2

Suppose a desktop OS has a lock screen and fades and locks after inactivity. Suppose the default appearance and inactivity duration are well known (eg consider a default installation of some popular version of Linux). Is there something I'm missing that prevents the following attack?

  1. Create a webpage which entices the user to view at full screen for some time without input (eg a video player)
  2. Shortly before the inactivity timer fires, mimic the fading screen and login prompt.
  3. User attempts to log in as usual, providing their credentials to the webpage (additionally the user input resets the real inactivity timer).

The fake lock screen could probably not prevent the user reaching the real lock screen via a keyboard shortcut (eg Ctrl-Alt-L). However if the user believes they are already at the lock screen, there is no reason for them to do this.

Background: My employer recently deployed a custom lockscreen. I and others (who missed the announcement) were suspicious of an unfamiliar password prompt. It was suggested the concern is unfounded because changing the lock screen already requires significant privileges. However I don't see how this rules out the possibility of a user-space program faking a lock screen (admittedly the appearance was significantly different, so if it were an attempted imitation it would be a poor one).

stewbasic
  • 157
  • 2
  • 6
  • How would you force the fullscreen mode? Atleast in Chrome this requires some user interaction – toom Jun 21 '18 at 06:40
  • @foom Yes, barring a browser bug this would require the user to agree to fullscreen mode. I think this is not impossible (IIRC I have watched videos in full screen Chrome tabs before). Also IIUC the tab can find out whether it's full screen and avoid raising suspicious if not. – stewbasic Jun 21 '18 at 06:59

1 Answers1

0

It's pretty common already for malware to inject fake popups asking for a password so this seems like a valid variation of that attack path but isn't really related to the lock screen at all.

See this example in metasploit.

stewbasic
  • 157
  • 2
  • 6
neonprimetime security
  • 986
  • 5
  • 17