Will antivirus detect all keyloggers?

Question

Our company schedules Security Training courses for our personnel.

In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of course we want to know whether our antiviruses detect this code.

We send keyloggers by email to all personnel and rename them to "update or service packs".

Many of them download and run them and ... We get user name and IP through a web service.

And we have noticed that our antivirus does not detect this code as malware.

Which software should we use to detect keyloggers and other similar malwares?

Answer 1

No, anti-malware packages will not detect every form of keylogger. They will detect known ones by hashing, and some may detect certain keylogger-like behaviour via heuristic analysis.

However, I strongly advise you against this. First off, it's insulting to your employees. If I found out my employer was doing such a thing, I'd resign on the spot. Secondly, it's potentially illegal. I'd guess you're spying on people without their consent. You're opening yourself up to lawsuits. Finally, you're creating a security vulnerability - email isn't secure, and keyloggers are likely to contain company and personal credentials when users log into services. It's a security and privacy nightmare.

So, in my personal and professional opinion:

DON'T DO THIS!

Answer 2

I think that your question (Will Antivirus detect keyloggers?) has been answered.

I'd like to take a step back and examine the broader issues - because sometimes the answer to a question isn't really the answer you're seeking.

First, I must respectfully disagree with @Polynomial's opinion. I think your core notion is fantastic. It doesn't matter what security controls you deploy if your users aren't at least tacitly compliant. RSA was brought down because an administrative assistant reached into a sequestered email message and clicked on a link. You're trying to change user behavior by providing a clear feedback cycle; this is a technique which has been proven to be effective. I believe that a keylogger is the wrong "mission" or payload to deploy in this campaign. I believe that a sufficient payload would be a redirect to a page containing your company's policy. If you need to go beyond that, you could include one of the sample viruses used by antivirus companies to test their products. (I can't find a link to one, but if you have a legitimate need, I'm confident that you'll be able to find one).

Second, I'm not sure I understand why you're looking at antivirus. If your goal is to test the effectiveness of your antivirus, then I would suggest you rely on other people's research. There are sites that publish comparitive research. But ultimately 90% of the antivirus products are going to be adequate against 90% of the attacks you find. I don't have the current numbers, but the majority of viruses in the wild are common viruses.

Third, let me combine those two observations. Antivirus is designed to reduce the likelihood that you'll be the victim of opportunistic attack. If you want to test your reslience against opportunistic attack, you need a different test strategy. (simple scans are probably sufficient). Fake Phishing attacks like what you describe are designed to test your resilience against targeted attacks; antivirus programs are worthless against targeted attacks.

I believe you need to take a step back and decide what kind of security policy/implementation you want (what is your risk tolerance). Once you know that, then design threat scenarios and test cases against those. Confusing user behavior with keyloggers with antivirus indicates to me that you don't have a coherent risk management strategy.

Answer 3

No, not every keylogger will be found.

Just like viruses, Anti-Virus-Softwrae can only detect stuff they know and/or detect "strange" behaviour.

And: Hardware-Keylogger will most likely not be detected at all.

Answer 4

Custom written malware (like keyloggers) cannot be detected by anti-virus software using signatures to detect malware, because the signature of keylogger is unique so far. What some anti-virus (AV) software can detect is applications hooking up into Windows system listening for keystroke events (made by typing on a keyboard). Some AV software, if properly configured, can also block the keylogger from communicating over the network, effectively preventing it from sending the keystrokes to the attacker. There is a software called "KeyScrambler" that can protect against most keylogging malware.

Answer 5

Some antiviruses can detect keyloggers if you are setting mode into "Paranoid" , but in this case Antivirus take tons of resources since it hooks windows api and check for abnormal calls like for example GetAsyncKeyState , global hooks , checks injections to processes , but your station in this mode will become very slow and unresponsible.

You can get a soft that will catch 90% of keyloggers , since most of them are wtitten with same technics , keyboard hoks , and getasynkkeystate , there are some loggers that replacing default keyboard drivers , anyway , you shouldn't focused on catching keyloggers , you should focus on how to prevent data being sent from workstations to world.

Answer 6

the best protection today for keyloggers is keyscrambler, it doesn't really 'block' keyboards in a sence that they keep running, but the keys will be encrypted end decrypted at the target application, while this will work against real keyloggers, other programs which read data directly for a programs input field aka are actually hacking a certain application will not be blocked, since the real application has to get the real keyboard input, but those programs are real virusses and get usually detected by antivirus and require admin privileges to run