5

All in all, hardware keyloggers are harder to detect.

But if computers can measure the exact voltage consumption of their peripherals, could a hardware keylogger be detected by comparing the normal power consumption of the keyboard with the slightly higher consumption of the keyboard with a keylogger attached?

5
  • 1
    Don't even need a keylogger attached
    – RoraΖ
    Oct 14, 2014 at 15:32
  • 1
    Laser vibration range-finding keylogging is similar but more accurate than mobile phone vibration keylogging but probably rather obvious as glass is opaque to more discrete IR range-finding. The PS/2 clock cycle keylogging is probably less relevant for modern more efficient USB keyboards. Oct 14, 2014 at 15:48
  • If a keylogger is installed, the attacker could also just hack whatever method you are using to detect it... Oct 14, 2014 at 18:02
  • 1
    @MatthewPeters If they are using a hardware logger, we are assuming they don't have enough time to subvert the operating system. A hardware keylogger can take only a handful of unsupervised seconds to install; overriding the bios or running the hard drive from a test rig takes longer. Indeed process may be iterative; with a hardware logger being the first step to undermine full disk encryption. Oct 14, 2014 at 23:25
  • nit pick: voltage isn't consumed, current is.
    – dandavis
    May 16, 2020 at 20:55

2 Answers 2

3

In theory, it's possible, but is very, very hard:

  • USB is, by definition, a serial bus. So you can have more than one device on a single USB bus. This defeats any measurement.

  • Monitoring minute changes on power consumption on a bus is not easily done, and it's easier to just open up the keyboard and search for a keylogger.

6
  • Also, someone were to develop a means to detect a hardware keylogger by voltage it would probably be static. Meaning they could just change the voltage used, use another USB device with different voltage to bypass the detection. Even better, they could use voltage comparable to keyboard or mouse making it much harder to block. Oct 14, 2014 at 15:56
  • @Paraplastic2 Unless the keylogger has internal power, it will draw power in addition to the keyboard to write to flash; though whether USB power monitors are sensitive enough is a matter in itself, Additionally, unless the logger works through passive induction or vibration or whatever, you need to unplug the keyboard to install; an event that the conputer could warn the user occurred. If the operating system is especially cunning, it could choose to send a random voltage (within tolerance) to make masking the keylogger for standard keyboard model even harder. Oct 14, 2014 at 23:38
  • @LateralFractal All good points. It might also be feasible to monitor power consumption with no key press vs. when keys are held down and the logger would be active. Then compare power consumption to the same setup without a logger to see what the difference is. It could become detectable. Oct 15, 2014 at 14:41
  • It would be a lot cheaper and simpler to just buy a ordinary keyboard, open it up, fill the inside with epoxy, and put tamper evident seals around it.
    – ThoriumBR
    Oct 15, 2014 at 15:31
  • The keylogger may not be in the keyboard. You could superglue the keyboard plug adapter to the onboard usb hub; but the attacked could either snip and discard the existing keyboard, replacing with a lookalike - or splice in the keylogger to the cable if they have the time. Oct 22, 2014 at 1:17
1

I've recently tested this with a KeeLog USB Keygrabber and a USB Charger Doctor from Adafruit

I noticed the voltage going down about 0.2V upon plugging in the keylogger, but the value didn't seem to be stable enough to use it for reliable detection.

What seemed more stable was the power consumption. With the keylogger I got constantly 0.04 A more than without the keylogger. But so far I was not able to see this difference in power consumption with software from inside the OS, e.g. with powertop on Linux. But if I have to check the USB Charger Doctor everytime before I use a PC, I very likely will also detect an USB keylogger sitting at the same place or nearby.

Anyway, let's say, we found a way to measure that value from inside the OS.

A sudden rise in power consumption is still no real indicator since hitting Caps-Lock and/or Num-Lock on the keyboard also caused additional power consumption from its LED. And that was in about the same range according to the USB Charger Doctor: 1 LED = 0.03 A, 2 LED = 0.05 A. So the keylogger's power consumption is within an expected range.

So if someone lits all LEDs on his keyboard it could be noticed that the power consumption is higher than it seemed possible. But that's unrealistic in everyday use unless you light those LED from the OS side (which is possible). But I guess regularly blinking keyboard LED would drive the user crazy.

Another way would be to do long-time statistics about this and then notice a sudden rise of the average power consumption level as an anomaly. But I expect false positives here, e.g. one user prefers Num-Lock being off all the time and another user prefers it to be on all the time.

With regards to the hint from the other answer about multiple devices might defeat that: That's right. But quite some USB keyloggers don't support multiple devices (or at least don't support USB hubs) behind them and at least on desktop PCs, the keyboard is often connected directly to the PC.

1
  • 1
    my whole keyboard lights up. a well-designed (purposeful chip like a pga, not a commodity MCU) keylogger could draw under 1ma, well within the margin of noise. Most keyboards seem to use a linear votage regulator as well, which can change power consumption significantly with USB voltage fluctuations and even temperature since transistors amplify better warmed up. a large capacitor could also easily hide short-term current fluctuations, so this method doesn't seem very reliable.
    – dandavis
    May 16, 2020 at 20:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.