86

No, your data is not safe from key loggers on a local computer. There isn't much more to say here, to be fair. A key logger will grab and save any key stroke entered. The tls (https) encryption happens "after" the driver from keyboard "sends" those key strokes to the browser, "through" the key logger. Even if encryption is being used and there isn't one ...


84

Virtual keyboards were an easy-to-implement solution to malware that recorded keystrokes from the keyboard and hardware keyloggers. But the keylogger software developers quickly adjusted to this new technique (sometimes by simply taking a screenshot focused around where the mouse clicks). In the end, it is not clear that a virtual keyboard provided any ...


82

Because it wouldn't help. Most keyloggers are installed at the operating-system level, and the operating system needs to have access to the keystrokes. Alt-Tab program switching, using Ctrl-Alt-Del to terminate malfunctioning programs, and detecting keyboard activity to keep your screensaver from activating all require the OS to see keystrokes. There's ...


59

This would greatly depend on the implementation of the keylogger. Some enterprise-level products do include rootkits which make the keylogger nearly impossible to detect, unless you know the product in use and its configuration. For an example, check out Spector Pro*. Also, as syneticon-dj notes, it's possible they may instead be using a hardware ...


58

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can delete these data, send these data to somebody else etc. Moreover it can make screenshots, control other applications running on the same X windows screen (even if ...


57

"Secure Keyboard Entry" maps to the EnableSecureEventInput function whose concept is described here. Basically, applications don't access the hardware themselves; they obtain events (e.g. about key strokes) from the operating system. Some elements in the OS decides what application gets what events, depending on its access rights and GUI state (there are ...


56

Many applications make futile attempt to foil keyloggers and spyware by using convoluted (and cumbersome) password entry methods. None work against keyloggers and many actually cause users to be LESS secure because they make it hard to use password managers. The best way to handle that kind of things is to use one-time passwords. There are several ways to ...


55

These kinds of password entry systems are only good as long as the attackers do not adapt. It is a play in several acts: Bank Web sites use passwords which are entered the traditional way, with a keyboard. Key loggers appear, and harvest key strokes. After some cases of actual bank password theft, banks adapt. They implement "visual keyboards" in which the ...


37

RedGrittyBrick is right. Here's how it would work: Keylogger is on host machine: even VM sessions will be keylogged. Keylogger is on virtual machine: only VM will be keylogged unless it escapes the VM. Keylogger is hardware-based: same as #1: everything can be captured, but this includes things even outside of the main operating system, as long as it's all ...


33

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: Running on a low-privilege account (aka "principle of least privilege") should be part of a balanced breakfast which also includes good firewall configurations; ...


32

A hardware keylogger will obviously capture anything typed on the keyboard it is attached to. So that includes keystrokes that are forwarded to a VM. I would expect a software keylogger running on the host system should also capture anything typed on the local keyboard before it gets to any VM A software keylogger running in a VM would capture keystrokes ...


31

The keyboard to application interface goes through several phases, some of which the OS has little control, and some that is provides explicit hooks into for additional functionality. The basic design goes like this: hardware events are received by driver chains, which then pass messages to the kernel, that then dispatches it to a global hotkey chain, and ...


28

Nope. Keyloggers can often also do screen-capturing and mouse-coordinate-logging. So the attacker can still see what image the user selects. Another kind of two-factor authentication for which the user needs two devices (e.g. laptop and phone) would be more secure. Another good alternative is a Yubikey. A kind of device which generates a pseudo-random ...


26

The answer that you don't really want is that keyloggers can be very stealthily incorporated into pretty much anything: Keyboard with integrated keylogger: https://www.paraben-sticks.com/keyboard-keylogger.html Less savoury keylogger found in retail keyboard, sending keystrokes back: https://thehackernews.com/2017/11/mantistek-keyboard-keylogger.html Wifi ...


24

The reason this isn't done by default is because the previous-generation operating system design didn't have a huge focus on sandboxing and the like, so right now it would require big architectural changes to make such changes work. Mark touches upon those to some extent in his answer, but it boils down to that you can't allow applications to blindly run ...


