Quick security question

[Jared]

> Wrong.
> http://en.wikipedia.org/wiki/Control-Alt-Delete
> http://www.techshowflorida.com/details.html
> 
> Invented LONG before phishing.  I fail to see how a USB dongle can
> determine if a user is local or not.  And yes, you can send a
> ctl+alt+delete remotely, but it will disconnect your session as the
> computer reboots.  Also, Linux and Windows can be altered to not respond
> to remote ctl+alt+delete.

Responding to the four claims above:

1. "Phishing" is a strategy of fooling the user into thinking he is
logging into a system when he is actually running an application
which harvests passwords. It is at least 18 years old, as I used
this technique on a DEC VMS system at UMKC in the late 1980s, as
a stunt among close friends, not entirely realizing the ethical
boundaries I had crossed. I never actually used passwords thereby
harvested, because it was more fun to simply show the program to a
friend and say "Ain't that cool?" Many years later, the term
"phishing" was coined to describe this technique, by which time
Windows NT had changed CTRL-ALT-DEL from the reboot sequence to
its anti-phishing Security Sequence. Thus, the phishing technique
is well over 30 years old, although the name "phishing" is new.

2. A dongle is a well-known practice for ensuring:
   a. The expensive-application runs only on a single machine.
   b. The secure-user is actually at the local machine.
It is also annoying and consequently not used often, thank God.

3. TightVNC allows me to send CTRL-ALT-DEL remotely, and it will
perform as expected, _not_ immediately rebooting the computer. I
think your information on this may be a few years old, from before
Microsoft commandeered the CTRL-ALT-DEL sequence from its previous
role as reboot sequence.

4. Your final point is correct. On a RedHat system, comment this
line in /etc/inittab:
    ca::ctrlaltdel:/sbin/shutdown -t3 -r now
In Windows, there are several ways; even including JavaScript:
    var wshell=WshShell.CreateObject("WshShell");
    wshell.RegEdit("HKCU\Software\Microsoft\Policies\CurrentVersion\
                    System\DisableTaskMgr",1,"REG_DWORD");

Of course, your security policies will need to allow this.

In other words, the initial claim of "Wrong" above may need
to be adjusted slightly. Luke did know what he was talking about,
and I write to corroborate.

-Jared

 > >-----Original Message-----
 > >From: Luke -Jr
 > >Sent: Wednesday, February 21, 2007 11:27 AM
 > >
 > >Actually, IIRC, the Ctrl-Alt-Delete login process is meant to
 > >thwart phishing attacks. When you press Ctrl-Alt-Delete,
 > >Windows ALWAYS intercepts it.
 > >Therefore, you know Windows itself is presenting your login
 > >dialog, not some viral program. You can send Ctrl-Alt-Delete
 > >remotely since at least Win98 (though in DOS-based Windows, it
 > >will freeze any network processes).
 > >
 > >If you want to determine if a user is local, use a USB dongle
 > >:)