I am almost certain a colleague has installed a keylogger on my system. I am totally new to IT security, but have substantial linux / windows / programming experience.

The system I believe is compromised is running windows 7 with Eset smart security. Any compromise would be from custom-written scripts (likely python.)

Can someone point me in the direction of resources I would need in order to find the compromise? It would also be helpful if I could then find the origin of any infiltration.

I'm looking to spend 10-30 hours on this, and more if it yields solid results. I'd obviously like to implement measures to counteract future attacks - so long as I'm not dedicating more than 5 hours per week on it. Is this possible?

Are there IRC channels or forums I could check out for more in-depth security / forensics information?

Thank you!

  • 1
    Welcome to IT Security! I feel like this question may be too big to reasonably answer completely. I would say have a browse through the forensics, incident-response, and maybe penetration-test tags. Definitely a fun topic, but big and at least half feel. One of those might answer your question, or give you information enough to narrow this down some. – Scott Pack Dec 26 '12 at 18:22
  • If your system has been compromised you have to reinstall it. If you spend your productive worktime on pursuing forensic evidence of your colleague's malfeasance, this may be a question better suited for Workplace SE. – Deer Hunter Dec 26 '12 at 19:21
  • "any compromise would be from custom-written scripts" - how do you know this? To suggest a reasonable course of action, it's kind of important to know whether the two of you just have an ongoing competition playing tricks on each other or whether you believe your colleague is trying to steal your passwords/results/etc. – us2012 Dec 26 '12 at 21:11
  • I have heard him talking about writing viruses - and he mentioned writing custom to avoid heuristics. – Allen Watsdal Dec 27 '12 at 15:44

There are many ways to go about finding key loggers. Some are more time consuming than others and may also provide false-negative.

  • Purchase a well known anti key logger software. Or take your chances with a free distribution.

This is your first defense and the easiest thing you can do. A scanner may find suspicious files or process and flag them. At this point, you do research on these processes and find whether they are legitimate or not.

The software may not always work because a good key logger may hide itself very well.

  • Scan your computers ports and log all traffic.

Research if your computer should be transmitting particular traffic or not. This can be very time consuming depending on how many programs/services are installed.

If you find anything out of the ordinary here, you can research and find out what the traffic is for. A typical question you should ask is, should I have port 80 open on my computer?

This method may provide a false negative because the key logger may not be running or sending information at that time.

  • Compare files to known good files

This may be very time consuming depending on how many files you have. To do this, you can take an md5 hash of your file and compare it to a md5 hash of a good file that is on a default install with the appropriate updates and software, or a known good back up. If the files are different, the md5 will be different. You should probably should mount the hard drive so you know the current operating system isn't running.

Ask yourself whether or not the files will be different. Log files will be different, the page file will be different, etc. You might be looking for system are that are different.

  • Have any files been added?

Find out whether files have been added compare to a default install or a known good back up.

Research whether or not files are legitimately installed on your computer. For instance, it may look like Skype is a legitimate program, but you never installed it. A key logger could be disguised as something like that.

  • What else can I do?

Check if your boot loader is infected.

Use a rootkit scanner.

Check your firmware.

| improve this answer | |
  • 1
    +1 for logging traffic, this is a good place to look. if it's just a hobby/small project of his, he probably isn't encrypting the stream. He probably isn't properly hiding the process either... – lynks Dec 27 '12 at 16:03
  • And if you ever see encrypted traffic going somewhere odd, then that's an indication too. – bethlakshmi Dec 27 '12 at 17:11

You personally must do nothing.

Do not touch the machine from this point on. Instead, go directly to whoever manages information security in your organization and report your suspicions.

If you do not know who that person is, then go to your Line Manager, HR contact, or head of IT. If you're small enough not to have any of those, you're small enough to directly approach the head of the whole organization.

In almost any company this is something your colleague will be immediately terminated for doing; your organization will have processes to follow, and the last thing they need is for you to forensically compromise the machine by poking about at it.

This is not a technical problem, it's an HR problem. Even if you didn't care about this colleague seeing what you type, what other damn fool things are they doing?

| improve this answer | |
  • I own the machine, and our organization does not have any such department – Allen Watsdal Dec 27 '12 at 15:47
  • Editing answer to address this. – Graham Hill Dec 27 '12 at 16:45

Iserni's answer touched on this, but I think it's worth highlighting.

A wonderful approach to investigating how you are being spied on is to disseminate false information. Open a notepad document and pretend to have an instant-message conversation about how pleased you are with your massive Christmas bonus (insert suitable figure that will anger him immensely). Or talk about how so-and-so is going to be fired.

The point is to type something that he will almost certainly talk to others about, but to never tell anyone yourself.

That way, as soon as the rumor gets around, you know for sure where it came from. And have proof of a sort, certainly enough to leverage a confession.

| improve this answer | |
  • I'm finding that 'social hacking' is a cheap and effective tool. This is an outstanding idea, thank you! – Allen Watsdal Dec 30 '12 at 10:11

First of all, a "legal" disclaimer: if your colleague has indeed done so, how is this relating to your company's security policies, and who is in charge of the latter? Two possible solutions would be to either go to your local ${BOFH} and seek assistance, or drop broad hints that you may do so (because "your workstation feels sluggish" for example) in the hope that your colleague will then proceed to undo the damage.