24

HTTPS can't possibly fully protect your user input on an untrusted computer: The computer could have keylogger software installed. The keyboard could have firmware programmed to keylog you. There could be a hardware device between the computer and the keyboard recording keypresses. There could be screen recording software running. There could be a video ...


20

Virtual keyboards are commonly used in banking sites because they have (at least) two neat pros: they protect the password from naive keyloggers they prevent the user from storing the password in a file But they do have cons: specialized keyloggers can still spy the passwords (see @schroeder's answer for a more in-depth explanation) then prevent usage of ...


19

No, anti-malware packages will not detect every form of keylogger. They will detect known ones by hashing, and some may detect certain keylogger-like behaviour via heuristic analysis. However, I strongly advise you against this. First off, it's insulting to your employees. If I found out my employer was doing such a thing, I'd resign on the spot. Secondly, ...


18

Create GMail account with no 2 step authorization (not from friend' laptop). Log in with you friend' laptop into GMail web interface (type username/pass manually). Create new mail with subj some reports from %companyname%, attach some dummy .docs and .pdfs, type "dave123@another-company-in-your-field.com" in "To:" field. Click "Send". Enable 2 step ...


17

The graphical entry of passwords is initially an attempt to thwart keyloggers. When such things began to appear, keyloggers naturally evolved (the people who write keyloggers have not stopped developing them; they adapt to new conditions) and modern keyloggers are also mouseloggers which record, for each click, a partial snapshot of the screen (a small area ...


16

If you were dealing with keyloggers in isolation, then it might be possible to mitigate the risk (e.g. using on-screen keyboards, 2FA or similar), however if an attacker has the ability to install a keystroke logger on the system it is very likely (apart from physical keystroke loggers) that they have privileged access to the system in question and as such ...


15

Such protection mechanism you're describing could possibly be exploited by the IE mouse tracking flaw, an Internet Explorer vulnerability that allows an attacker to track your mouse cursor anywhere on the screen, even if the browser is not being actively used, and to me seems such password protection would be more at risk of being compromised than your ...


15

The keylogger looks to be sending email using Gmail but the SMTP communication is encrypted with TLS (SSL). Simple Mail Transfer Protocol Command Line: STARTTLS\r\n Command: STAR Request parameter: TLS Simple Mail Transfer Protocol Response: 220 2.0.0 Ready to start TLS\r\n Response code: <domain> Service ready (220) ...


14

In a similar vein, but slightly different. Rather than using audio recordings this link shows that you can point a laser at the back of a laptop monitor and determine what is being typed based on the vibrations of the screen. Here is the original presentation slides


14

A lot of keyloggers are smart enough to catch this. Not only do they log the keys being physically pressed, but they also log the contents of password boxes whenever window messages are processed, or when browser forms are posted. They also often capture small blocks of the screen around the mouse cursor, to catch cases like this.


14

You can't ever be safe on hardware you don't control. A hardware keylogger could be mounted inside the chassis where you could not see it, or remove it. A software keylogger may not be detectable by any app that you could run (if you had enough user privileges to run any app). Network monitoring and sniffing of your web traffic would be completely ...


13

Carrier IQ is a rootkit previously installed by mobile phone operators on Android and on iOS 4 iPhones. It is capable of recording every keystroke on your virtual keyboard. See What risk does Carrier IQ pose, exactly?


12

In my experience, most anti virus/malware solutions don't complain about low-level-keyboard-hooks, which are the easiest way to create a keylogger. One of my most popular programs contained such a keyboard hook, and only one user told me about his firewall complaining. On the other hand, several other modules of it, which were pretty harmless, triggered ...


12

In order to understand why certain programs (malicious and non-malicious) are flagged by Anti-Virus software, we need to understand some of the basic principles that Anti-Virus software use. Access to unauthorized resources The Keyboard Hook As others have suggested, the keyboard hook is one of the first ways in which a primitive keylogger gets detected. ...


Only top voted, non community-wiki answers of a minimum length are eligible