Jump to content

Keystroke logging

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by 217.150.152.145 (talk) at 13:30, 11 June 2010 (→External links). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Keystroke logging (often called keylogging) is the action of tracking (or logging) the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that their actions are being monitored. There are numerous keylogging methods, ranging from hardware and software-based approaches to electromagnetic and acoustic analysis.

Application

Software-based keyloggers

A logfile from a software-based keylogger.
A screen capture from a software-based keylogger.

These are software programs designed to work on the target computer’s operating system. From a technical perspective there are five categories:

  • Hypervisor-based: The keylogger can theoretically reside in a malware hypervisor running underneath the operating system, which remains untouched. It effectively becomes a virtual machine. Blue Pill is a conceptual example.
  • Kernel based: This method is difficult both to write and to combat. Such keyloggers reside at the kernel level and are thus difficult to detect, especially for user-mode applications. They are frequently implemented as rootkits that subvert the operating system kernel and gain unauthorized access to the hardware, making them very powerful. A keylogger using this method can act as a keyboard driver for example, and thus gain access to any information typed on the keyboard as it goes to the operating system.
  • Hook based: Such keyloggers hook the keyboard using functionality provided by the operating system for applications to subscribe to keyboard events legitimately. The operating system notifies the keylogger each time a key is pressed and the keylogger simply records it.
  • Passive Methods: Here the coder uses operating system APIs like GetAsyncKeyState(), GetForegroundWindow(), etc. to poll the state of the keyboard or to subscribe to keyboard events. These are the easiest to write, but where constant polling of each key is required, they can cause a noticeable increase in CPU usage and can miss the occasional key. A more recent example simply polls the BIOS for preboot authentication PINs that have not been cleared from memory.[1]
  • Form Grabber based: Form Grabber-based keyloggers log web form submissions by recording the web browsing onSubmit event functions. This records form data before it is passed over the internet and bypasses https encryption.

Remote access software keyloggers

These are local software keyloggers programmed with an added feature to transmit recorded data from the target computer to a monitor at a remote location. Remote communication is facilitated by one of four methods:

  • Data is uploaded to a website, database or an FTP account.
  • Data is periodically emailed to a pre-defined email address.
  • Data is wirelessly transmitted by means of an attached hardware system.
  • The software enabling a remote monitor to log into the local machine via the internet or ethernet and access the logs stored on the target machine.

Software Keyloggers may be augmented with features that capture user information without relying on keyboard key presses as the sole input. Some of these features include:

  • Clipboard logging. Anything that has been copied to the clipboard can be captured by the program.
  • Screen logging. Screenshots are taken in order to capture graphics-based information. Applications with screen logging abilities may take screenshots of the whole screen, just one application or even just around the mouse cursor. They may take these screenshots periodically or in response to user behaviours (for example, when a user has clicked the mouse). A practical application used by some keyloggers with this screen logging ability is to take small screenshots around where a mouse has just clicked; these defeat web-based keyboards (for example, the web-based screen keyboards that are often used by banks) and any web-based on-screen keyboard without screenshot protection.
  • Programmatically capturing the text in a control. The Microsoft Windows API allows programs to request the text 'value' in some controls. This means that some passwords may be captured, even if they are hidden behind password masks (usually asterisks).[2]
  • The recording of every program/folder/window opened including a screenshot of each and every website visted, also including a screenshot of each.
  • The recording of search engines queries, Instant Messenger Conversations, FTP Downloads and other internet based activities (including the bandwidth used).
  • In some advanced software keyloggers, sound can be recorded from a users microphone and video from a users webcam.[citation needed]

Hardware-based keyloggers

A hardware-based keylogger.
A connected hardware-based keylogger.
Main article: Hardware keylogger

Hardware-based keyloggers do not depend upon any software being installed as they exist at a hardware level in a computer system.

  • Firmware-based: BIOS-level firmware that handles keyboard events can be modified to record these events as they are processed. Physical and/or root-level access is required to the machine, and the software loaded into the BIOS needs to be created for the specific hardware that it will be running on.
  • Keyboard hardware: Hardware keyloggers are used for keystroke logging by means of a hardware circuit that is attached somewhere in between the computer keyboard and the computer, typically inline with the keyboard's cable connector. More stealthy implementations can be installed or built into standard keyboards, so that no device is visible on the external cable. Both types log all keyboard activity to their internal memory, which can be subsequently accessed, for example, by typing in a secret key sequence.[3] A hardware keylogger has an advantage over a software solution: it is not dependent on being installed on the target computer's operating system and therefore will not interfere with any program running on the target machine or be detected by any software. However its physical presence may be detected if, for example, it is installed outside the case as an inline device between the computer and the keyboard. Some of these implementations have the ability to be controlled and monitored remotely by means of a wireless communication standard.[citation needed]

Wireless keyboard sniffers

These passive sniffers collect packets of data being transferred from a wireless keyboard and its receiver. As encryption may be used to secure the wireless communications between the two devices, this may need to be cracked beforehand if the transmissions are to be read.

