Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung. While Task Manager is open and visible and sorted by CPU usage, I pick up the windows of one of the instances and drag it around quickly. The CPU usage on one of the processes goes up, presumably as that process' paint message is rapidly called (assuming your system does "Show window contents while dragging").

Today I wondered if my system has a keylogger. I imagined a hardware keylogger and thought there might be some way to detect it without dismantling my computer, but the search hits I got were mostly for software keyloggers and using anti-Malware software to detect it. But if you activate Windows Task Manager and then just hit lots of keys on the keyboard (gently!), then any process that is recording them would presumably start using some CPU. I wondered if it would use enough CPU to bring it to the top. When I try it, I can get dwm.exe and csrss.exe and taskhost.exe to come up. I think this shows that it is possible to use this method to find a process that is watching the keyboard, but it takes some discernment.

Does this seem plausible, and is this technique one that is resilient to camouflage methods that malware authors might take?

share|improve this question
    
You asked about a hardware keylogger; by definition a hardware keylogger has an independent CPU and an independent process table. Suggest you modify the question to ask about software keyloggers. –  Mark C. Wallace Dec 3 '12 at 12:14
add comment

2 Answers

Completely useless against anything but the university project of a computer security student.

You can make processes appear another process's name or not at all without too much difficulty. Also you can get hardware key loggers which can take the raw signal from your keyboard and store it to a memory stick or broadcast it over wifi.

share|improve this answer
1  
You must have a pretty dim view of university students. –  lynks Dec 3 '12 at 18:57
add comment

Efficient malware will manipulate the kernel internal structure so as not to appear at all in the list of process (then again, a hide-and-seek game between malware and malware detectors; see for instance this page for some information). Thus, you will not see anything in the task manager.

Even if the keylogger does appear as a task in the task manager, key logging, in its basic forms, is extremely inexpensive. My first computer could keep track of all I typed with its 6809E CPU, running at the blazing speed of 1 MHz. A basic PC is more than 10000 times faster than that, and will thus need no more than 1/10000th of its CPU to log key strokes. To see that in the task manager, you will need sharp eyes... To complicate the setup, there are a lot of process which exhibit some regular activity even when nominally idle; this is typical of process with background garbage collection activity.

And, of course, when you look at the task manager, you observe, among the list of process, the task manager itself, which uses CPU to update the list as graphically rendered on the screen...

share|improve this answer
    
Agreed - there are a lot of better ways to find such activity. As a good example of how little CPU this will need - I can stream 1080p video over my WiFi and display it at full resolution (whilst decoding it from H.264) and use only ~15% of my CPU's entire throughput. I hardly think saving a few ASCII characters to disk will reach enough cycles to make Task Manager display even 1% for the process. –  Polynomial Dec 2 '12 at 23:43
    
Yeah, would be better to look for IO on network or the filesystem (depending if it saves it to a log or sends it straight out, and it would still be very hard to detect the increase). –  ewanm89 Dec 3 '12 at 0:29
    
@ewanm89 Agreed, and at that point why not just use Wireshark and tcpview? :) –  Polynomial Dec 3 '12 at 9:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.