Slashdot Mirror
Keystroke Logging Increases
JamesAlfaro writes "Hackers are likely to release more than 6000 keylogging programs this year--up 65 percent from the number in 2004--according to Reston, Virginia, security vendor iDefense." From the article: "Each variant could lead to anything from a few to several thousand infections, Ken Dunham, senior engineer at iDefense, said. Keylogger software typically tracks keystrokes on infected computers and is used to try to steal sensitive information such as user names and credit card data. The biggest problem with keyloggers, which silently relay data to attackers, is that they often go undetected, easily slipping past firewalls and antivirus software, iDefense, a division of VeriSign, said. "
For the moment it's fairly easy to find out when a machine has spyware. What would scare me is when a decent programmer will start to write such programs so that it is completely stealth and doesn't bring the machine to a grinding halt. After all, basically all spyware seems to be badly written and performance not an issue at all. A decent programmer, using all his skills could write a stealth spyware/keylogger that doesn't bog down the computer and goes undetected for a very long time. It shouldn't do popups, but just log the keys... A small background prcess could do this, and store locally, detect when a big download is started to camouflage its own traffic to the server by sending it while the big file gets downloaded. The day that that happens: we'll be all screwed.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
Hackers are likely to release more than 6000 keylogging programs this year
Will there be a firefox plugin for one of those babies? Or am I still gonna be missing out on all the fun this year also?
Good thing I type everything in with charmap.
ßöôÝà!
easily slipping past firewalls and antivirus software, iDefense, a division of VeriSign, said.
But for $99.95 per system per day you can buy magic beans from iDefense that protect you against them, right?
I've had enough abrasive sigs. Kittens are cute and fuzzy.
"Next year to be really, really scary on the computer security front", says a company which makes money from designing Comprehensive Solutions to Security Threats yet cannot decide whether keyloggers are silent but lethal or whether they have observable symptoms like a system slowdown (because you KNOW your 1 GHz Pentium just crawls when it tries to do processor-intensive tasks like parsing keyboard input). Honestly, these kind of folks give security research a bad name. Its like the doctor down the street who says "Hey, AIDS cases are likely to increase next year -- symptoms include coughing or feeling less energetic than you usually do. Be afraid!"
Help poke pirates in the eyepatch, arr.
Password Security doesn't mean a damn when you're getting logged or someone is sniffing them over a network
Change your passwords regularly.
If that's too much trouble, rotate easy to remember (yet secure) passwords
While you're at it, change the password on your luggage.
[Fuck Beta]
o0t!
I've been considering building some sort of e-commerce appliance for my less technically-inclined family members...essentially a low-end PC that will only boot off a Puppy Linux CD. All online financial transactions would take place only over this PC. Since the whole OS is on CD, it's fairly immune to the traditional spyware strategies (being Linux helps a bit as well
____
~ |rip/\/\aster /\/\onkey
How do they know you say?
By infecting the hackers with keyloggers offcourse!
Fortunately, Microsoft Keylogger 2006 will be included with Vista, and will report all your passwords to Redmond in a convenient and user-friendly way, establishing a de-facto industry standard in modern keylogging solutions.
Real Daleks don't climb stairs - they level the building.
The first line of defense against these things is avoiding the trap of downloading things that may contain them. Same old saw: don't download anything from people you don't know or trust. Don't open suspicious emails. Problem is, no matter how much you say it, the common computer-user doesn't heed the warnings. People are too gullible for their own good and there are so many get-rich-quick, boy-that-sounds-interesting types out there that its only a matter of time before one of these things spreads
Of course, what the article fails to mention is the corporate use of keyloggers, to see just what you've been saying on Slashdot, or worse, the number of people who install them on purpose to trap an unwary spouses or their mischievous kids.
Ultimately, we should all be installing anti-keylogging software right along with our anti-virus. That will work, until the forces of evil come up with the next generation of spyware.
GetOuttaMySpace - The Anti-Social Network
Why spend actual money (even a low-end PC costs you what, a couple hundred dollars) just because of the hype, especially when you know darn well the likelihood of it ever getting booted up is zilch (particularly if technologically less-than-savvy people get an urgent "Don't wait, update your account information today!" email in their inbox -- which, incidentally, leaves them 100% as screwed no matter what Linux distribution you're using)
Help poke pirates in the eyepatch, arr.