Keyboard overlays

Criminals have been known to use keyboard overlays on ATM machines to capture people's PINs. Each keypress is registered by the keyboard of the ATM as well as the criminal's keypad that is placed over it. The device is designed to look like an integrated part of the machine so that bank customers are unaware of its presence.[4]

Acoustic keyloggers

Acoustic cryptanalysis can be used to monitor the sound created by someone typing on a computer. Each character on the keyboard makes a subtly different acoustic signature when stroked. It is then possible to identify which keystroke signature relates to which keyboard character via statistical methods such as frequency analysis. The repetition frequency of similar acoustic keystroke signatures, the timings between different keyboard strokes and other context information such as the probable language in which the user is writing are used in this analysis to map sounds to letters. A fairly long recording (1000 or more keystrokes) is required so that a big enough sample is collected.[5]

Electromagnetic emissions

It is possible to capture the electromagnetic emissions of a wired keyboard from up to 20 metres (66 ft) away, without being physically wired to it.[6] In 2009, Swiss researches tested 11 different USB, PS/2 and laptop keyboards in a semi-Anechoic chamber and found them all vulnerable, primarily because of the prohibitive cost of adding shielding during manufacture.[7] The researchers used a wide-band receiver to tune into the specific frequency of the emissions radiated from the keyboards.

Optical surveillance

Not a keylogger in the classical sense, but an approach that can nonetheless be used to capture passwords or PINs. A strategically placed camera, such as a hidden surveillance camera at an ATM, can allow a criminal to watch a PIN or password being entered.[8]

History

An early keylogger was written by Perry Kivolowitz and posted to the Usenet news group net.unix-wizards,net.sources on November 17, 1983 [9]. The posting seems to be a motivating factor in restricting access to /dev/kmem on Unix systems. The User-mode program operated by locating and dumping character lists (clists) as they were assembled in the Unix kernel.

Cracking

Writing simple software applications for keylogging can be trivial,[citation needed] and like any nefarious computer program, can be distributed as a trojan horse or as part of a virus. What is not trivial for an attacker however, is installing a covert keystroke logger without getting caught and downloading data that has been logged without being traced. An attacker that manually connects to a host machine to download logged keystrokes risks being traced. A trojan that sends keylogged data to a fixed e-mail address or IP address risks exposing the attacker.

Trojan

Young and Yung devised several methods for solving this problem and presented them in their 1997 IEEE Security & Privacy paper[10] (their paper from '96 touches on it as well).[citation needed] They presented a deniable password snatching attack in which the keystroke logging trojan is installed using a virus or worm. An attacker that is caught with the virus or worm can claim to be a victim. The cryptotrojan asymmetrically encrypts the pilfered login/password pairs using the public key of the trojan author and covertly broadcasts the resulting ciphertext. They mentioned that the ciphertext can be steganographically encoded and posted to a public bulletin board such as Usenet.[citation needed]

Ciphertext

Young and Yung also mentioned having the cryptotrojan unconditionally write the asymmetric ciphertexts to the last few unused sectors of every writable disk that is inserted into the machine.[citation needed] The sectors remain marked as unused. This can be done using a USB token. So, the trojan author may be one of dozens or even thousands of people that are given the stolen information. Only the trojan author can decrypt the ciphertext because only the author knows the needed private decryption key. This attack is from the field known as cryptovirology.

Federal Bureau of Investigation

In 2000, the FBI used a keystroke logger to obtain the PGP passphrase of Nicodemo Scarfo, Jr., son of mob boss Nicodemo Scarfo.[11]

Use in surveillance software

Some surveillance software[vague] has keystroke logging abilities and is advertised to monitor the internet use of minors. Such software has been criticized on privacy grounds, and because it can be used maliciously or to gain unauthorized access to users' computer systems.

Countermeasures

Countermeasures against keyloggers will vary depending on the type of keylogger in use.

Live CD/USB

Rebooting the computer using a Live CD or Live USB is a possible countermeasure against software keyloggers if the CD is clean of malware and the operating system contained on it is fully patched so that it cannot be infected as soon as it is started. Booting a different operating system does not impact the use of a hardware keylogger.

