Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New bypass #12

Open
Rederax01 opened this issue Sep 1, 2022 · 2 comments
Open

New bypass #12

Rederax01 opened this issue Sep 1, 2022 · 2 comments
Labels
enhancement New feature or request

Comments

@Rederax01
Copy link

press control+alt+delete then click "task manager" then close the fakelogin program

@bitsadmin bitsadmin added the wontfix This will not be worked on label Sep 2, 2022
@bitsadmin
Copy link
Owner

Hi Rederax01, that is correct and it is not possible to prevent this, which is good from the security perspective. For an elaboration, see for example this StackExchange topic: https://security.stackexchange.com/q/34972, for completeness also copied below.

Question
Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it's a bad idea as it's adding an extra step in getting access.

Does it improve security in any way, and if so, how?

Answer
This combination is called a Secure attention key. The Windows kernel is "wired" to notify Winlogon and nobody else about this combination. In this way, when you press Ctrl+Alt+Del, you can be sure† that you're typing your password in the real login form and not some other fake process trying to steal your password. For example, an application which looks exactly like the windows login.

† This implies a trust in the integrity of the system itself, it's still possible to patch the kernel and override this behaviour for other purposes (malicious or completely legitimate)

@bitsadmin bitsadmin added enhancement New feature or request and removed wontfix This will not be worked on labels Sep 2, 2022
@bitsadmin
Copy link
Owner

Realizing that a small improvement could be to periodically check if the Task Manager (taskmgr.exe) and maybe other tools like procexp.exe/procexp64.exe are running, they can be killed by the FakeLogonScreen and the FakeLogonScreen can be forced in the focus again.

However, probably when someone uses the Ctrl + Alt + Del key sequence, they are already aware that the logon screen is fake, so they won't enter their credentials anymore. Such feature would just be an additional annoyance for the user.

@bitsadmin bitsadmin reopened this Sep 2, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants