I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it?

My guess is that they just check if Wireshark is running and don't send logs if Wireshark is running. So, this wouldn't work if you are capturing packets using a router or another computer. Am I right?

  • No a keylogger won't check if a packet sniffer is running on the spied upon system. Just for the reason you guessed (a packet sniffer is never used on a suspected OS). – dan Dec 8 '13 at 10:36
  • Actually, I've played with a keylogger called "Gh0st Logger" and it does exactly what you're describing. If it detects that Wireshark is running, it doesn't send logs. Quite stupid technique, if you ask me. – Adi Dec 8 '13 at 10:45
  • @Adnan: IMHO it's not as stupid as sending logs even if Wireshark is running. Maybe lazy, but not stupid. Normal users run wireshark only on their computer. – Ufoguy Dec 8 '13 at 16:40
  • 2
    @Adnan: Also it makes them to qualified to advertise the product as "Anti-Wireshark" which makes the script kiddies buy it thinking that they are immune. – Ufoguy Dec 8 '13 at 16:42

If an attacker roots a system they can install drivers which will hide malicious traffic from sniffers like wireshark, tools like netstat, or process utilities like task manager or PS. An attacker could have keyloggers, spam bots, ddos tools, anything they like running on a system and even administrators would be completely oblivious unless they ran an external sniffer.


Meaning their data can't be sniffed. Is it possible to do so? How would they do it?

One plausible way of accomplishing this is encrypting the data before sending it out. To the perspective of the packet sniffer, the data will appear as an encrypted stream without knowing what actually is being sent. The server receiving the data stream can then decrypt the data stream to obtain the actual data being sent.


Some Googling suggests that at least some "anti-Wireshark" measures just look for processes running on your system named "Wireshark" and shutting them down.


I hate to start out an answer like this, but I do not know if my answer will be 100% correct because there are many ways this could be done. One way could be to hook a DLL into predetermined sniffing processes like wireshark and then make modifications to the process memory to not display any packets being sent to a specific IP Address (the IP Address which is monitoring the keylogger).

I'm sure there are other ways, but if I was attempting to create an anti-wireshark program, that's where I would start as to me it makes sense to do.

The program would simply have to find the static memory address where wireshark prepares information for display, intercept the packets before their displayed and then use a conditional statement to decide whether to allow them to continue on their way to be displayed or whether to stop them from being displayed.

However, it could just be as simple as finding the wireshark process and then calling the console command taskkill to terminate the process (like you said).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.