Is it possible to login on an machine with keylogger installed without compromising your password?

Question

Suppose a scenario in which you have to login to a public/friends pc which has a keylogger installed. You need to login from that pc. Will it be possible to escape compromising your passwords if you know in advance that the machine is infected.

Taking into account that different keyloggers have different functionalities, still I think it must be possible to reduce the probability of password being compromised or at least making it more difficult to decode the password. Some naive thoughts that come to my mind for achieving this are:

1. Inputting wrong password and then using backspace key in combination with mouse clicks to make it correct.
2. Inputting half of password using step1 and half password using virtual keyboard..
3. Keeping a pendrive, and using it to executing a script to enter password, thus implementing keepass like functionality..

I think that using these points might be helpful to some extent.

What do you think we can do to reduce the chances of being getting compromised?

Answer 1

Most OS's provide some facility to provide user input to an application. This functionality is part of what will get hooked in any decent keylogger and so any means of creating input to the program will likely end up being picked up. This is true whether you use scripts, on-screen keyboards or the physical keyboard itself.

Now, a little good news, some OSes, including Windows when UAC is on, will not share keypresses with non-admin processes, however, if the key logger is running as an admin program, all bets are off.

Short of direct memory injection, you aren't going to be able to get information in to a program without going through the input channels provided by the OS and that's exactly what keyloggers are designed to monitor and pull data from.

Unfortunately, there are actually some pretty good usability reasons to maintain this kind of functionality (such as enabling background processes to respond to shortcut combinations) so it isn't likely to go away any time in the near future. This is part of what makes protecting against key loggers so difficult.

That said, as long as it isn't also logging mouse clicks and positions then you can do some things to confuse it. Making a series of mouse selections to remove content from the string and filling it in will help obscure it a bit, but I still wouldn't advise using it as a protection as it greatly limits the number of possible passwords so brute forcing becomes much more likely.

The best bet is really to change your password to something you can discard and login with that, if you don't want to burn your current password. If you aren't domain connected, you can also back up the user profile files, reset them to something else (this will lock all encrypted files, but that's why you have a backup of your user profile), and then login with the reset password on the new profile. If you have an account recovery disk, using that may also be an option as I believe that does a direct input that would bypass the keypress system. (This is, of course, assuming you are on Windows.)

Answer 2

1. Go on your phone and change your password to a random one
2. Login on the compromised PC using the random password
3. On your phone change the random password back to your normal one

Answer 3

Don't worry about keyloggers. Keyloggers are not the problem.

Logging in to your account on a compromised machine is dangerous beyond just losing your password. Local malware can (and frequently does) perform activity on your account that isn't visible to you as you look at the screen. The attacker doesn't need your password or your second factor token because you're already logged in. Whatever you were afraid of bad guys doing offline at some point in the future, they can do right there and then, no keystroke logging involved.

So no; worrying about keyloggers is solving the wrong problem. If you're concerned about your account safety on a given machine, then don't use it, plain and simple, no way around it.

Answer 4

There are two main types of keylogger - physical and software based. In both cases I would argue without full knowledge of exactly how the logger works there is no way to know with certainty you are safe.

How do you know you can trust the rest of the software on the machine? How do you know it isn't also recording all other input? Or even just intercepting it between being entered and the hash being calculated? It could also be implemented in a hypervisor loaded by bios under the operating system - in which case running your own OS would not work.

For hardware based there is a similar issue. The immediate answer is "use your own keyboard" - but what if the logger is between the USB ports and the motherboard? If it controlled all USB ports on the machine it could record mouse, keyboard and fully copy any removable media plugged in - which renders your script approach useless.

Answer 5

Most key loggers are just that: they eavesdrop on the keyboard, so on Windows box an easy workaround would be to activate the on-screen keyboard to input your password (use Win+U to open the accessibility settings).

Of course if you're not certain you don't have a nasty one that do a screen capture each time you click on your mouse you should go back to a fail-proof method like booting from an USB stick.