Also you ought to ask yourself how do you stand versus this colleague of yours - i.e., why did he/she do this? Is this kind of behaviour acceptable? How will he/she react to your investigating the situation should he/she realize it is happening? What will you do if you discover something, and what if you discover nothing?

A comprehensive answer isn't feasible for the reasons already indicated by Scott Pack, so this is my very narrow attempt.

If you need/want to take justice in your own hands, so to speak, be careful to do so in a way that is not incompatible with your company's security policies. For example, a dirty trick I confess playing to a colleague of mine oh so many years ago involved leaving available to "myself" (and whoever could impersonate me, i.e. him) an executable purporting to be a porn-joke-fun game. It actually was a "screamer" application, which was just borderline acceptable because I pretended to believe that he had been tricked by the same website that had tricked me. This kind of scheme is a variant of the "honey pot" and is often used with documents; basically you disseminate information (executables, documents, etc.) in such a way that anyone having improper access to them is bound to modify his/her behaviour in a recognizeable way. If the new behaviour involves lawbreaking, the information is called a sting and the one supplying it (i.e. you) might be prosecuted in some legislations.

A more direct way of collecting evidence would be to investigate the machine's own structure and behaviour. Hardware keyloggers are either keyboard replacements or small plugins that will be found along the keyboard cable (in more sophisticated setups, inside the keyboard itself). Software keyloggers are either realtime (i.e. they transmit keys via IP, usually via UDP, and are visible to LAN sniffers - you either see unexplained ESTABLISHED TCP connections to some strange place such as your coworker's workstation, or equally unexplained UDP traffic to same) or delayed. These last store their booty in hidden files either continuously, and you will see unexplained processes opening files using e.g. Process Explorer, or upon reboot or user logout. In this last case, the careless keyloggers can be recognized by inspecting any file that turns out to have been changed since last reboot/logoff. You could e.g. reboot twice, both opening and closing Notepad, one almost without using the keyboard, the second after writing (and not saving) some kilobytes of rubbish. Checking modified file times and sizes ought to offer some hints.

Another technique (which ordinarily requires starting from a known clean system, which yours definitely isn't) is to calculate an integrity signature from all system and nonsystem files (google e.g. "TripWire"). This will both help you ascertain further modifications (but remember that Windows Update usually keeps the system in a very fluid state :-) ) and pinpoint those files whose timestamps did not change while their contents did, which is typical of the more advanced keyloggers (you can hide from a timestamp check, but not from a MD5 check; the latter being very expensive and therefore rare, it makes sense to try to thwart the former).

Finally, keep a log of your accesses to your workstation and verify with the system's access logs whether there are discrepancies.

| improve this answer | |
  • Thank you for this very detailed response. I appreciate the time you took. I'm positive it is not a hardware keylogger, but I believe the attack vector may have been through a USB device plugged into my computer. I have one question about the access logs: Would the keylogger potentially trigger a login when it goes to phone home? – Allen Watsdal Dec 27 '12 at 15:53
  • 1
    Take into account the possibility that your colleague is as much a victim as you are: there is malware that "reproduces" through USB storage devices. As to the 'phone home' part, if the software is running without an active login, it usually does not need one to 'phone home'. It might be installed so that it runs only when you login, though. – LSerni Dec 28 '12 at 11:22

Depending on the type of keylogger there are several different ways to go about your task. Some of these are fairly simplistic and some are fairly complicated and technical. This can range from "are there any devices attached to the computer that shouldn't be?" to doing detailed forensics.

If you suspect that a crime has occurred the it is not advised that you go digging for this yourself. Continuing to fiddle with the computer could compromise evidence and possibly make it inadmissible in court. Run and up to date AV. Run an up to date malware scanner. If that doesn't fix your problem I would recommend taking it to a professional.

| improve this answer | |
  • ... If he's not already running an AV or malware scanner, attempting to add/install one would potentially compromise evidence. Besides the potentiality that a good virus may be able to root the AV (or its installer), at which point a check could return nothing. – Clockwork-Muse Dec 26 '12 at 23:58
  • You're not wrong Clockwork-Muse. I generally recommend that AV/Scanners are a good first step because they are within the realm of due care and due diligence for a standard user, and every reputable AV/Scanner that I know of keeps a log of it's actions on the system which is good- just in case. Yes, all of these things can be circumvented (see Sophos from a few weeks back) but they are reasonable precautions that a user/owner can be expected to take. When in doubt, take it to a pro. When curious, give it a good check up. – grauwulf Dec 27 '12 at 0:23

Most infectors (such as a keylogger) will need a method of persistence to maintain the infection ability upon rebooting the computer. As a initial check, the Sysinternals Tool Autoruns provides the capability of checking the locations the Windows 7 operating system looks at upon logging into the computer. Checking these entries for suspicious looking entries along with their date and time of installation will help you perform an initial triage, and hopefully if your adversary is not fully competent, reveal a result.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.