6

Most trojaning, spyware and keylogger tools have the ability to take screenshots. Is there a way to detect if an app or software is taking a screenshot in Windows? Maybe a Windows API call or dll?

This would be helpful for finding malware.

8
  • 7
    Why would it be helpful for finding malware? I don't know Windows architecture that well, but if there was an API which caught "screenshot" events, and I was a malware author wanting to make screenshots, I'd be intercepting that call! – Matthew Jun 8 '16 at 7:55
  • Damn Matthew with the quick slay... I would assume that high protective applications, like anti-malware/AV would protect against this kind of threat, so I would assume there are many other applications that could defeat the Malware's "hijacking" with their own hijacking or something similar? Also, it might be possible to find screen-shots in the Log/Event-Viewer of Windows. We could assume Malware is able to mess with logs/events as well. I do think that being able to BLOCK screen shots would be important, to stop these apps, but aren't keyloggers for keystrokes? – XaolingBao Jun 8 '16 at 8:14
  • @Matthew I'm not talking about the normal Screenshot shortcut. It's rather screenshots by apps. Most keyloggers I experimented with take Screenshots for every few seconds or minutes. – user76223 Jun 8 '16 at 8:14
  • @Wally Yes, I know. Either it uses a standard method (if one exists), in which case you can intercept it (but so can they), or it uses a non-standard method, in which case it wouldn't trigger such an API. It's even possible to have a programmatic trigger sending a key press of the PrtScn button. – Matthew Jun 8 '16 at 8:22
  • 1
    Used to be you could trivially take a screenshot by making a borderless no-background fullscreen window with an OpenGL context (almost guaranteed that it works with D3D too) and read back the window's pixels without clearing first. Probably still works 10 years later, why wouldn't it. How do you want to prevent someone from doing that? It's entirely legal to read back the buffer, and it doesn't use any API that is in some way "restricted" or "shady" or that needs elevation or special rights. – Damon Jun 8 '16 at 8:34
1

My answer would require writing some code. I'm only posting this answer because you mentioned a programming related solution in your question.

Ever since Window Vista, the windows kernel raises an event for basically every single thing that happens on your computer. Microsoft provides a library called TraceEvent for .NET that makes it absolutely trivial to hook into these events.

For detecting a screenshot, you could monitor memory write events, file write events and so on. You can also hook into notifications for socket IO and the like. You can do all of this in around 30 lines of code.

From there, depending on how invasive and thorough you want to be, you could do a number of things. You could hook calls in the unknown processes such as Winsock's send function, and wind up scraping a copy of all data that the process writes to a socket, and check it. You could look for a JPEG or PNG header in scraped data and fire off the alarm bells if you find one. You could open and analyze files it writes, etc.

It's at this point that things can get complicated, but you could probably hook the send function with a library like EasyHook with a hundred or so LOC.

Another approach would be look at what libraries/WinAPI functions such an application would need to load to perform this function. You can detect when a process starts and when it loads an assembly (.dll) with these kernel events, so you could just look for the right (or wrong) combination of loaded assemblies. You could automatically hook WinAPI or OpenGL or DirectX functions that provide screen capture capability in every process that starts up, and directly monitor when applications access these capabilities.

For more information about this general approach you can see my other answer here.

I'd like to make it clear that the only thing I'm advertising as being easy is the process of hooking right into the heart of the OS and getting notifications about things happening. The art of correctly using this data to effectively catch malicious code is a much, much more difficult task.

0

You can detect it by monitoring free space (very easy) or file writes (not that easy). The screenshots must be stored somewhere so files will have to stack up to a not-so-obvious location.

This is the method I used, and I managed to locate and eliminate a multi-logger just by using a simple file manager.

8
  • 3
    What if it stores the screenshot in memory, sends it to a server and clears it from memory, all within less than a 0.1s? And what if the screenshot quality is deliberately small and poor, such that a screen cap requires only a few kilobytes of space? – Potaito Jun 8 '16 at 8:33
  • Well, they could technically create a temp image of the screen shot, upload it to their servers and deleted it after upload... or even take a screen shot, and send the stream directly to the server, without saving the file at all. Interesting that you were able to find something just by checking out space. – XaolingBao Jun 8 '16 at 8:33
  • It's very unlikely to happen like that. Usually, the link-ups are made quick and well packed data are sent in a shot interval. Continuously transmitting is not at all a good way to hide. – Overmind Jun 8 '16 at 8:37
  • Well, how often does the screen shot get sent to the server is the question, but you could store it in memory, and just stream it up when needed, but that might alert that there's an application using a decent amount of space, especially since screen-shots of bigger monitors BIG, unless the quality is crapped out, but you could also save a much smaller version of the image and get a much smaller sized file/stream. Idk how these applications work, but this is my thoughts. – XaolingBao Jun 8 '16 at 8:42
  • 1
    "Monitoring free space (very easy)" - really? Would malware author rely to storing the catch in incrementally growing disk space area, maybe even separate files? Not preallocate and obfuscate a file or even cache the data in free space? – techraf Jun 8 '16 at 9:58