I thought of a simple way to throw keyloggers off when typing sensitive information into a field, however this method presupposes that the keylogger can't actually read what's in the field, and also that it can't record the exact movements of my mouse and exactly what was on my screen and in what position as I was typing and moving my mouse about. So that's my question, do keyloggers simply record key presses, or can they also track your exact mouse, movements, and exactly what was on your screen at the time these moves were made, like the field in which the information was typed? In essence, do they have a clear picture of exactly what went on on my monitor when the information was being typed? I'd rather not disclose the method I mentioned. I'm certain it's not even remotely as clever as I think it is, but still.

  • 2
    Typically keyloggers are simple things that just log keystrokes, then the person analyzing it picks words out that may be passwords (usually passwords are some combination of words and symbols/numbers, or random text). That isn't to say that there may not be more sophisticated ones that can do screen capture/mouse capture...
    – Ron Beyer
    May 12 '20 at 15:29
  • I see. So in essence, there is no way to fool screen capture viruses if you typed in the correct information. Are these rare, or have they become increasingly common? Basically, if I catch a keylogger, is there a good likelihood that it's one of these?
    – Lolpingu
    May 12 '20 at 15:33
  • Think of how password brute-forcing works. Lets say you have a password you want to crack, so you have the entire alphabet, special symbols, punctuation, and numbers to form some random length password. This could take forever. A key-logger provides a brute-force dictionary which can be easily narrowed down to provide usernames/passwords. You don't really even need to see what is on the screen or where it's being typed, you've got a very limited search set to use now.
    – Ron Beyer
    May 12 '20 at 15:36
  • Fascinating! I didn't think about it like that, though I presume that information that consists solely of numbers, like phone numbers, IP addresses, credit card numbers etc, can't really be narrowed down if it has every number from 1 to 9, which I think most credit card numbers do, so you're still left with a 16-digit number. However, could the NUMBER of times each number appears in the log be used to narrow down the search too?
    – Lolpingu
    May 12 '20 at 15:41
  • That may be even easier to find... Any group of 16-digits, 0-9 is a possible credit card number. If it's surrounded by a 3 digit number that's probably the number on the back, any set of XX/YY would be the date code, you can easily get that... IP addresses are always in the format XXX.XXX.XXX.XXX, phone numbers also follow a specific format, anybody with a basic knowledge of Regex and a few minutes can pull that information out of a log file...
    – Ron Beyer
    May 12 '20 at 15:45

What a keylogger can do depends on how it's been programmed. The name "keylogger" is just a generic term to refer to a program that records what you do on your computer. Originally, simple keyloggers were just keyloggers, that is, as the name suggests, they recorded your keystrokes. But more advanced keyloggers have then been developed, capable of recording your screen, tracking your mouse movements, etc. This kind of malware could hide inside a simple program, or it could even hide inside a kernel module, so "keylogger" is really a very generic term.

The real problem you have is that if you want to defend against "keyloggers", whatever that means, then you also need to defend against all other kinds of malware. What are you going to do about that? If you think you can get infected by a keylogger, why can't you also get infected by a browser plugin? Why can't a "keylogger" also have a module that will patch your browser, giving the attacker full control over what you do online? Why can't the "keylogger" be just one part of the whole infection, which might actually be a rootkit? In other words, I see some problems with your threat model, which I suspect is wrong or incomplete. You want to know how keyloggers work exactly, so that you can find a way around them, but your threat model should also include a lot of other threats in the same scenario. Then you'll realize that knowing how keyloggers work exactly isn't going to be very helpful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.