[Fuck Beta]
o0t!
Actually, it could be argued that AMD makes one heck of an appliance.
Yes, it runs Windows. However, it's a rather obscure variant of Windows, blending WinCE and XP. Hopefully that doesn't mean that it's open on BOTH sides, instead of none.
It's $300 at RadioShack.
... make me glad I'm a Linux user. A quick ps auwx will show me if there are evil deeds afoot.
Meh.
Obviously software keyloggers are a huge threat. But there are also hardware keyloggers that hardly ever get mentioned. They get plugs in usually between your ps2 port and your keyboard. They are very small and can store MB's of data. Since people hardly ever look back there, they are very hard to detect. Of course physical presence is required to use this, but I'm sure some of my coworkers would love to play with one of these.
http://www.stockmarketgarden.com/
The Sony rootkit for a keylogger? Then we'd only have to worry about 5999 others!
Is it just my observation, or are there way too many stupid people in the world?
Since the whole OS is on CD, it's fairly immune to the traditional spyware strategies (being Linux helps a bit as well ;) ).
Fortunately I do my keylogging with a keyboard dongle, which is cross-platform and supports linux.
Beware windows apps with calls to SetWindowsHook() with WH_KEYBOARD or WH_KEYBOARD_LL as the idHook
Enjoy
While I'm not sure how common they are on Linux, lots of spy/snoop/etc programs are memory resident.
/side question: whatever happened to encrypted meta/polymorphic viruses, trojans and worms?
So even if there's no fixed disk for the prog to store itself on, it can do its dirty deeds until the next reboot.
[Fuck Beta]
o0t!
I was told once that on unix based systems (unix, linux, OSX), when a window pops up asking for an admin password to do something, software keyloggers can't capture what you type in because that window process is a root process.
Is that true?
Let's all automatically use a keylogger that posts to Livejournal.com. Of course, it will be called "Keyblogging".
all you need is your mouse and the "Character Map" program. No need to use your keyboard.
Sure this post took me 10 minutes to type (or copy and paste I should say), but those hackers won't have a clue!
Hackers are likely to release more than 6000 keylogging programs this year.
They're also likely to release more than 6,000,000 keylogging programs this year. They're also likely to release more than 1 keylogging program this year.
What a stupid statement. oh wait, its from a vaporous, dot-bombish, DC-metro "computer security" company looking for page hits, blogs, and "press release" publicity on Yahoo! Finance.
I want to delete my account but Slashdot doesn't allow it.
More info here:
http://security.resist.ca/keylog.shtml
Anti-Key logger:
http://www.anti-keylogger.net/
FCheck: http://www.geocities.com/fcheck2000/fcheck.html
I don't know if will stop a keystroke logger, but it is a cool idea, nonetheless: http://www.kittytech.com/defaultx.html
He who knows best knows how little he knows. - Thomas Jefferson
Part of the problem with computers getting bogged down and popups coming out the wazoo is that more than one program can (and probably will) slip in through the same IE exploit.
So it doesn't really matter how many uber-l33t pieces of crapware are out there, because there will always be people exploiting the same holes but doing it with buggy programs.
[Fuck Beta]
o0t!
To be effective don't keystroke loggers written for windows need to use system hooks that should make them all relatively easy to detect? I'm not sure what OSs they will be released for, but I would assume that Windows would be the major target.
Those who know, do not speak. Those who speak, do not know. ~Lao Tzu
I really like the idea and could have some very cool applications. But I'm not sure less-tech savy users would be one of them.
I mean, it seems like a bit of a catch 22 to market an active security solution (ie, think about security before every transaction, instead of a one-time install) to a group who has security problems precicely because they don't want to concern themselves with security 24/7.
The real question is how many keyloggers are actually installed and reporting back now, as opposed to last year or 5 years ago. Just becuase there are more, doesn't mean there are more actually running. This would be an interesting statistic, if someone has it.
He's a sharp cookie, that Ken.
King Roland: The combination is: one . . .
Dark Helmet: One.
Col. Sandurz: One.
King Roland: Two . . .
