New answers tagged

1

In order to qualify as social engineering, the victim must actively participate in the ruse of their own free will, usually by the attacker gaining the user's trust and then exploiting it. Installing a key-logger directly is simply a successful security penetration, as is getting the victim's password off a Post-It note that's stuck to their monitor. ...


3

but what of the case where an adversary has gained access to a machine over a network and installed keylogger software on the target machine. This is not social engineering. You are describing the outcome of an attack: an attacker gains access to a machine an put a keylogger. You are describing what happened. However, social engineering is not an ...


1

Would BD Safepay avoid this problem with its enforced virtual keyboard ? Not completely: It would mean that actual keyloggers would no longer be able to intercept your keystrokes. In fact, this is why some banks require you to enter your password by clicking on-screen buttons. However, keyloggers have adapted, and some have also become "mouseloggers", ...


-1

All purely conjecture, but I'm fairly convinced this method of audio analysis fingerprinting does not work in real life. In the ocean for subs yes but keys probably not. The initial attack of the audio signal from a mechanical keyboard is pretty loud, so it would be fairly difficult to mask.Systems that mask 40db SPL to 80db SPL for ambient sounds would not ...


2

You could for instance get the person to use such programs as language apps to get an acoustic fingerprint of the sets of letters. Just imagine the permutations of 'a quick brown fox jumps over the lazy dog'. A frequency analysis on the frequencies could provide letter to key sound mapping. In which case you could mitigate this by switching between dvorak, ...


3

In my opinion acoustic cryptanalysis is more of a proof of concept then to be used in real applications. What is possible to do? A few years ago guys from MIT (if I am not wrong) were able to log every keys on a mechanical keyboard using an Android/IOS phone application and just by placing that specific phone near the keyboard. Things you can do to ...


2

Xterm does not allow isolation unless you set it to run as another user, in another tty. Gksu and Gksudo do not provide any sort of isolation at all. The same applies to all other password entry utilities, like kdesu/kdesudo, pinentry, etc. They are regular windows, like any others. Wayland supports isolating Windows, but only for applications which support ...


16

If you were dealing with keyloggers in isolation, then it might be possible to mitigate the risk (e.g. using on-screen keyboards, 2FA or similar), however if an attacker has the ability to install a keystroke logger on the system it is very likely (apart from physical keystroke loggers) that they have privileged access to the system in question and as such ...


5

JavaScript cannot control low system calls and change them to get that keystroke interference. Even user-mode software protections are defeated by kernel-mode keylogging. You can protect against hardware keyloggers by having an onscreen keyboard, which can be easily implemented. Software keyloggers are more powerful. Smart banking trojans also capture HTTP ...


0

If you are concerned about keyloggers that log key strokes (manual password entry) or copy/paste (password manager) then you have to use the mouse: Show the user a virtual keyboard to enter the password. This is really not very user-friendly and hard to set up for global usage (regional differences in the keyboard layout). I would still let the ...


56

Many applications make futile attempt to foil keyloggers and spyware by using convoluted (and cumbersome) password entry methods. None work against keyloggers and many actually cause users to be LESS secure because they make it hard to use password managers. The best way to handle that kind of things is to use one-time passwords. There are several ways to ...


0

While flagging another question as duplicated, I was also writing the reply, so I'll leave this here just in case is useful for someone: To be realistic, that will get rid of mostly all kind of malware. But. < paranoid mode > Bootkits: https://macpablodesigns.wordpress.com/2009/10/01/bootkits-what-is-bootkit-and-why-should-it-concern-you/ ...



Top 50 recent answers are included