Is it possible for a foreign entity to get a keylogger on your computer without physical access? Thinking of security of never-saved local passwords.
2 Answers
Key loggers can be inserted on to a system via a wide range of attack vectors. Not all are reliant on physical access - although some are.
Keyloggers are generally broken down into two main categories - Hardware Based, and Software Based. Those each have sub-categories of their own based on where the keylogger resides on the system, or the methods it uses to track key presses.
Those that are reliant on physical access can arguably be harder to trace, depending on the physical security of the location. For example, you may be able to detect that a keylogger was used, however if the physical access to the site cannot be monitored through cameras or other physical security measures then once the keylogger is collected there is little to track the attacker on.
Whereas those that do not require physical access to the machine will usually 'dial home' and send their information back to the attacker. This could leave a bigger trail of breadcrumbs to trace the attacker down but has the benefit of all being performed without physical access to the infected device.
Attack vectors for non-physical keyloggers include but aren't limited to having the user open an email attachment that contains the payload, gaining control of a users WiFi session and sending them to a fraudulent website that will serve up the payload, or even distributing them via online advertisements. There are simply too many ways to serve up a keylogger to a system to have it listed here.
The following Wiki breaks things down quite well: https://en.wikipedia.org/wiki/Keystroke_logging
Sure. The simplest example I can think of is to send you a keylogger app as attachment to an email and you just happen to double click it.