Dark Helmet: Two.
Col. Sandurz: Two.
King Roland: Three . . .
Dark Helmet: Three.
Col. Sandurz: Three.
King Roland: Four . . .
Dark Helmet: Four.
Col. Sandurz: Four.
King Roland: Five . . .
Dark Helmet: Five.
Col. Sandurz: Five.
Dark Helmet: So, the combination is: one, two, three, four, five. That's the stupidest combination I ever heard in my life! That's the kind of thing an idiot would have on his luggage!
After the interrogation
Dark Helmet: It worked, sir. We have the combination.
President Skroob: Great. Now we can take every last breath of fresh air from planet Druidia. What's the combination?
Dark Helmet: 1 2 3 4 5.
President Skroob: 1 2 3 4 5? That's amazing! I've got the same combination on my luggage! Prepare Spaceball 1 for immediate departure!
Dark Helmet: Yes, sir!
President Skroob: And change the combination on my luggage!
I work for a university and supervise multiple public computer labs for students.
One of our employees decided it would be a brilliant idea to install a key logger on a handful of our computers. Our security software would have easily detcted/prevented the installation, but this employee had administrator passwords, allowing him to bypass the security software (since then, passwords have been restricted, which leads to massive inefficiency but higher security). He quietly disabled the security - especially anti-virus - software on these computers and let the program do its work.
The key logger was discovered approximately 6 weeks later when an icon for it randomly popped up on the desktop (I do not know the name of the key-logger software). A patron reported the strange icon, and the lab assistant reported it to management.
All 600 people who had used these computers in the last 6 weeks were notified almost immediately of the breach and instructed to change all their passwords and monitor their credit reports for suspicious activity. A lengthy FBI investigation began, and finally one employee was singled out. Luckily, there is no evidence he used any of the information he had gleaned from these computers.
This employee faced jail time, but ended up accepting a plea bargain for 5 years probation and a $5,000 fine. He has since fled the country.
Moral of the story - these things are quite serious when installed on the right computer, and those that install them in person could receive jail time. Now, even one hint of a key logger appearing on a computer in the labs is enough to drag in all of our technical staff at any hour to heavily investigate and reimage all nearby computers. We'd rather not have to go through any more investigations with the FBI.
An obvious solution is setting input to right-to-left, and then typing backwards!
.txt file on your Windows desktop. Additional security can be provided by storing the file in Shared Documents instead, but just make sure your WiFi AP is unencrypted and broadcasting its SSID.
Alternatively, you may just simply store all your passwords in a
This is a sig. It is appended to the end of comments I post.
What difference does it make whether there are six, six thousand or six million? They all work in basically the same way, and only the one that's installed on /your/ PC is the one you should be worried about. This is just frighten-hype to sell some kind of product or service. An increase in the supply of these programs (which is highly doubtful - see below) isn't proportional to their successful application.
Honestly, the FTC should ask them to list all six thousand programs, with a code sample for each and an explanation why one is different from the next, along with all known information about the authors. They'd be hard pressed to find sixty.
Check out Pest Patrol's online scanner.
I used it to find a keylogger that my sister's dipshit boyfriend put on her computer.
This is why you should use strong, default-deny egress rules on your network - especailly if you have confidential data.
Especially at small organizations, people think they are protected if they just have some ingress rules that (supposedly) stop the bad people getting in. However, you've got to stop your PCs from making connections *out* to random addresses.
Oolite: Elite-like game. For Mac, Linux and Windows
Those people are called "crackers". Hackers are an entirely different breed who can be learned of from ESR's website.
... to create a program that simulates all the keystrokes to "War and Peace"
Do you really think that the non-geek members of your family will actually bother to boot to a CD and use a completely unfamiliar Os and web browser??
My Grandma probably hasn't even rebooted her computer in months... Let alone run critical updates or checked her Antivirus!
Yes, hackers are not destroyers of lives... Idiots in the media make hackers look bad. Ethical hackers are the people doing this security research. Hackers test computer system security, sometimes illegally yes, but they never destroy data or intentionally cause problems. Crackers are the ones making the keyloggers, and breaking into systems on the internet just to abuse them or destroy data. People need to hear this message, and quit frowning upon hackers.
