Eng. Hector M Lugo-Cordero, MS CIS4361 Department of Electrical Engineering and Computer Science February, 2012 University of Central Florida

What is keystroke logging? A keylogger is a program that runs in the background or hardware, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker A keylogger is a program that runs in the background or hardware, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker Attacker checks files carefully in the hopes of either finding passwords, or possibly other useful information. Attacker checks files carefully in the hopes of either finding passwords, or possibly other useful information.

What is keystroke logging? Key loggers, as a surveillance tool, are often used by employers to ensure employees use work computers for business purposes only Key loggers, as a surveillance tool, are often used by employers to ensure employees use work computers for business purposes only Such systems are also highly useful for law enforcement and espionage Such systems are also highly useful for law enforcement and espionage Keystroke logging can be achieved by both hardware and software means. Keystroke logging can be achieved by both hardware and software means.

The good, the bad and the ugly  Good: companies can monitor the productivity of an employee, also useful for software developing.  Bad: Espionage  Ugly: External hardware can be caught easily and software installation without user noticing is hard.

Hardware key loggers Come in three types:  Inline devices that are attached to the keyboard cable  Devices which can be installed inside standard keyboards  Replacement keyboards that contain the key logger already built-in

Some hardware keyloggers  Hardware KeyLogger Stand-alone Edition a tiny hardware device that can be attached in between a keyboard and a computer. Hardware KeyLogger Stand-alone Edition Hardware KeyLogger Stand-alone Edition  Hardware KeyLogger Keyboard Edition looks and behaves exactly like a normal keyboard, but it keeps a record of all keystrokes typed on it. Hardware KeyLogger Keyboard Edition Hardware KeyLogger Keyboard Edition  KeyGhost Hardware Keylogger a tiny hardware device that can be attached in between a keyboard and a computer. KeyGhost Hardware Keylogger KeyGhost Hardware Keylogger  KeyKatcher Keystroke Logger a tiny hardware device that can be attached in between a keyboard and a computer. KeyKatcher Keystroke Logger KeyKatcher Keystroke Logger

Keylogger The Hardware KeyLogger™ Stand-alone Edition is a tiny hardware device that can be attached in between a keyboard and a computer. It keeps a record of all keystrokes typed on the keyboard. The recording process is totally transparent to the end user. The keystrokes can only be retrieved by an administrator with a proper password. BEFORE AFTER

Hardware KeyLoggerTM Keyboard Edition The Hardware KeyLogger™ Keyboard Edition looks and behaves exactly like a normal keyborad, but it keeps a record of all keystrokes typed on it. The recording process is totally transparent to the end user. The keystrokes can only be retrieved by an administrator with a proper password.

KeyKatcher The KeyKatcher is a hardware device to log activity as it is performed on the keyboard. The device works with any PS/2 keyboard and is not dependant on the operating system because there is not any software required for the manufacture to product to interact with the hardware. The KeyKatcher records up to 32,000 bytes (keystrokes) in the 33k model or 64,000 bytes (key strokes) in the 64k model. Even if the device is unplugged from the keyboard it will still remember EVERYTHING and you wont lose a single keystroke.

Interacting with keylogger Interacting with the Keystroke logger is simple, it can be done from any PS/2 compatible keyboard/computer. You can take it off the computer it is on to examine the data on another computer or perform the audit from that computer. Enter into a text program. Type the passphrase which was set, the menu will be displayed, you can navigate through the menus by entering typing in the number corresponding with the command.

Other approaches There are other approaches to capturing info about what you are doing.  Some keyloggers capture screens, rather than keystrokes.  Other keyloggers will secretly turn on video or audio recorders, and transmit what they capture over your internet connection.

Software Key Logging  Easy to implement – code is relatively normal.  Hard to install – user can notice the presence of it.

Problems with installing a Key Logger  An attacker that connects to the target to download the keystrokes risks being traced.  A code that sends the information to an address risks exposing the attacker.

Secure ways to install a key logger  Program can be distributed through viruses and/or worms and attacker can claim to victim of it if s/he is caught.  Use cryptography to prevent others from discovering the content and later decode it later.

Examples of key loggers  Magic Lantern  developed by the FBI  is installed remotely via attachment.  All in One Keylogger Spy Software  sends encrypted logs to desired  tracks all users activity

Examples of key loggers (cont.)  Wiretap Pro  specializes in Internet monitoring  records chats, s, web sites visited  Ardamax Keylogger  monitors user activity in an encrypted way  data is stored as text or web page  used to maintain backups or monitor kids.

Defending from a key logger  Have our computer up to date with:  Keep net firewall on  Anti-spywares  Anti-viruses  Check USB ports and PS/2  Check programs installed  Also we can maintain a practice of using only the soft keyboard (on screen). However is not completely secure.

References        

Questions