1

When you press keystrokes, I suppose you can intercept in low level code all applications that listen and record. Why it cannot be designed a software that protects 100% against keyloggers, simply refusing the access to all applications that are not on a whitelist? And the problem is how to manage the whitelist ...

  • 1
    An application or an operating system? As I understand it, macOS does what you are describing. – Alexander O'Mara May 2 at 17:55
  • @AlexanderO'Mara i thought the same thing.Maybe he means like an antivirus application – Vipul Nair May 2 at 20:19
2

And the problem is how to manage the whitelist.

And that problem makes your solution impossible. Let's see why.

Debuggers and other developer tools

They can access low-level functions like those used by keyloggers, but are used for legitimate reasons by developers. If you whitelist those, developers are in risk. If you not, they productivity will be impacted.

Angry developers are bad for the health of the company.

Dynamic Link Libraries

Also know as .dll (or .so on Linux). If a trusted application can load an external library file, this file can be hijacked and execute malicious code inside the application memory space. Now you have to whitelist library files too. But those files receive upgrades, so you must create a whitelist of every single version of every single library file for every single application you have.

A difficult job to create, an even out-worldly nightmarish difficult job to maintain.

Malicious use of manufacturer applications

If you allow drivers signed by certified manufacturers and an attacker gets the certificate private key (that happened more than once), they can put any application on the whitelist. Once that happens, or you remove the entire certificate from your whitelist (and break every system that have those legitimate applications running) or you leave it active and risk infection.

You create collateral damage. Users not likely to be affected by the keylogger are affected by your blacklist.

Hardware keyloggers

This is outside of your scope, but even with a really tight closed security, a hardware based keylogger is impossible to detect by software, cannot be protected against.

0

Why it is difficult to write an application to protect 100% against keyloggers?

Well same reasons that an application written to find and protect against 100% malware fails. Ever played a Video game?How does it work?When you press the forward key it accelerates.Now a simple keylogger could follow the same logic.How would you differentiate between a key logger and a racing game?Its not possible

the access to all applications that are not on a whitelist

Creating a whitelist which allows certain application or executable is the most Impossible/Impractical solution i have ever heard.Its just not possible

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.