Results 1 to 7 of 7

Thread: Can root discover other users passwords

  1. #1
    Join Date
    Dec 2009
    Beans
    145

    Can root discover other users passwords

    I am non-root user in ubuntu machine , I have noticed that password and encryption keys contains all my entered password.
    Which shoked me !!!!!!!!!!!!!!!!!!!!!!!!!!!

    My questions are :

    1 . I have found in my search that password and encryption keys are stored in the files login.keyring , user.keystore (/home/myusername/.gnome2/keyrings) , it seems that they are encrypted .
    is there any way to view the contents of this two files , is there any way to view the passowrds inside above 2 files

    2 . Is there any way or security whole in which the root user can access (system menu --> preferences --> passowrd and encryption keys) of other users (other root users , non-root users,....etc) . of course for the the same machine?

    3 . Is there any way or security whole in which the root user can discover the passwords like ubuntu login passowrd , keyring password , browsing sites passwords (taking in consideration never remember passwords for all sites , and clearning browsing history) entered by other users(other root users,non-root users,,,,etc). of course for the same machine?

    I really do need your detailed reply for my questions , all advises and feedbacks are most welcome

  2. #2
    Join Date
    Aug 2011
    Location
    47°9′S 126°43W
    Beans
    1,912
    Distro
    Kubuntu 12.10 Quantal Quetzal

    Re: Can root discover other users passwords

    Quote Originally Posted by techbrainless View Post
    I am non-root user in ubuntu machine , I have noticed that password and encryption keys contains all my entered password.
    Which shoked me !!!!!!!!!!!!!!!!!!!!!!!!!!!

    My questions are :

    1 . I have found in my search that password and encryption keys are stored in the files login.keyring , user.keystore (/home/myusername/.gnome2/keyrings) , it seems that they are encrypted .
    is there any way to view the contents of this two files , is there any way to view the passowrds inside above 2 files

    2 . Is there any way or security whole in which the root user can access (system menu --> preferences --> passowrd and encryption keys) of other users (other root users , non-root users,....etc) . of course for the the same machine?

    3 . Is there any way or security whole in which the root user can discover the passwords like ubuntu login passowrd , keyring password , browsing sites passwords (taking in consideration never remember passwords for all sites , and clearning browsing history) entered by other users(other root users,non-root users,,,,etc). of course for the same machine?

    I really do need your detailed reply for my questions , all advises and feedbacks are most welcome
    If it's the same PC that you share with others, a root user can likely install a keylogger to record all your keyboard interactions. Passwords for sites not using HTTPS are also likely sent in the clear and can be captured by anyone with access to your local network. A root user can also set up a transparent proxy and record all your web traffic, even HTTPS stuff by faking certificates (man-in-the-middle attack).

    You aren't going to sleep well tonight

  3. #3
    Join Date
    Dec 2009
    Beans
    145

    Re: Can root discover other users passwords

    Thanks ofnuts for your reply ,

    If it's the same PC that you share with others, a root user can likely install a keylogger to record all your keyboard interactions. Passwords for sites not using HTTPS are also likely sent in the clear and can be captured by anyone with access to your local network. A root user can also set up a transparent proxy and record all your web traffic, even HTTPS stuff by faking certificates (man-in-the-middle attack).
    great answer for question 3.

    I will be grateful if you could provide answers for q1 & q2 also.

  4. #4
    Join Date
    Jul 2012
    Beans
    4

    Re: Can root discover other users passwords

    Q3: Linux passwords are stored in whats called a hash meaning that its mathematically impossible for root to get it. However with the hash one could brute force the hash meaning they go through the many combinations of ascii text hashing each and comparing it against the hash in the shadow file. Secondly if you never remember passwords then it shouldn't be a problem other than how ofnuts described.

  5. #5
    Join Date
    Apr 2008
    Location
    UK
    Beans
    496
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Can root discover other users passwords

    Generally speaking, wherever passwords are stored these days, they are encrypted before storage. The idea is that it should take an inordinately long length of time to "break" the encryption, assuming the algorithm to be strong enough.

    If you can get your hands on a password hash, as you certainly can with root access, then you can try a variety of common approaches to cracking the hash. Rainbow tables, dictionary attacks and brute force attacks are the usual barrage of solutions. However, if the algorithm is chosen well (or just applied enough times), and the password long enough with a good charset, then the basic answer is no. You're stumped.
    Ace1 FreeBSD/Gnome 2, i5 2300, 16GB, HX750W, 20TB ZFS pool, 60GB SSD, Fractal Design XL
    Ace2 Ubuntu/Xubuntu, i7 2600, 16GB, HX850W, 4TB, Asus HD6970, Fractal Design R3
    Ace3 Ubuntu/XFCE, E7200, 4GB, OCZ GameXStream 700W, 8TB

  6. #6
    Join Date
    Oct 2009
    Location
    Elgin, IL USA
    Beans
    2,534
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Can root discover other users passwords

    Main system passwords use a one-way encryption. In other words the system can encrypt a password you give it and see if it matches the encrypted password, but you cannot decrypt the encrypted password. With a good encryption hash, the only way to really find a password of a user is to keep guessing until there is a match.

    So don't use normal dictionary words or something easy to guess and mix it up with numbers and upper and lower case letters.

    I do keep some passwords for web sites in an OpenOffice/LibreOffice document. Not sure how that is stored or how secure it is, but it is password protected and a password or phrase is used to encrypt and decrypt the file.
    i5 650 3.2 GHz, 8 GB, nvidia GTX 550 Ti 32" 1080p | i7-4700, 8 GB, Intel HD 4600/nvidia GTX 765M 15.6" 1080p | etc.

  7. #7
    Join Date
    Feb 2005
    Location
    Melbourne, Australia
    Beans
    13,505
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Can root discover other users passwords

    Quote Originally Posted by techbrainless View Post
    I am non-root user in ubuntu machine , I have noticed that password and encryption keys contains all my entered password.
    Which shoked me !!!!!!!!!!!!!!!!!!!!!!!!!!!
    ..........
    Why?, they are your passwords and you should have access to them.
    Regards, David.
    Please use the Forum search and Wiki search for immediate help
    Please mark your thread as Solved when appropriate
    New to technical forums?: How To Ask Questions The Smart Way

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •