Hot answers tagged

80

Because it wouldn't help. Most keyloggers are installed at the operating-system level, and the operating system needs to have access to the keystrokes. Alt-Tab program switching, using Ctrl-Alt-Del to terminate malfunctioning programs, and detecting keyboard activity to keep your screensaver from activating all require the OS to see keystrokes. There's ...


56

Many applications make futile attempt to foil keyloggers and spyware by using convoluted (and cumbersome) password entry methods. None work against keyloggers and many actually cause users to be LESS secure because they make it hard to use password managers. The best way to handle that kind of things is to use one-time passwords. There are several ways to ...


55

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can delete these data, send these data to somebody else etc. Moreover it can make screenshots, control other applications running on the same X windows screen (even ...


48

This would greatly depend on the implementation of the keylogger. Some enterprise-level products do include rootkits which make the keylogger nearly impossible to detect, unless you know the product in use and its configuration. For an example, check out Spector Pro*. Also, as syneticon-dj notes, it's possible they may instead be using a hardware ...


45

if you do not trust the medium: do not enter sensitive information. typing in your password in some obscure way is just that: security through obscurity, which never works. other than that: you might be able to achieve some level of security in such open places if the password you entered changes for the next login, see one-time-passwords. (note: '2-factor-...


44

These kinds of password entry systems are only good as long as the attackers do not adapt. It is a play in several acts: Bank Web sites use passwords which are entered the traditional way, with a keyboard. Key loggers appear, and harvest key strokes. After some cases of actual bank password theft, banks adapt. They implement "visual keyboards" in which the ...


35

RedGrittyBrick is right. Here's how it would work: Keylogger is on host machine: even VM sessions will be keylogged. Keylogger is on virtual machine: only VM will be keylogged unless it escapes the VM. Keylogger is hardware-based: same as #1: everything can be captured, but this includes things even outside of the main operating system, as long as it's ...


33

It is possible for malware to persist across a re-format and re-install, if it is sufficiently ingenious and sophisticated: e.g., it can persist in the bios, in the firmware for peripherals (some hardware devices have firmware that can be updated, and thus could be updated with malicious firmware), or with a virus infecting data files on removable storage or ...


31

The keyboard to application interface goes through several phases, some of which the OS has little control, and some that is provides explicit hooks into for additional functionality. The basic design goes like this: hardware events are received by driver chains, which then pass messages to the kernel, that then dispatches it to a global hotkey chain, and ...


31

A hardware keylogger will obviously capture anything typed on the keyboard it is attached to. So that includes keystrokes that are forwarded to a VM. I would expect a software keylogger running on the host system should also capture anything typed on the local keyboard before it gets to any VM A software keylogger running in a VM would capture keystrokes ...


31

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: Running on a low-privilege account (aka "principle of least privilege") should be part of a balanced breakfast which also includes good firewall configurations; ...


30

Malicious software that only logs keyboard strokes rarely exists in the wild. Most key loggers for graphical interfaces (e.g. Windows) are more sophisticated and log all user interaction including mouse, copy and paste events by hooking into the operating system. Key loggers are normally a small subset of a rootkit that may also include the ability to act ...


27

"Secure Keyboard Entry" maps to the EnableSecureEventInput function whose concept is described here. Basically, applications don't access the hardware themselves; they obtain events (e.g. about key strokes) from the operating system. Some elements in the OS decides what application gets what events, depending on its access rights and GUI state (there are ...


26

Nope. Keyloggers can often also do screen-capturing and mouse-coordinate-logging. So the attacker can still see what image the user selects. Another kind of two-factor authentication for which the user needs two devices (e.g. laptop and phone) would be more secure. Another good alternative is a Yubikey. A kind of device which generates a pseudo-random ...


25

It is definitely possible for a slightly sophisticated attacker to leave malware outside the direct reach of the operating system. Reinstalling the operating system means a disk wipe at most. Even there, you need to be careful if you restore any data that may have been compromised. Malware can be stored in one of the many rewritable memories that lurk in ...


