too late though). – John WH Smith Sep 11 '15 at 14:37
  • 6
    You don't install it. You simply use your own account to log into every terminal, and run the fake login there. Users who try to use a terminal after that will find your fake prompt, running as you, not the login program running as root. I'm not assuming that the actual login program has been compromised, indeed. – John WH Smith Sep 11 '15 at 14:48
  • 7
    @dr01. Login as normal. When you're ready to start your ~/bin/fakelogin, use exec ~/bin/fakelogin so that when it exits (for whatever reason) your user account is logged out and the real login prompt presented to the other user. – roaima Sep 11 '15 at 15:44
  • 3
    Normally when you try to steal a password in a prompt, you log it and write "Invalid login.", then exit your program. So, no need to authenticate using $euid=0. – Ned64 Sep 11 '15 at 19:21
  • 1
    Why the downvotes? – dr_ Sep 13 '15 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.