4

On a Linux system, is it at all possible to detect unknown keyloggers? Keyloggers which are new and haven't made it to any detection software's database?

7

Yes, it is possible to detect unknown keyloggers and other malware, usually through computer forensics (Volatility or EnCase are well-known software for doing that).

Keylogger detection, as for viruses and other malwares, can basically be achieved through two methods (I simplify for answer's clarity) :

  • Signature based detection
  • Heuristic based detection

Obviously, an unknown keylogger will not get caught by signature-based detection products (it can be though, in case of code-reuse for ex.), and you will have to rely on heuristics or behavioral detection, which usually generate a more false-positive results.

Fortunately, the thing is that keylogger developers usually rely on well-known methods to develop their malicious code, and that allows researcher to quickly find and detect them. Such methods are for example:

But generally, if your system has been compromised at kernel level by an unknown malware, the only thing you can do is get rid of it and reinstall a clean one, as kernel level modifications can be almost impossible to detect if done properly.

You can read this ESET Paper on detecting unknown malwares, or this one from Symantec, or just Google for one of the many interesting paper/article on this topic.

| improve this answer | |
  • A lot of info here. So focusing on just 1 aspect of it, the kernel. Is a checksum not possible to check if the kernel has been modified after being install? I'm going to assume no because of all the changes which probably happen in config files when he kernel is installed and running? – oshirowanen Apr 14 '14 at 13:47
  • Well, more globally the idea is the following: the tools you are going to use to detect Kernel modifications are relying on the kernel itself to perform. So at the end, this is a cat-and-mouse game, usually ending up with a complete reinstall of the potentially affected system. – ack__ Apr 14 '14 at 14:23
  • More info on the checksum approach can be found here – ack__ Apr 14 '14 at 14:36
  • @ack__ Very very interesting, but i want to ask you: are there any software which is able to detect malwares at kernel level? – Cristian Jul 17 '14 at 13:39
1

Yes. You could, for example, perform a code audit to identify software that is out of place.

Or you might be able to detect the data as it travels back to the attacker.

| improve this answer | |
0

The key item is whether you know whether there is a keylogger (or have reasonable suspicion) or you just want a way to automatically detect it.

In the first case an investigation is very likely to lead to something: data travelling back to the attacker (as others have pointed out), suspicious devices, evidence of tampering, and so on.

In the latter case the likelihood of automatically detecting a keylogger is very small: are you using off-the-shelf products? Can you measure timing of all systems' component, and compare with known, good values? Can you isolate the system in a Faraday cage to avoid passive keyloggers that transmit back data when irradiated (a-la NSA's TAO)? Do you have control of all the abstraction layers from boot to GUI, and can you cryptographically verify the software it runs (via some form of trusted boot)?

| improve this answer | |
0

Yes but normally not an easy task

There is a framework exactly for this called Volatility: bunch of tools written in python

it will crawl through the memory to determine if any keyloggers are running check it out at https://code.google.com/p/volatility/

hope that helps

| improve this answer | |
0

In theory, you could stop all the applications that you know are generating network traffic, then write a small piece of code to simulate lots of key typing events and monitor the network traffic to look for increased chatter over the wire. Even if the traffic is encrypted and sent in bulk packages, you could still have get a general idea about what your applications are doing and whether or not you were the target of a keylogger software. From that point on it would be up to you to investigate further, find the malicious app and take action to actively protect yourself and maybe backtrack the application to it's source.

| improve this answer | |
  • A keylogger doesn't necessarily generate network trafic. Keylogging is one part, exfiltrating data is another. A keylooger don't just send data outside as it records it, it can wait a lot of time and use several obfuscation methods to do so, or even it can just store the data and wait for the attacker to come back later to retrieve it. – ack__ Apr 14 '14 at 11:44
  • I totally agree with your perspective, however for the scope of the question and to relate to your opinion, the answer would definitely be no, you can't detect them as someone can always, in theory, create a keylogger that's well-behaved enough to evade detection (for example, data transfer can be initiated from the remote source, provided that the targeted machine has a static IP and an open port that the keylogger can just listen to). But data must leave the targeted machine somehow - so monitoring network traffic as well as physical access to the machine can at least give you a heads-up. – Thyamarkos Apr 14 '14 at 15:44
  • Data doesn't necessarily leave the machine, for example when an attacker get access to the system and just want to collect password/passphrases/whatever, he can just connect back to the machine and view the keylogger dumpfile. This scenario is particularly seen when dealing with inside attackers - which is the case in the majority of attacks. – ack__ Apr 14 '14 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.