0

I'm not entirely sure this is the right place for the is question but I cannot think of another so here goes.

In order to login to the windows machines at my office one must press the almighty CTRL-ALT-DELETE command combo first. I, finding this very frustrating, decided to look into why and found claims from both my sys and Microsoft stating that it's a security feature and that "Because only windows could read the CTRL-ALT-DELETE it helped to ensure that an automated program cannot log in.

Now I'm not a master of the windows operating system ( as I generally use *nix ) but I cannot believe that "Only windows can send that signal" bull. It just doesn't sit right.

Is there a good reason for the CTRL-ALT-DELETE to login thing? is it something I'm missing? or is it another example of antiquated legacy security measures?

Improve this question
2
  • 1
    Without wishing to sound rude, have you looked at wikipedia? (en.wikipedia.org/wiki/Control-Alt-Delete). C-A-D is essentially trapped by a high level process in windows that should make it very hard for malware or badly behaved system software, running at a lower level, to intercept and interfere with that keystroke.
    – Rob Moir
    Feb 5, 2011 at 23:04
  • You're also misunderstanding. You say you "cannot believe that "Only windows can send that signal" " - well, you're correct in that. Plenty of things can SEND that signal. Only Windows can READ that signal.
    – mfinni
    Feb 5, 2011 at 23:40

2 Answers 2

Reset to default
4

A normal application program cannot intercept the <CTRL>-<ALT>-<DEL> key sequence (which is called a "Secure Attention Sequence", or "SAS") in a Windows NT-family operating system (Windows NT, 2000, XP, 2003, Vista, 2008, and 7). Only a program with "Administrator" level access to the system (actually, "SYSTEM" level access, but I'm simplifying) can do this.

Imagine a scenario as follows:

  • An evil user, Mallet, writes a program that mimics the Windows logon interface. Mallet logs on, runs his program to mimic the Windows logon interface, and walks away.

  • When someone tries to "logon" using this mimic interface, though, an obscure sounding error message is displayed. As the error is displayed, the username and password entered by the user (which probably were valid) is emailed to Mallet.

  • The annoyed user who was attempting to logon dismisses the error message. The mimic program issues a "Log Off" call to the operating system such that the user is then presented with the real Windows logon interface. The user logs-on successfully, figures that they just "fat fingered" their password, and goes about their work.

  • Mallet logs-on to every computer in every computer lab in his building and runs his mimic program and receives a large number of likely-to-be valid usernames and passwords in his email.

The reason for the "SAS" functionality in the operating system is to prevent this kind of malicious activity. When enter the "SAS" sequence (which in Windows NT is <CTRL>-<ALT>-<DEL>, but could just as easily be a dedicated hardware button, smart card reader, etc) you are guaranteed to receive a user interface from the operating system itself, and not a malicious third-party program. This "guarantee" assumes that no Administrator-level user or malicious attacker with physical access to the computer (who could then disassemble the computer and insert malicious code) has "corrupted" the operating system. If malicious users have "Administrator" level access or can disassemble the computer or otherwise inject code into the operating system (through, say, a bug in the operating system) then all bets are off.

The SAS functionality is a piece of an overall security strategy. By itself it's fairly weak, but as part of a layered security model it does stop some specific types of attacks.

As an aside: The sequence <CTRL>-<ALT>-<DEL> was chosen because Windows NT (where it was originally introduced as an SAS) was to be compatible with both MS-DOS and 16-bit Windows applications. This key sequence was a good pick because in MS-DOS and 16-bit Windows the <CTRL>-<ALT>-<DEL> sequence would initiate a reboot and, as such, taking over that key sequence for an operating system function wouldn't "deprive" users of a key sequence in application software.

Improve this answer
2

Windows reserves the “Ctrl-Alt-Del” key combination to the windows logon process. This means that provided everything else is running as it should, a third party can’t spoof the logon process and key log your password. Yes, the chance of that happening is slim. Yes, it’s an archaic security policy. Yes, it’s in place. It's my job to be paranoid and my job to enforce archaic security policies because upon occasion we deal with archaic security threats. Deal with it.

Happy coding.

-Your Sys.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .