How do hackers deploy keyloggers?

Question

I know the use of keyloggers. What I wish to know is how a hacker can install the keylogger onto the victim's system? If it can be done by XSS then to where this keylogger is actually installed (I mean to the client system or browser or somewhere else)? And also how the response of keyboard press reaches the attacker?

Answer 1

Keyloggers are usually programs which run in background on the users operating system. There are lots of ways to install these on the users machine. Some examples are:

1. The attacker learns about a vulnerability in the victims web browser which allows to download and install arbitrary programs from the web, and then tricks them into visiting a website they set up to abuse that vulnerability ("drive-by download").
2. The attacker sends them an executable file which installs the keylogger when executed, and then tricks them into executing it. Common methods do this is through email attachments which masquerade as documents (invoice.pdf.exe) or by masquerading the program as a legitimate installer for another software. It's not difficult to create an installer which pretends to install, say, Mozilla Firefox (and maybe even does this), but also installs other software without the user noticing.
3. Speaking of vulnerabilities: An attacker could also combine methods 1 and 2 and send them an actual document file which is crafted to exploit a vulnerability in the program they use to view it.
4. The attacker could put it on an USB device which installs the keylogger when connected to a computer. They then place that device where the victim will find it, hoping that they are curious about the content and connect it to the target machine.
5. Get physical access to the machine and install it the normal way

About how to get the data from the keylogger back to the attacker: Many keyloggers will use the internet to contact the hacker and send them their logfiles. There are many different protocols and techniques which can be used for this to improve stealth and traceability in this case, and listing them all would go too far.

Answer 2

In addition to the informative answer of Philipp.

Key Loggers are highly appreciated by attackers, this is the gold to watch for. Many advances have been made, up to replacing a keyboard with a 'tapped' keyboard or even have a 'tapped' mouse put in place.

More advanced are almost 'invisible' devices which proxy the data using bluetooth. The frustrating thing about keyloggers is the code required to execute them is almost insanely small, the hardware required to run them is also.

--- added after a comment from Shantnu

The question itself is generic, there are hundreds if not thousands of key loggers. The mention of XSS is also self-containing the answer(s)

1. yes, an xss can be used to install a keylogger on your system. It would download a component to facilitate the injection of the keylogger into your browser or your operating system or any other vulnerable component able to detect.

2. yes, an XSS can cause a keylogger to be dropped on the server as well, though this would mean for it to be targeted.

Communicating with 'home' would most likely happen by contacting a command-and-control server, by sending instant messaging messages, sending e-mails even by sending special icmp request. Many ways exist. In case a keylogger has been 'dropped' on a server i could simply log into a text file which would be available to any visitor who knows the address.