1

I'm connecting to a remote machine via Teamviewer, let's assume it's trusted. Is it possible for a MITM or virus on my local (client) machine to detect keys I enter using my remote machine's on-screen keyboard? Or would that involve continuous screen capture (something I assume would degrade performance to the point of being eventually noticeable, and thus low efficacy for my hacker)?

Any surefire ideas for testing this would be appreciated.

  • I just want to point out that the premise may not be correct. Simply running basic image recognition on a low-resolution, low-framerate video to detect the keys being pressed via an on-screen keyboard would not degrade performance. My guess is that it would require less computer resources than simply opening a new tab in the browser. – forest Feb 10 '18 at 10:36
  • Thanks; I guess I could move the keyboard around a lot and actually type a few of the characters? I only need to do this for passwords and I'm only really worried about bots. Also I should note that the keyboard is not a widely used one. – user5654 Mar 3 '18 at 3:34
  • That's not likely to work either. Image recognition is very good at tracking something that is solid and moving. You fundamentally cannot input information securely when your method of inputting is compromised. The most a virtual keyboard can do is protect against hardware keyloggers connected to the keyboard. If something is monitoring input to a remote machine, you've lost. – forest Mar 3 '18 at 3:36
  • You're there! Do you know if actual characters I typed in a Linux VM's virtual keyboard could possibly be registered to the host system - or to my client machine that's TVing into it - except via screen scraping? – user5654 Mar 3 '18 at 3:39
  • If you are typing something into a VM, the host will always know what you are typing. After all, the host receives it first and then sends it to the VM. – forest Mar 3 '18 at 3:40
1

Simply running basic image recognition on a low-resolution, low-framerate video to detect the keys being pressed via an on-screen keyboard would not degrade performance, so it is a practical attack against virtual keyboards. There are free and easy to use spyware utilities that come with this functionality built in, so even script kiddies can do this.

You fundamentally cannot input information securely when your method of inputting is compromised. The most a virtual keyboard can do is protect against hardware keyloggers connected to the keyboard. If something is monitoring input to a remote or virtualized machine, you've lost.

Perhaps you want to use a KVM (Keyboard Video Mouse) switch. They are devices which allow remote access to, as the name states, the keyboard, display, and mouse (and often other HIDs). These devices are simple and do not run a complex operating system, nor do they allow executing files, making them more or less immune from malicious activity. They are nothing more than an extension for your monitor and input devices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.