5

I came across a suspicious website called keylog.me (you can already tell from the name).

I was as curious as heck to find out what it does, so I got on a VM (Fedora Linux which I reinstalled later) and went to it but the VM crashed.

So then I went on it again with NoScript and there was a script embedded in an image (though, I couldn't see what it was because the first time the VM crashed and this time I had NoScript). Only after did I find out that keyloggers can be installed through webpage scripts (I was using firefox on the VM).

Also, I found out that a keylogger may be able to escape (and of course I had internet enabled) a VM. So now I'm concerned about my data, thinking that I'm being keylogged right now typing this question (and more sensitive data).

Currently, my OS is Ubuntu, but I have Windows 10 on a separate partition which as we all know is nothing in comparison to Linux systems in terms of security and I have sensitive data there too.

If there is a keylogger tracking me how can I get rid of it and can website keyloggers escape a VM?

Improve this question
3
  • Were your VM host software and Ubuntu install reasonably up to date on patches? – trognanders Jul 14 '20 at 23:44
  • I was using 16.04 LTS and yeah, they were probably up to date – cppiscool Jul 16 '20 at 14:52
  • 1
    Zero-day exploits on browsers and VMs are pretty rare and tend to be pretty big news. Finding one is a pretty big deal, but in your setup, they would need two! Trash the VM install for sure, but I wouldn't worry too much about the host OS. – trognanders Jul 16 '20 at 17:21
15

TL,DR: Don't be worried, you are probably safe.

Usually malware cannot escape the VM onto the host OS. There are exceptions, as some malware are designed specifically to break from the VM into the host, but those are very, very few and usually are seen on targeted attacks, not on a public internet site.

Cross-OS malware infection are even rarer. Malware infecting your Ubuntu installation and jumping to Windows are plausible but mostly theoretical. A malware that escapes Firefox sandbox, infects the guest OS, escapes the VM, infects the host, discovers other OS installation and infects it too? No, I don't believe such thing would be available on a public facing site. It would be a weapon so powerful that nobody would admit to have it, even less go using it left and right.

Improve this answer
6
  • 3
    I bet VM escape vulnerabilities are probably some of the worst kinds of cyber attacks, and most expensive on the black market. Imagine the damage they could do on cloud computing environments. It's reasonable to assume hypervisors are some of the best guarded software there is. (only for Intel to blow it with speculative execution attacks at the hardware layer under the fancy hypervisors. side channel go brrrr) – Alexander Jul 14 '20 at 22:20
  • Once anyone discovered/reported an exploit like this, the patch would come very soon. – trognanders Jul 14 '20 at 23:43
  • I don't have a vm. Is it safe to visit that site to have a look? OP said "Only after did I find out that keyloggers can be installed through webpage scripts" as long as I don't download anything is that site safe to visit? Googling the site's name doesn't bring out anything – user13267 Jul 15 '20 at 7:25
  • @user13267 No, you should not go there with your browser. If there's any code exploiting your browser or OS, it can download and execute code. Those attacks are called Drive by Download. If you really want to see the site, install a VM. Or rent a Windows VPS, test, delete the VPS. – ThoriumBR Jul 15 '20 at 12:40
  • so that website downloads an exe and executes it without having to do anything? – user13267 Jul 15 '20 at 12:48
2

It's tricky.

If you were just browsing a website in the VM then you're reasonably safe.

If it managed to trick you into running a separate executable, then there is a chance that it could infect your host or other PCs on your network, if the VM wasn't properly isolated. (Using the same login credentials on the VM as on the host is the biggest no-no; using bridged networking increases the possible targets but by itself isn't usually an issue.) Having said this, it'd have to be a keylogger that included a viral component; these probably do exist but the chances you'd run into one accidentally are fairly slim. Especially across different OS types.

Another loophole that's easily overlooked however is that some VM software will automatically share your clipboard between host and guest; this means that a keylogger in the VM could potentially steal passwords or other important info if you happen to copy them while the VM is running. (This can occur without you noticing, eg. if you are using a password manager app that happens to use the clipboard to enter passwords.) Having said this, many VM systems will disable this by default (as it's a known vulnerability), so unless you've enabled it then you may be safe. (And a good password manager app shouldn't be using the clipboard in the first place.)

Improve this answer
-4

There may be many ways to get rid of keyloggers. For that, you have to work on its detection.

Wireshark can help in detection, but depending on the usage pattern of the PC, it can be difficult to determine which traffic is harmless and which is malicious.

This is what I would do if I suspect a keylogger transmitting data:

If you can, put Wireshark on a 2nd PC and use a Hub/SPAN Port to capture the suspicious PC's data. If you can't, you might have to go with installing Wirehark on the actual client's PC which has some drawbacks but sometimes can't be helped. Start the client's PC and let Wireshark capture the data coming and going to its network card.

Close as many programs that use the network as you can, to make sure that there is as little valid network traffic created as possible.

Open a text editor and start typing. Now if there's a keylogger it should at some point start to send out the captured data. You should see that as communications coming from the PC that have no other reason to be there. You can filter on that by using something like ip.src==X.X.X.X where X.X.X.X is the PC's IP address. This way you see everything that goes out. If there is something that you have no explanation for, you can filter on this communication bidirectionally. For example, by using the Follow TCP stream filter (if it is, in fact, a TCP session). Then you need to determine what is happening and if this is, in fact, a keylogger.

You may have to monitor the PC for a while because not all keyloggers send their data out right away. If you have a Wireshark on a 2nd PC you can try to shut down the suspicious PC and see if there is a transmission right before the keylogger is terminated.

Once you detect the keylogger then you can remove that.

Improve this answer
11
  • 5
    Do you mean to say that malware that can escape a browser sandbox and a VM will be so easy to detect and remove? Such malware would probably be able to disguise itself enough to make it near impossible for an average user to remove by themselves – nobody Jul 14 '20 at 15:11
  • 1
    You also assume that the transmission will not be encrypted. That's an odd assumption given the complexity of what we're talking about. Even TLS would break your packet capture idea. Plus, not many home users have hubs or routers with a span port. – schroeder♦ Jul 14 '20 at 16:22
  • 1
    "You should see that as communications coming from the PC that have no other reason to be there." -- that's a mouthful, even for experienced forensic experts. In order to make this useful, you would need to tie the source port with a local process using that port, then trace the process id to find out what is sending the traffic. Your answer skips over that entire, tricky part. – schroeder♦ Jul 14 '20 at 16:28
  • 3
    We know for the same reason that we assume that a $200k Ferrari isn't going to have a tow hitch on the back. Is it possible that a supercar might be used to tow a fishing boat? Sure, but that's not likely. To base an answer on a highly unlikely set of circumstances is not very useful. Especially when you could simply make some minor changes to bring things into a more likely realm. – schroeder♦ Jul 14 '20 at 16:51
  • 3
    Any malware sophisticated enough to escape both the sandbox, the guest, the host, and infect everything on its path will be sophisticated enough to use something like Domain Fronting, or DNS, or hide its traffic on the padding of TCP packets. And of course encrypt everything. So detecting such a malware is out of reach even for the most savvy user, and very challenging for security researchers. – ThoriumBR Jul 15 '20 at 1:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.