Keyloggers! your keystrokes may be recorded
Keystroke logging,
often referred to as keylogging or keyboard capturing, is the
action of recording (logging) the keys struck on a keyboard, typically
covertly, so that the person using the keyboard is unaware that their actions
are being monitored. keylogging can also be used to study human–computer
interaction. Numerous keylogging methods exist: they range from hardware and
software-based approaches to acoustic analysis.
2 types
of keyloggers exist nowadays:
Software-based keyloggers
Keyloggers are used in IT organizations to troubleshoot
technical problems with computers and business networks. Families and business
people use keyloggers legally to monitor network usage without their users'
direct knowledge. However, malicious individuals can use keyloggers on public
computers to steal passwords or credit card information. Most keyloggers are
not stopped by HTTPS encryption because that only protects data
in transit between computers, thus the threat being
from the user's computer.
·
Hypervisor-based: The
keylogger can theoretically reside in a malware hypervisor running
underneath the operating system, which thus remains untouched. It effectively
becomes a virtual machine. Blue
Pill is a conceptual example.
·
Kernel-based: A
program on the machine obtains root access to
hide itself in the OS and intercepts keystrokes that pass through the kernel.
This method is difficult both to write and to combat. Such keyloggers reside at
the kernel level, which makes them difficult
to detect, especially for user-mode applications that don't have root access.
They are frequently implemented as rootkits that
subvert the operating system kernel to gain unauthorized access to the hardware.
This makes them very powerful. A keylogger using this method can act as a
keyboard device driver, for example, and thus gain
access to any information typed on the keyboard as it goes to the operating
system.
·
API-based:
These keyloggers hook keyboard APIs inside a running
application. The keylogger registers keystroke events, as if it was a normal
piece of the application instead of malware. The keylogger receives an event
each time the user presses or releases a key. The keylogger simply records it.
·
Windows
APIs such as GetAsyncKeyState(), GetForegroundWindow(), etc. are used to poll the state
of the keyboard or to subscribe to keyboard events. A more recent example
simply polls the BIOS for
pre-boot authentication PINs that have not been cleared from
memory.
·
Form
grabbing based: Form grabbing-based
keyloggers log web formsubmissions by recording the web browsing on submit
events. This happens when the user completes a form and submits it, usually by
clicking a button or hitting enter. This type of keylogger records form data
before it is passed over the Internet.
·
Javascript-based: A
malicious script tag is injected into a targeted web page, and listens for key
events such as onKeyUp(). Scripts can be injected via a
variety of methods, including cross-site scripting, man-in-the-browser, man-in-the-middle, or a compromise of the
remote web site.
·
Memory
injection based: Memory Injection (MitB)-based keyloggers perform their logging
function by altering the memory tables associated with the browser and other
system functions. By patching the memory tables or injecting directly into
memory, this technique can be used by malware authors to bypass Windows UAC
(User Account Control). The Zeus and SpyEye trojans
use this method exclusively. Non-Windows systems have analogous protection
mechanisms that the keylogger must thwart.7 with an added feature that allows
access to locally recorded data from a remote location. Remote communication
may be achieved when one of these methods is used:
·
Data
is uploaded to a website, database or an FTP server.
·
Data
is periodically emailed to a pre-defined email address.
·
Data
is wirelessly transmitted
by means of an attached hardware system.
·
The
software enables a remote login to the local machine from the Internet or the
local network, for data logs stored on the target machine.
Software keyloggers
can be expanded with related features such as:
·
Clipboard
logging. Anything that has been copied to the clipboard can be captured by the program.
·
Screen
logging. Screenshots are taken to capture graphics-based
information. Applications with screen logging abilities may take screenshots of
the whole screen, of just one application, or even just around the mouse
cursor. They may take these screenshots periodically or in response to user behaviors
(for example, when a user clicks the mouse). A practical application that is
used by some keyloggers with this screen logging ability, is to take small
screenshots around where a mouse has just clicked; thus defeating web-based
keyboards (for example, the web-based screen keyboards that are often used by
banks), and any web-based on-screen keyboard without screenshot protection.
·
Programmatically
capturing the text in a control. The Microsoft
WindowsAPI allows programs
to request the text 'value' in some controls. This means that some passwords
may be captured, even if they are hidden behind password masks (usually
asterisks).
·
The
recording of every program/folder/window opened including a screenshot of each
and every website visited.
·
The
recording of search engines queries, instant
messenger conversations, FTP downloads and other Internet-based
activities (including the bandwidth used).
The other
type is:
Hardware-based keyloggers
Hardware-based
keyloggers do not depend upon any software being installed as they exist at a
hardware level in a computer system.
