Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm curious to what are the possible solutions to defending against a comprised computer with a key logger installed. Assume you had to login to a site with a user / password and there's no way to disable the keylogger. What would one do to throw off the keylogger even if it recorded all your key strokes.
Some possible solutions come to mind is doing copy and paste instead of typing.
... presumably creating a file with the password on another machine and transfering via network or hot pluggable storage device. As Aria says, this doesn't protect you against something which can read the clipboard.
An on screen keyboard works around the problem in a different way - but if the logger is intercepting the key events in the gui, then no benefit.
Another option would be to proxy the connection (assuming the password is for a remote service) and inject the real password on the proxy - but this would require access to the server encryption key if the connection uses pinned keys.
One time passwords would seem to meet your requirement.
Whatever....passwords have no intrinsic value. They are critically important as a means for protecting assets with value. I.e. if you know the machine is compromised, then how can you be certain that the asset is adequately secured after authentication?
I have seen keyloggers be defeated (sort of) by typing characters out of order by moving the cursor around using the mouse. The keylogger will get all the characters you used but if it is long enough it will not be enough to crack it. The funny thing is if I knew that I was working on a compromised machine I would feed them misinformation, try to track them and hack them back/DDOS them rather than just try to protect myself.
Defend against a compromised computer? You can't.
If a system is compromised it is by it's very nature, lost. I believe that the terminology you mean is how would you recover from this type of attack?
Best practice? Wipe the system. Start Again. With an attack as advanced as that, you've no way of really determining the depth of system penetration without performing extensive analysis and forensics.
EDIT:
Response to comment:
Let's assume you have no choice but to login to your account at some service and you know for a fact the computer is compromised with a keylogger. What would you do? Wiping the system in this scenario is not an option
One method you could try is booting up the System using a live image of some kind (Ubuntu perhaps?). Assuming that the keylogger that is on the system is written for a windows machine (higher statistical probability that this is the case) booting into a live image would bypass any of your system files from being loaded into memory (keylogger would never be launched) . You could use this method to remove the keylogger from your original system, or just straight up use the browser on the live image to login to whatever service that you need to do.
Of course this method would depend on what level the keylogger is being executed. This method assumes that it is being lauched at the Operating System level.
If the system is compromised with key logger abd who knows what other malware you destroy it. Possibly you can drives/volumes and Very Carefully look at them on a clean machine. But this is useful for studying the attack not for cleaning it up as you can never confidently give them a clean bill of health.
If you must right now take a risk of logging in to a compromised machine, you can try smoke screens as suggeted in another answer, moving curser around etc. This may help against simple fully automated keyloggers. However a human looking at the log may be able to extract more information. Also keyloggers may not be the only malware and if it is aware of your password field it could take the password out from the password field and not from the keylogger.
The best recommendation is if you must log in you should replace your credentials shortly after from a trusted machine. If you can't do so promptly (likely since you felt the need to use the compromised machine to begin with) you can try to lock yourself out. Possibility by emailing or calling a system administrator and have her lock your account. Thus minimizing the timewindow for using stolen credentials.
After a compromised machine is identified you want to try and figure out what possibly could have been stolen and invalidate any possibly exposed credentials. And look for signs of latteral movement.
The idea that you can defeat some mysterious, invisible key-logging opponent with copy/paste, mouse clicks, back-spaces, and all that kind of key-dancing is ridiculous. You would have zero way of knowing exactly what kind of data is being logged, how it's being logged, etc. Having written key-interception hooks myself (for legitimate reasons), I know it's trivial to record all Windows messages. Do not trust that an attacker wouldn't learn everything you enter.
Instead of imagining you're dealing with a key logger, you should suspect the whole machine has been compromised. Dealing with a compromised system is pretty much the same, regardless of what kind of compromise it is.
Assuming this is your computer, take it off line immediately. Unplug the network cable, disable the wireless card. Do not let the machine reconnect to the Internet until after you've neutralized the malware.
If you've ever entered your credit card info into this machine, contact your bank's "lost or stolen card department" and tell them what's happened. Do this immediately and request a new credit card now. You don't know if the data leaked, but you should take no chances.
Assuming you've used the compromised machine to enter credentials to log into web sites or other places, you'll need to change those passwords now. Use a new, trustworthy machine to log in and change your passwords. This would be a good opportunity to obtain and use a password manager.
Make an inventory of the data on the compromised machine, and use a USB mass storage device to back it up. Be careful if you back up any programs, as they might carry infections - if possible, plan to download new copies from the Internet. Also, see if there's a way to back up any software licenses (Office, Windows, etc.) Consider bringing your machine to a professional dewormer, who might have a way of preserving the machine without losing those licenses.
If you suspect that your credit card was misused, this is the time to consider contacting your local authorities and reporting the attack. Theft by computer is a crime, and they should treat it as such. But don't expect much from them - they might not have a competent digital forensic analyst; they might not consider your problem important enough to investigate; or they may want to place your case in a queue where your computer will sit in an evidence locker for six months.
If you're still handling the compromise yourself, it's time to reimage the machine. DBAN is a good tool to use to thoroughly wipe your hard drive; but be aware that it will destroy any 'recovery partitions'. That's good for your security, because you don't know if they were compromised by the attacker; but it might make recovery hard if you no longer have an installable OS image. You'll also lose any licenses you may have had stored on the machine; this is where having backed them up is critical, and why I recommend using a professional.
There is very little an end user can do to hide their keystrokes, but here are some "proven" methods I have used in the past:
On screen keyboard
Depending on how the keylogger was implemented, using the accessibility feature built into windows can work quite well. Because the virtual keyboard is implemented with it's own separate device driver, a keylogger may fail to pick up any keys pressed.
This method is quite dated, and has surely been "rained in" by malware authors.
Keepass's Autotype Obfuscation
Instead of just typing the username and password out, Keepass has a novel feature. It's called Autotype Obfuscation, which in effect makes it much harder to figure out a credential pair.
It does this by combining the use of the clipboard, direct entry (virtual key-presses), and shifting the entry of each part of the credential pair.
Read more: https://keepass.info/help/v2/autotype_obfuscation.html
Use of a User/Kernel Mode Rootkit
I will go out on a limb here with the rootkit suggestion, but do bare with me.
If the keylogger is a user-mode/user-space program, one could intercept calls the keylogger makes, and either return false or invalid data. I currently do this to prevent the copying/opening of files from within Microsoft Office products.
Depending on how the keylogger was implemented it would not be very difficult to do the same, except with intercepting a different call. If the keylogger used low level direct system calls, this would require the use of a kernel mode rootkit, and a lot more work.