---
Ignorance may be bliss, but knowlege is power.
If you have access to a computer (or more specifically behind a computer) just add one of these:
for PS/2 Keyboards
or for USB Keyboards
Anti-virus and anti-spyware won't protect you from this kind of technology.
And they said zombies weren't real!
"yet" being the key word here.
/. password
Now that the trolls know your
Your karma is going straight to hell
[Fuck Beta]
o0t!
I will belive it when i see it.
Did these people know there would be a major increase in zombies? or smtp worms? or even IM worms. i dont belive so. So im not going to belive what bullshit they say.
Simply pry up the keys from your keyboard and put them back in a different order! It's foolproof! Arwvbnst bsforssd msscoidgs!
In trying to assist the average Windows user, I think Microsoft could do something to help aid fight against unauthorized spyware/viruses:
When I open the task manager to view all my running processes, there are usually a ton of programs running. Some I recognize (explorer.exe, System, firefox.exe, etc.) but some I have no idea what they are. Some are from my firewall (BlackIce), some are anti-virus (mcshield.exe), some are other system processes (mdm.exe: the machine debugger), and some I just plain do not know what they are. There are various sites where I can search for these programs, but when there are 50-60 in the list, it gets quite tedious. What would be nice is if the task manager actually produced a mouse-over popup (much like an 'alt' tag in HTML) that gives information about the process. Now this would have to be part of task manager, and not a factor of the application, or malware could just say that its some important legitimate file. I don't know if this is possible, feasible, or even necessary, but I know it would make it a whole lot easier for me to examine all of my currently running processes.
Just a though in light of the keystroke logging article.
And they said zombies weren't real!
This company is all about making sales pitches and has been spreading FUD since at least 1999. I remember all the way back to the sensationalization of the so-called Israeli-Pakistani Cyber War... Which was more like a couple script kiddie hacker groups defacing web pages.... Ohhhh but they called it a Cyber War.... I would take anything you hear from these guys with a very big grain of salt.
--Remember when they were in hot water for simply rewriting other people's materials and not citing original author or when Jericho and the Attrition crew started to campaign against them...
(I will give them credit for a few decent vulnerability discoveries though, but I tend to stay away from their reporting of cyber news...)
News Reporters Make Tasty Polar Bear Treats!
And this is all it takes these days to get a front page mention on Slashdot.
These keyloggers have actually been released by the University of Arts and Technical Studies in order to test the age old myth that a million monkeys at a million keyboards will eventually type the entire works of Shakespeare...
Make sure you use File Alteration Monitor Daemon then. Attackers often replace ps, top, login etc. with alternate, infected versions, so you don't see their software working. Of course that famd data can be replaced too, but just another security tool won't do any harm.
May Peace Prevail On Earth
Ok. I'll bite. I've been using Opera as an alternative to IE for two years now (in conjunction with Ad-Aware, Spybot, and AVG). For a few websites, I still had to use IE last year but it seems that Opera has become supported enough that with the updates, I don't hardly ever need to use another browser. I can't say that I've investigated Firefox much at all. Where does Firefox rank security-wise with your Operas and other alternative browsers?
6000 brands of keyloggers on countless machines, all collecting passwords. Who needs Carnivore and the backdoor key with this mess?
Gilmore's law ('The internet treats censorship as damage and routes around it') apparently also applies to free-market pressures to subvert security, even if it is white-hat security goals that are preventing something like Carnivore's back-door.
Ok. Let me preface this by saying that I probably wouldn't recommend keeping an unsecured text file full of passwords and financial data.
That said, in theory, could the same concept be applied by creating such a text file, say on a laptop you never connect to the internet, saving to floppy and then opening the file from the floppy on your desktop. When you want to enter such data, open the file, copy-paste. Would this accomplish the same thing? I'm ignorant to the concept really. Thanks.
Other planted articles that are startlingly similar:
The actual verisign press release with a cute graph
PC World with a seemingly verbatim copy of the press release
Again from Tech News World
And C|Net's news.com.com even copies the fun and [extreme sarcasm]ever so statistically meaningful[/extreme sarcasm] graph
It is nice to note that VerisSign's Nasdaq abbreviation appears in all of these articles within the first sentence. So I wouldn't be too worried because its not surprising that VeriSign wants us to fear keyloggers.
