Login spoofing

Login spoofings are techniques used to steal a user's password.[1][2] The user is presented with an ordinary looking login prompt for username and password, which is actually a malicious program, usually called a Trojan horse under the control of the attacker. When the username and password are entered, this information is logged or in some way passed along to the attacker, breaching security.

To prevent this, some operating systems require a special key combination (called a secure attention key) to be entered before a login screen is presented, for example Control-Alt-Delete. Users should be instructed to report login prompts that appear without having pressed this secure attention sequence. Only the kernel, which is the part of the operating system that interacts directly with the hardware, can detect whether the secure attention key has been pressed, so it cannot be intercepted by third party programs (unless the kernel itself has been compromised).

Similarity to phishing

Whereas the concept of phishing usually involves a scam in which victims respond to unsolicited e-mails that are either identical or similar in appearance to a familiar site which they may have prior affiliation with, login spoofing usually is indicative of a much more heinous form of vandalism or attack in which case the attacker has already gained access to the victim computer to at least some degree.

Internet

Internet-based login spoofing[3] can be caused by

  • compromised sites
  • those named similarly to legitimate sites: typos bring people there.

References
  1. Bongsik Shin (2017). A Practical Introduction to Enterprise Network and Security Management. ISBN 1498787983.
  2. Insupp Lee; Dianna Xu (2 December 2003). "CSE 380 Computer Operating Systems" (ppt). University of Pennsylvania. p. 35. Retrieved 6 April 2016.
  3. Emmett Dulaney (2011). CompTIA Security+ Deluxe Study Guide: SY0-201. ISBN 0470439858.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.