Replacing GINA to add a custom logo?

Security Briefs

Syndication

I just got some mail from a reader who wants to replace GINA to add a custom logo. This person wanted to know if a tutorial existed for this purpose, and mentioned that they weren't very good at C++ programming.

Replacing GINA is a major undertaking, even if you only want to change the look and feel of the logon screen. This is a highly sensitive part of the security system in Windows, and if you screw it up, you can cause the user's system to fail in nasty ways, or worse, allow a bad guy to steal user credentials from those logging in using a vulnerable, modified GINA.

So if all you want to do is “skin” the GINA so it has a custom logo, perhaps you should take the much, much simpler route of replacing the logon desktop background with one that has your company logo on it. You can do this by changing one registry value, and there's even a knowledge base article that explains how to do it.

Just because you can replace GINA doesn't mean you should!


Posted Jun 08 2007, 06:01 AM by keith-brown
Filed under: , ,

Comments

Jan Bannister wrote re: Replacing GINA to add a custom logo?
on 06-08-2007 6:38 AM
I completely agree. In my first development job building software to run on windows 'set-top boxes' that ran multi-media systems for Hotels we replaced GINA to automate the login and deployment of system images using ghost.

We did it because we couldn't think of a way around it. And it lead to lots and lots of pain. The state of a windows system is very fragile at the level that GINA works. We had some very odds issues with UNICODE support and the GINA module still sends a shiver down my back.

I've also noticed that most people in technology attack a problem space depth first. Many don't even know how to back up and try other options let alone take time to think about how to do something before they start coding.

Also, the need to have a company logo present at login has to be one of the most pointless and irrelevant 'features' I've ever heard...

Its exactly this type of combination of stupid developers and stupid feature requests that destroys so much time, money and value in the software industry.
Shawn Wildermuth wrote re: Replacing GINA to add a custom logo?
on 06-08-2007 6:54 AM
Is there a good solution for XP or Vista? This KB article seems to apply to NT/2000.
Keith Brown wrote re: Replacing GINA to add a custom logo?
on 06-08-2007 7:29 AM
If you are using fast user switching, this technique definitely won't work, since the desktop is managed differently.

But if you turn off FUS, this technique will probably still work. Give it a try and let us know, Shawn!
Henk de Koning wrote re: Replacing GINA to add a custom logo?
on 06-08-2007 1:34 PM
Actually, In Vista GINA's are no longer supported. You'll have to write a credential provider to get the same functionality.
Keith Brown wrote re: Replacing GINA to add a custom logo?
on 06-08-2007 1:46 PM
True for Vista, but for XP, it's the old model.
Norman Diamond wrote re: Replacing GINA to add a custom logo?
on 06-10-2007 5:14 PM
In XP it's too easy for Gina's not to cooperate with each other and cause problems even if each one is written properly.

In XP it's too easy for NP's not to cooperate with each other and cause problems even if each one is written properly.

In Vista, maybe we were just lucky, maybe we're going to learn a lesson in the future.

If someone just wants a custom logo, I agree with the suggestion for wallpaper.
Gal Cohen wrote re: Replacing GINA to add a custom logo?
on 08-13-2007 12:00 PM
The issue here is that each time a new release of windows comes out the pipe , the basic customer requirement of branding the logon screen somehow get ignored. This was true pre vista, and is true for vista and LH server. while I understand the security implication of allowing arbitrary bitmap on the logon screen and the possible security exposure for credentials, I fail to understand why when building the credential provider model the ms Dev team couldnt allow ISV to brand logonui. and on the corporate front, allowing a GPO that would change the backround for the logon screen or show a fixed size bitmap on some end of the screen. that would allowed only corperate customers to centraly control that feature , which would have served both the obvious common branding need and the security risk.
guess someone should add this as a workitem for blackcomb :)
Stranger wrote re: Replacing GINA to add a custom logo?
on 01-24-2008 8:55 PM
Well, i am using your GINAFULL.dll, its working fine but if i keep focus on "logon to the window" for some minutes, it automatically raise an error i.e
Debud Assertion Failed!
Expression : _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)
abort or retry or Ignore.

Can you tell me why this happens
With Best Regards
David Homer wrote re: Replacing GINA to add a custom logo?
on 07-09-2008 3:50 AM

Hello - best example I've seen on the net for GINA. You say don't use GINA modification unless you need to - but what about if you want a "Forgot My Password" Button that goes to a Self Service web page, whats the best way to do this? GinaStub? GinaHook? Some other way? Any tips much appreciated.

Add a Comment

(required)  
(optional)
(required)  
Remember Me?