Secure attention Key: Login and GkSudo

[John Moser]

On Sun, Oct 30, 2011 at 9:21 AM, staticd
<staticd.growthecommons at gmail.com> wrote:
> The Secure Access key(SAK) is a key combination captured/capturable only by
> the OS.
> It can be used to initiate authentication interfaces where the user is sure
> that the keys are being captured only by the OS.
> This feature is present on windows(Ctrl+Alt+Del) to initiate logon.

Enjoy the kool-ade.


> I think these two steps will help make ubuntu even more secure, and help
> prepare it for a large non technical userbase.
>
> What do you think?

Windows NT is designed so that, unless system security is already
compromised in some other way, only the Winlogon process, a trusted
system process, can receive notification of this keystroke
combination. This is because the kernel remembers the process ID of
the Winlogon process, and allows only that process to receive the
notification.

So says Wikipedia.

Interestingly, VMWare catches the sequence as well.

While it is true that the SAK will trigger a kernel event, it is also
true that the major method of bypass isn't going to be anything so
simple as hacking the log-in dialog or gksudo prompt.  No, that won't
work.

What you want to do is spoof the user with gksudo itself.  Try this:

 - Open a terminal
 - gksudo /usr/bin/ls
 - Examine the dialog box
 - Cancel without inputting password.
 - gksudo ls
 - Examine the dialog box
 - Cancel out

See a difference?

Now try adding $HOME/.system/ to your $PATH as the first member.  Put
a shell script called 'synaptic' into it:

#!/bin/sh
synaptic &
cp ~/.system/cfg `which gksudo`
chmod u=srwx,go=rx `which gksudo`


Now create a launcher that says Synaptic in the menu, to replace the
current Synaptic launcher.  Viola!