2

It is known that malware often uses keyloggers. Also some viruses aren't detected by antiviruses, therefore some viruses, especially APTs could stay in a system for so long without any detection. What I think is if I could find out keylogger activities, I could increase the chance of detecting virus or even APT (my real aim is not APT but viruses).

I want a software (or a system) that finds out possible keylogger activities by looking at network traffic. Is there such a software? This software doesn't have to be working real-time, it may be a tool doing daily analysis or even it may be an incident response tool.

Improve this question
1
  • Fixed the parts of your question that were incorrect, or irrelevant :-)
    – Rory Alsop ♦
    Feb 7, 2013 at 7:54

2 Answers 2

Reset to default
4

A keylogger can send the data it gathers in a lot of ways:

  • Sent them by email
  • Encrypt them and send them by email
  • Upload a file to an FTP/SFTP server
  • Use HTTP Requests with GET/POST encrypted parameters
  • Use other protocols to send the data: special crafted DNS requests could be built, that hide the ex-filtrated data in legitimate DNS requests. It can also use reserved bits in packet headers to hide data there.
  • etc

As you can see, there are a lot of possibilities of sending data and the chances of a certain tool being able to detect all of these possibilities is rather low. This does not mean that using such a tool (like Snort) would not increase your overall level of security.

If you have a certain keylogger you are targeting (and you know how it works), then Snort rules could be created to accomplish your task.

Improve this answer
4
  • 1
    In addition, and just as a side note, there are also hardware keyloggers which will not send any network traffic at all. These are nearly impossible to detect, especially if they are located within the PC or keyboard.
    – NULLZ
    Feb 8, 2013 at 3:39
  • @Dinu S: is there any difference with keyloggers activity and normal activites in terms of ways to send data. For example, when I send a data over gmail, is it same with keyloggers way of sending data? Is there any possible differences in some of these issues that we can differenciate whether it is normal activity or keylogger activity by looking at this difference?
    – smttsp
    Feb 8, 2013 at 13:20
  • A keylogger sending data is similar to outlook or thunderbird sending data. It connects to the mail server(gmail) and sends a normal email. It may send an email with an encrypted attachment, or a fully encrypted mail, but a human could do the same thing, so it is almost impossible to differentiate, if you do not know how the keylogger works.
    – Dinu
    Feb 8, 2013 at 14:55
  • Is there anyway to differenciate any of keyloggers by looking at network traffic? For example, as far as I know periodicity is an issue for some keyloggers, I mean, they may be sending data periodically to a server. also some of them are sending data when they reach a determined amount of data, let say send mail when you reach 100 KB, etc. Is there more of that kind if issues that may help us to find out keyloggers?
    – smttsp
    Feb 9, 2013 at 13:49
1

All manner of traffic monitoring tools do this, and in fact it is seen by large enterprises as being essential to their security - as intrusions will take place no matter how strong the security in place.

These tools run from the open source Snort, which is the most widely used IDS/IPS in the world, through to appliances and systems from all the major vendors.

The search term you may wish to look for is SIEM - and it covers not only trying to spot attacks, but also detecting longer term intrusion through monitoring communications channels etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .