I am making a PC application with authentication. It is using a salted encryption and works well safety wise. Still my main concern now is with keyloggers. So I thought that maybe I could solve (in a very primitive way) this problem.

I thought that the best way to do so would be to make the application simulate itself as the keyboard and type random characters alongside the user's password. I know it is a long shot but I just can't see why it wouldn't work. (I am talking about software keyloggers, not hardware.)

Can I fool a keylogger by simulating key presses with an app?

  • 1
    most keyloggers attach to the keyboard buffer, which means they will get the characters before your app does
    – schroeder
    Mar 10 '17 at 10:42
  • @schroeder and wouldnt be possible to make an app that interacts with the buffer as well? i mean fool the computer into thinking they were physically typed?
    – PeterKima
    Mar 10 '17 at 14:42

Depending on the OS, it may be trivial for the keylogger to distinguish different input sources and filter out your random characters. And even if that's not the case, there are many places aside from the keyboard where a decent trojan will be looking for passwords, like RAM contents and screenshots.

Aside from that, your method will only work if you introduce lots of random characters. Let's assume the keylogger has captured a sequence of N characters corresponding to M characters of the password and N-M random characters added by your method. Assuming M is known, there are C(N,M) possible passwords for the attacker to try. For example, if the keylogger has captured 16 characters and the password is known to be 8 character long, the attacker will discover the right password in

C(16,8) = 12870 attempts

If the password length is not known, the attacker could simply iterate through different possible values. For example if in the example above the password is known to be between 8 and 16 characters, the attacker will have to try out 39203 possible passwords.

Only when you add about 250 random characters to your 8 character password, the difficulty of cracking the keylogger data becomes equal to brute forcing an alphanumeric password. At this point, you should make sure you have a good random characters generator, because these 250 characters could be enough to crack the trivial ones.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.