0

What role, if any, do VPNs play in preventing information being stolen by keyloggers and mouse/screen readers? Here's my thought process:

  • Even if malicious software is present on your device, for any stolen information to be of any use to anyone doesn't it have to be transfered over some type connection, presumably the Internet?

  • Even if the adversary were able to get that data wouldn't it be unreadable to them since the VPN encrypts all outbound traffic?

  • Would the data have to be hidden within your normal traffic and if so where in the system could you look for it, i.e. are there any kind of "logs" where you could look for things that don't belong?

  • Is there malicious code that redirects the data to attacker, or does he have to manually intercept the traffic, or does this have to do with DNS spoofing?

  • Is the exit point of the VPN server a possible/preferrable point of interception since the traffic leaves unencrypted? How easy is it for the adversary to track my traffic to the VPN servers exit?

  • EDIT: Is this one more thing I shouldn't expect VPNs to protect me from? What can be done in place of or in addition to a VPN to protect yourself from these type of attacks?

  • 1
    If you can't trust the computer you are using, all bets are off. Just as a VPN won't protect you from someone looking at your screen over your shoulder, it won't protect you from local spyware. – tlng05 Jun 4 '15 at 10:29
  • @tlng05 I understand there's no substitute for working from a secure device but from a security stand point I'm interested in learning about how these attacks actually work, and I could always be in a situation where I'm forced to use an unsecure device so best to know what steps I might take to mitigate the threat. I'm hoping to get a better understanding of how networks work and the VPN seems to add an interesting dynamic to this. – Ian Last Jun 4 '15 at 10:55
  • Using insecure devices is inherently a bad choice. If your endpoint is untrusted, the only good option is to isolate it and keep secret data away from it. – Natanael Jun 4 '15 at 12:52
1

VPNs are not going to provide you any protection against keylogging/screen grabbing malware, all a VPN does is encrypt traffic between one point and another. Once the traffic exits the VPN it will then continue onto its destination whether that is a legitimate system or a hackers command and control system. It will not prevent you from getting malware in the first place or prevent malware from being able to send your data out.

  • Thanks for answering, so how does the hacker redirect your traffic to his 'command and control center?' Is there code originating from your system that takes care of this, if possible could you elaborate on this part a little? Where is the target data (passwords, etc.) located within your traffic and is there a way to inspect your traffic to look for this? Does redirecting always occur after the traffic exits the VPN server or can something like DNS spoofing be used to prevent the encrypted traffic from ever reaching the server in the first place? Thanks. – Ian Last Jun 4 '15 at 11:09
  • 1
    Nothing is redirected, the malware is not intercepting network traffic, it's creating its own. Keyloggers and screen grabbers do not piggy back on other connections, they open their own connections to send data, usually using common web protocols. – GdD Jun 4 '15 at 12:48
  • Is there any place on my computer system or some kind of software I can use to manually inspect/configure all active connections and hopefully catch/stop any unauthorized processes? Are these processes hidden in nature and is it non-trivial to find/kill them? Thanks. – Ian Last Jun 4 '15 at 21:39
  • *Find and kill them MANUALLY i.e. without antivirus – Ian Last Jun 4 '15 at 22:11
0

If the adversary that had installed the keylogger or screen reader were accessing them from another device on LAN, using a VPN could protect you. You would need firewall rules that allowed traffic only via the VPN tunnel, and did not allow connections to other devices on LAN.

Even if the adversary could intercept on LAN, they would see only encrypted VPN traffic. Intercepting from the VPN exit server wouldn't help them, unless the needed ports had been forwarded. The VPN is like a NAT router in that sense. The adversary would need root access to the VPN exit server in order to reach their keylogger or screen reader.

Still, if they had managed to install that stuff, they could arguably come back to get recorded information. Or maybe they have another channel, NSA TAO style. Your best option is physical security.

  • Thanks for answering, NSA TAO style aside, if accessing through LAN is no use and intercepting at VPN exit server is no use I guess the question is can access happen through wifi/internet between my computer and VPN exit server (encrypted tunnel). Even if intercepting at the VPN exit server doesn't help adversary would it be non-trivial for him to follow traffic from my computer all the way through to that exit server? – Ian Last Jun 4 '15 at 11:36
  • If he can get at the data at the VPN server, that gives him the same capabilities as if he was on your LAN. – Natanael Jun 4 '15 at 12:54
  • @Natanael Are you implying there is a threat from the VPN server and LAN, contrary to the answer? – Ian Last Jun 4 '15 at 21:23
  • @IanLast the threat from the VPN server or anybody that can control its connection is equal to that of an attacker within your LAN. they can attempt MITM. – Natanael Jun 4 '15 at 21:30
  • 1
    @IanLast The admin of your local network cannot read any traffic between you and the VPN server, but the admin of the VPN server or its local network can. The ISP of the VPN server can also read your traffic but it will appear to originate from the VPN server and not from you. – tlng05 Jun 5 '15 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.