Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to know if someone can log my keystrokes if i am on a virtual machine. Is it more secure to use a computer or a virtual machine on that computer.

share|improve this question
2  
Best two-liner question in months. Congratulations. – Mindwin Jan 5 at 12:39
1  
It might be a bit more secure if you're using a virtual keyboard inside the VM, but I wouldn't say there's a practical difference. Untrusted host can dump memory, take screenshots and do plenty of other things. – Dmitry Grigoryev Jan 5 at 12:39
up vote 35 down vote accepted

RedGrittyBrick is right.

Here's how it would work:

  1. Keylogger is on host machine: even VM sessions will be keylogged.
  2. Keylogger is on virtual machine: only VM will be keylogged unless it escapes the VM.
  3. Keylogger is hardware-based: same as #1: everything can be captured, but this includes things even outside of the main operating system, as long as it's all going to the hardware. This means anything on your machine, including BIOS passwords, boot passwords, disk encryption, etc.
share|improve this answer
1  
ok, thanks, i wondered how the scope of it works. – user30102967 Jan 4 at 16:22
2  
I think the answer is stronger if you add an example for #3. Maybe BIOS boot passwords? – Neil Smithline Jan 4 at 18:49
1  
@NeilSmithline Agreed, I should word it better. Updated. – Mark Buffalo Jan 4 at 18:50

A hardware keylogger will obviously capture anything typed on the keyboard it is attached to. So that includes keystrokes that are forwarded to a VM.

I would expect a software keylogger running on the host system should also capture anything typed on the local keyboard before it gets to any VM

A software keylogger running in a VM would capture keystrokes from the virtual keyboard presented by the host, so it would not capture keystrokes consumed by the host nor keystrokes forwarded to other VMs.

Keyloggers do not capture keystrokes generated remotely and transmitted to the computer hosting the keylogger by network protocols similar to SSH.

Whether host-end keyloggers can capture keystrokes from remote-desktop clients (e.g. RDP) presumably depends on details of the implementation of the remote desktop service and of the keylogger.

share|improve this answer
    
What if he was using a virtual keyboard? – Ulkoma Jan 4 at 19:20
    
@Ulkoma: I have extended my answer to try to cover your question. – RedGrittyBrick Jan 4 at 19:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.