gcr security problem?

[millerthegorilla]

Hi - I am running ubuntu studio 12.10 and recently a gcr prompt has been turning up that states - you weren't logged in to your keyring at log in time - or words to that effect.

The prompt requests the login passphrase, all of this in both user accounts and the admin account.

I was doing some less than secure work involving dropping the firewall briefly just before it happened, and I have seen a keystroke logging equivalent of this on Windows machines about 7 years ago. Is there a way to find out if this is an exploit?

Thanks

[nothingspecial]

Thread moved to Security Discussions.

[Hungry Man]

Try reading here maybe.

https://wiki.ubuntu.com/BasicSecurity#Did_I_Just_Get_Owned.3F

[millerthegorilla]

Thanks for the link, I am working through that now. I think that I may have found the error.
In auth.log I have the following :


Dec 8 19:37:49 xxxxx-R720 polkitd(authority=local): Registered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session2 (system bus name :1.19 [/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_GB.UTF-8)
Dec 8 19:38:45 xxxxx-R720 gnome-keyring-daemon[2315]: couldn't set environment variable in session: The name org.gnome.SessionManager was not provided by any .service files
Dec 8 19:38:45 xxxxx-R720 gnome-keyring-daemon[2315]: keyring alias directory: /home/xxxxx/.local/share/keyringsWhen I check the environment variables I get :


GNOME_KEYRING_CONTROL=/run/user/xxxxx/keyring-oOGlqL
GNOME_KEYRING_PID=2453
When I list the actual process id :

2739 ? 00:00:00 gnome-keyring-d
and 2453 is not listed

and the keyring file is
keyring-Wk2OwESo it seems that my environment variables are not being updated. I will read about this now but if anyone can contribute before I get back then I'd be grateful.

Thanks.