Anti-spyware

Many anti-spyware applications are able to detect keyloggers and quarantine, disable or cleanse them. These applications are able to detect software-based keyloggers based on patterns in executable code, heuristics and keylogger behaviours (such as the use of hooks and certain APIs).

No software-based anti-spyware application can be 100% effective against all keyloggers[citation needed]. Also, software-based anti-spyware cannot defeat non-software keyloggers (for example, hardware keyloggers attached to keyboards will always receive keystrokes before any software-based anti-spyware application, rendering the anti-spyware application useless).

However, the particular technique that the anti-spyware application uses will influence its potential effectiveness against software keyloggers. As a general rule, anti-spyware applications with higher privileges will defeat keyloggers with lower privileges. For example, a hook-based anti-spyware application cannot defeat a kernel-based keylogger (as the keylogger will receive the keystroke messages before the anti-spyware application), but it could potentially defeat hook and API-based keyloggers.

Network monitors

Network monitors (also known as reverse-firewalls) can be used to alert the user whenever an application attempts to make a network connection. This gives the user the chance to prevent the keylogger from "phoning home" with his or her typed information.

Automatic form filler programs

Automatic form-filling programs may prevent keylogging by removing the requirement for a user to type personal details and passwords using the keyboard. Form fillers are primarily designed for web browsers to fill in checkout pages and log users into their accounts. Once the user's account and credit card information has been entered into the program, it will be automatically entered into forms without ever using the keyboard or clipboard, thereby reducing the possibility that private data is being recorded. However someone with physical access to the machine may still be able to install software that is able to intercept this information elsewhere in the operating system or while in transit on the network. (Transport Layer Security prevents the interception of data in transit by network sniffers and proxy tools.)

One-time passwords (OTP)

Using one-time passwords may be keylogger-safe, as each password is invalidated as soon as it's used. This solution may be useful for someone using a public computer, however an attacker who has remote control over such a computer can simply wait for the victim to enter his/her credentials before performing unauthorised transactions on their behalf while their session is active.

One-time passwords also prevent replay attacks where an attacker uses the old information to impersonate. One example is online banking where one-time passwords are implemented to protect accounts from keylogging attacks as well as replay attacks. KYPS is a service that gives OTP access to websites that normally do not offer OTP access.

Security Tokens

Use of smart cards or other security tokens may improve security against replay attacks in the face of a successful keylogging attack, as accessing protected information would require both the (hardware) security token as well as the appropriate password/passphrase. Knowing the keystrokes, mouse actions, display, clipboard etc used on one computer will not subsequently help an attacker gain access to the protected resource. Some security tokens work as a type of hardware assisted one time password system, and others implement a cryptographic challenge-response authentication, which can improve security in a manner conceptually similar to one time passwords. Smartcard readers and their associated keypads for PIN entry may be vulnerable to keystoke logging through a so called supply chain attack[12] where an attacker substitutes the card reader/PIN entry hardware for one which records the user's PIN.

On-screen keyboards

Most on screen keyboards (such as the onscreen keyboard that comes with Microsoft Windows XP) send keyboard event messages to the external target program to type text. Every software keylogger can log these typed characters sent from one program to another. Additionally, keylogging software can take screenshots of what is displayed on the screen (periodically, and/or upon each mouse click).

Some on-screen keyboard programs use other techniques (such as dragging and dropping the password from the on-screen keyboard to the target program), though are still subject to the same vulnerabilities.

Anti-keylogging software

Keylogger detection software is also available. Some of this type of software use "signatures" from a list of all known keyloggers. The PC's legitimate users can then periodically run a scan from this list, and the software looks for the items from the list on the hard-drive. Two drawbacks of this approach is that it only protects from keyloggers on the signature-based list, with the PC remaining vulnerable to other unknown keyloggers, and also may not be able to detect a keylogger implemented as a rootkit.

Other detection software doesn't use a signature list, but instead analyzes the working methods of many modules in the PC, allowing it to block the work of many different types of keylogger. One drawback of this approach is that it can also block legitimate, non-keylogging software. Some heuristics-based anti-keyloggers have the option to unblock known good software, but this can cause difficulties for inexperienced users.

Keystroke Interference software

Keystroke Interference software is also available. These programs attempt to trick all keyloggers by introducing random keystrokes, although this only results in the keylogger recording more information than it needs to, which may be subsequently filtered out by an attacker.