23

The reason this isn't done by default is because the previous-generation operating system design didn't have a huge focus on sandboxing and the like, so right now it would require big architectural changes to make such changes work. Mark touches upon those to some extent in his answer, but it boils down to that you can't allow applications to blindly run ...


20

If you can't be sure that your keystrokes aren't captured (and you can't), use any sort of two factor authentication. Make sure your password isn't useful by itself! The only way to be sure that your data is secure is to avoid entering "everything" into the suspicious machine. Given that keyloggers are your only concern (i.e. no sophisticated tracking ...


17

I can see two ways: Use some virtual keyboard solution. You can type your password with mouse-clicks, it will avoid keyboard logger (but may not avoid mouse-click based logger). However, it would be one level of security. You would just type a wrong password into the password box, select it with the mouse (replacing the wrong keys with the true); type the ...


16

The graphical entry of passwords is initially an attempt to thwart keyloggers. When such things began to appear, keyloggers naturally evolved (the people who write keyloggers have not stopped developing them; they adapt to new conditions) and modern keyloggers are also mouseloggers which record, for each click, a partial snapshot of the screen (a small area ...


16

If you were dealing with keyloggers in isolation, then it might be possible to mitigate the risk (e.g. using on-screen keyboards, 2FA or similar), however if an attacker has the ability to install a keystroke logger on the system it is very likely (apart from physical keystroke loggers) that they have privileged access to the system in question and as such ...


15

There several threats you are dealing with; but fundamentally what you are asking -- using potentially malicious hardware -- is unsafe and should be avoided for sensitive purposes. (E.g., try not to check into your bank account on vacation). However, if you are willing to take that risk but want to minimize it, here are your threats: Hardware keyloggers. ...


15

The keylogger looks to be sending email using Gmail but the SMTP communication is encrypted with TLS (SSL). Simple Mail Transfer Protocol Command Line: STARTTLS\r\n Command: STAR Request parameter: TLS Simple Mail Transfer Protocol Response: 220 2.0.0 Ready to start TLS\r\n Response code: <domain> Service ready (220) ...


14

Create GMail account with no 2 step authorization (not from friend' laptop). Log in with you friend' laptop into GMail web interface (type username/pass manually). Create new mail with subj some reports from %companyname%, attach some dummy .docs and .pdfs, type "dave123@another-company-in-your-field.com" in "To:" field. Click "Send". Enable 2 step ...


14

No, anti-malware packages will not detect every form of keylogger. They will detect known ones by hashing, and some may detect certain keylogger-like behaviour via heuristic analysis. However, I strongly advise you against this. First off, it's insulting to your employees. If I found out my employer was doing such a thing, I'd resign on the spot. Secondly, ...


14

A lot of keyloggers are smart enough to catch this. Not only do they log the keys being physically pressed, but they also log the contents of password boxes whenever window messages are processed, or when browser forms are posted. They also often capture small blocks of the screen around the mouse cursor, to catch cases like this.


14

Such protection mechanism you're describing could possibly be exploited by the IE mouse tracking flaw, an Internet Explorer vulnerability that allows an attacker to track your mouse cursor anywhere on the screen, even if the browser is not being actively used, and to me seems such password protection would be more at risk of being compromised than your ...


14

You can't ever be safe on hardware you don't control. A hardware keylogger could be mounted inside the chassis where you could not see it, or remove it. A software keylogger may not be detectable by any app that you could run (if you had enough user privileges to run any app). Network monitoring and sniffing of your web traffic would be completely ...


13

I was wondering exactly how powerful can keyloggers be? Extremely powerful. But the use of the term keylogger can be distracting so lets explore what a keylogger is. Back many decades ago computers had very small hard drives and little RAM, but lots of various cables and assorted adapters. The keyboard was connected to the computer tower with a 5-pin ...


13

Carrier IQ is a rootkit previously installed by mobile phone operators on Android and on iOS 4 iPhones. It is capable of recording every keystroke on your virtual keyboard. See What risk does Carrier IQ pose, exactly?



Only top voted, non community-wiki answers of a minimum length are eligible