·
Firmware-based: BIOS-level firmware that
handles keyboard events can be modified to record these events as they are
processed. Physical and/or root-level
access is required to the machine, and the software loaded into
the BIOS needs to be created for the specific hardware that it will be running
on.
·
Keyboard
hardware: Hardware keyloggers are used for keystroke logging by means of a
hardware circuit that is attached somewhere in between the computer
keyboard and the computer, typically inline with the keyboard's
cable connector. There are also USB connectors based Hardware keyloggers
as well as ones for Laptop computers (the Mini-PCI card plugs into the
expansion slot of a laptop). More stealthy implementations can be installed or
built into standard keyboards, so that no device is visible on the external
cable. Both types log all keyboard activity to their internal memory,
which can be subsequently accessed, for example, by typing in a secret key
sequence. A hardware keylogger has an advantage over a software solution: it is
not dependent on being installed on the target computer's operating system and
therefore will not interfere with any program running on the target machine or
be detected by any software. However its physical presence may be
detected if, for example, it is installed outside the case as an inline device
between the computer and the keyboard. Some of these implementations have the
ability to be controlled and monitored remotely by means of a wireless
communication standard.
·
Wireless
keyboard and mouse sniffers: These passive sniffers collect packets of data
being transferred from a wireless keyboard and its receiver. As encryption may
be used to secure the wireless communications between the two devices, this may
need to be cracked beforehand if the transmissions are to be read. In some
cases this enables an attacker to type arbitrary commands into a victim’s
computer.
·
Keyboard
overlays: Criminals have been known to use keyboard overlays on ATMs to capture people's PINs. Each
keypress is registered by the keyboard of the ATM as well as the criminal's
keypad that is placed over it. The device is designed to look like an
integrated part of the machine so that bank customers are unaware of its
presence.
·
Acoustic
keyloggers: Acoustic cryptanalysis can be used to
monitor the sound created by someone typing on a computer. Each key on the
keyboard makes a subtly different acoustic signature when struck. It is then
possible to identify which keystroke signature relates to which keyboard
character via statistical methods such as frequency analysis. The repetition frequency of
similar acoustic keystroke signatures, the timings between different keyboard
strokes and other context information such as the probable language in which
the user is writing are used in this analysis to map sounds to letters. A
fairly long recording (1000 or more keystrokes) is required so that a big
enough sample is collected.
·
Optical
surveillance: Optical surveillance, while not a keylogger in the classical
sense, is nonetheless an approach that can be used to capture passwords or
PINs. A strategically placed camera, such as a hidden surveillance camera at an ATM, can allow a criminal to watch a PIN
or password being entered.
·
Physical
evidence: For a keypad that is used only to enter a security code, the keys
which are in actual use will have evidence of use from many fingerprints. A
passcode of four digits, if the four digits in question are known, is reduced
from 10,000 possibilities to just 24 possibilities (104 versus
4! (factorial of
4)). These could then be used on separate occasions for a manual "brute
force attack".
·
Smartphone
sensors: Researchers have demonstrated that it is possible to capture the
keystrokes of nearby computer keyboards using only the commodity accelerometer found
in smartphones. The attack is made possible by placing a smartphone near a
keyboard on the same desk. The smartphone's accelerometer can then detect the
vibrations created by typing on the keyboard, and then translate this raw
accelerometer signal into readable sentences with as much as 80 percent
accuracy. The technique involves working through probability by detecting pairs
of keystrokes, rather than individual keys. It models "keyboard
events" in pairs and then works out whether the pair of keys pressed is on
the left or the right side of the keyboard and whether they are close together
or far apart on the QWERTY keyboard. Once it has worked this out, it compares
the results to a preloaded dictionary where each word has been broken down in
the same way. Similar techniques have also been shown to be effective at
capturing keystrokes on touchscreen keyboards while in some cases, in
combination with gyroscope.
What countermeasures
can you take to protect yourself?
The effectiveness of countermeasures varies, because keyloggers
use a variety of techniques to capture data and the countermeasure needs to be
effective against the particular data capture technique. For example, an on-screen
keyboard will be effective against hardware keyloggers, transparency will
defeat some but not all screenloggers and an anti-spyware application
that can only disable hook-based keyloggers will be ineffective against
kernel-based keyloggers.
Also,
keylogger program authors may be able to update the code to adapt to
countermeasures that may have proven to be effective against them.
Anti
keyloggers
An anti keylogger is a piece of software specifically designed to detect keyloggers on a
computer, typically comparing all files in the computer against a database of
keyloggers looking for similarities which might signal the presence of a hidden
keylogger. As anti keyloggers have been designed specifically to detect
keyloggers, they have the potential to be more effective than conventional anti
virus software; some anti virus software does not consider a keylogger to be a
virus, as under some circumstances a keylogger can be considered a legitimate
piece of software.
Comments
Post a Comment