Speech recognition

Similar to on-screen keyboards, speech-to-text conversion software can also be used against keyloggers, since there are no typing or mouse movements involved. The weakest point of using voice-recognition software may be how the software sends the recognized text to target software after the recognition took place.

Handwriting recognition and mouse gestures

Also, many PDAs and lately Tablet PCs can already convert pen (also called stylus) movements on their touchscreens to computer understandable text successfully. Mouse gestures utilize this principle by using mouse movements instead of a stylus. Mouse gesture programs convert these strokes to user-definable actions, such as typing text. Similarly, graphics tablets and light pens can be used to input these gestures, however these are less common everyday.

The same potential weakness of speech recognition applies to this technique as well.

Macro expanders/recorders

With the help of many Freeware/Shareware programs, a seemingly meaningless text can be expanded to a meaningful text and most of the time context-sensitively, e.g. "we" can be expanded "en.Wikipedia.org" when a browser window has the focus. The biggest weakness of this technique is that these programs send their keystrokes directly to the target program. However, this can be overcome by using the 'alternating' technique described below, i.e. sending mouse clicks to non-responsive areas of the target program, sending meaningless keys, sending another mouse click to target area (e.g. password field) and switching back and forth.

Window transparency

Using many readily available utilities, the target window could be made temporarily transparent, in order to hinder screen-capturing by advanced keyloggers.[citation needed] This would be unlikely to offer any advantage however; the user would have to be able to view the window being used in order to use it; as would a keylogger taking screenshots.

Non-technological methods

Alternating between typing the login credentials and typing characters somewhere else in the focus window[13] can cause a keylogger to record more information than they need to, although this could easily be filtered out by an attacker. Similarly, a user can move their cursor using the mouse during typing, causing the logged keystrokes to be in the wrong order e.g. by typing a password beginning with the last letter and then using the mouse to move the cursor for each subsequent letter. Lastly, someone can also use context menus to remove, copy, cut and paste parts of the typed text without using the keyboard.

Again, these are of little use against many keyloggers, which would simply record which window was being used, and taking a screenshot on every mouse click.

Another very similar technique utilizes the fact that any selected text portion is replaced by the next key typed. E.g. if the password is "secret", one could type "s", then some dummy keys "asdfsd". Then these dummies could be selected with mouse, and next character from the password "e" is typed, which replaces the dummies "asdfsd".

See also

References

  1. ^ Jonathan Brossard (2008-09-03). "Bypassing pre-boot authentication passwords by instrumenting the BIOS keyboard buffer (practical low level attaks against x86 pre-boot authentiation softwares)" (PDF). Iviz Technosolutions. Retrieved 2008-09-23. {{cite journal}}: Cite journal requires |journal= (help); External link in |publisher= (help)
  2. ^ Microsoft. "EM_GETLINE Message()". Microsoft. Retrieved 2009-07-15.
  3. ^ "Keyghost". keyghost.com. Retrieved 2009-04-19. {{cite web}}: External link in |publisher= (help)
  4. ^ Jeremy Kirk (2008-12-16). "Tampered Credit Card Terminals". IDG News Service. Retrieved 2009-04-19.
  5. ^ Berkeley.edu
  6. ^ "Remote monitoring uncovered by American techno activists". ZDNet. 2000-10-26. Retrieved 2008-09-23.
  7. ^ Martin Vuagnoux and Sylvain Pasini (2009-06-01). "Compromising Electromagnetic Emanations of Wired and Wireless Keyboards". Lausanne: Security and Cryptography Laboratory (LASEC). {{cite journal}}: Cite journal requires |journal= (help)
  8. ^ "ATM camera". snopes.com. Retrieved 2009-04-19. {{cite web}}: External link in |publisher= (help)
  9. ^ "The Security Digest Archives". Retrieved 2009-11-22.
  10. ^ A. Young, M. Yung, "Deniable Password Snatching: On the Possibility of Evasive Electronic Espionage," IEEE Symposium on Security & Privacy, pages 224-235, May 4–7, 1997.
  11. ^ John Leyden (2000-12-06). "Mafia trial to test FBI spying tactics: Keystroke logging used to spy on mob suspect using PGP". The Register. Retrieved 2009-04-19.
  12. ^ Austin Modine (2008-10-10). "Organized crime tampers with European card swipe devices". The Register. Retrieved 2009-04-18.
  13. ^ Cormac Herley and Dinei Florencio (2006-02-06). "How To Login From an Internet Cafe Without Worrying About Keyloggers" (PDF). Microsoft Research. Retrieved 2008-09-23.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Keystroke_logging&oldid=367417779"