Chip Pan Fires on the Increase, says Chief of new Privatised Fire Brigade.
..... like you can be careful with Windows if you know how. But the real problem is that Windows, as it needs to be configured to work with certain applications, is insecure by design.
Anti-virus companies have a vested interest in there being malware out there. It wouldn't surprise me if they were encouraging the script kiddies. Dunno about anybody else, but I expect for software just to work, as it comes, and that goes double for software that you pay for. Imagine if you bought a phone, and then had to pay extra for the charger! Sure, you could use a laboratory power supply, if you already had one
Je fume. Tu fumes. Nous fûmes!
I find no link to an online scanner at pestpatrol.com
I just scraped all the letters off my keys! Ha! Try and see what I'm typeing now!!! This I saw this kewl keyboard. It comes with the letters already scraped off. SWEET!
"It's because they're stupid, that's why. That's why everybody does everything." -Homer Simpson
We are starting to see variants of CoolWebSearch popping up on computers at work (I work for my residence computer service). Anyone who has dealt with CWS knows it's a pain; few virus/spyware detectors find it. It blocks windows registry editor from showing values that give it's existence away (you need to use reglite or autoruns(which misses some). The variants are becomming even more tricky as silentrunners and CWShredder aren't catching them.
That and they don't noticably kill performance. As far as spyware goes, it's really best in class right now.
I have a tablet PC, I normally use the keyboard for text entry, and use the pen as a mouse and for art, since I type quicker than I write, but hey, maybe I should start using handwriting more often. Keylog that! :-)
Say that sounds great!
So as corporate customer of Microsoft's, how do I leverage this new, service oriented architecture they are developing? I would like to have access to an API that allows me to track my company's users and also see what my competition is up to. Will I be able to utilize my existing legacy infrastructure or will I have to upgrade every other installed service at my company to use this wonderful service you speak of?
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
It is just so much easier to key log a half asleep non computer literate person than to try and break the gazillion bit encryption schemes available. Its the weakest link that's going to get you every time.
Question: How do you "Find Files" on C: modified in the last day?
Why not just give them a live CD, and telling them to use that with their existing computer? That should be good enough, unless you really suspect that someone is breaking into their place and installing a hardware keylogger onto their machine.
Start - Search - Find Files
Linux:
Install Windows.
I have seen a small keystroke logger for PS2 cables listed in a computer parts catalogue for many years. According to the catalogue it needs to be attached to the end of of the PS2 cable on the keyboard. If I remember correctly, it suggested that it would be a good way for parents to keep track of what their children are doing on the Internet. How many people buy them for other purposes? Someone could stick one of those on someone elses computer for a few days and then retreive the device later. I was surprised that they could legally sell something like that.
How often do people bother crawling under their desk to look for something like that? On my computer there is a PS2 to AT keyboard adapter which looks very similiar. Some people do online banking while they travel at Internet Cafes, public librarys or other computers that are open to the public. Is that is safe or not? Remember the incident a couple of years ago where someone had secretly installed keystroke logging software at 14 Kinko's stores. He used software instead of hardware. According to one article "he captured more than 450 user names and passwords, using them to access and even open bank accounts online." He is the article:
http://castlecops.com/article2568.htmlIf I am not mistaken, employers are legally allowed to used keystroke loggers to monitor what their employees are doing and are also allowed to read employees email. It is best to be careful what you say about the boss in email messages at work. When you get to work perhaps you should crawl under your desk and check the end of the cable on your keyboard. Perhaps a co-worker or the boss might have installed one of those. Of course if software is being used you still might not know.
Thanks
Linux:
Install Windows.
Because that is the only way 'C: drive' has any meaning.
--Phillip
Can you say BIRTH TAX
Sending all your paswords to a central authority - wasn't that what MS Passport was all about?
Oh well, what the hell...
Passwords are like toothbrushes:
Marge: Ooh! A punchbowl like that just screams good taste. Wouldn't it
be perfect for the dinner party.
Homer: Oh, we can't afford that. Who do you think I am, Liz Taylor?
Marge: Well, maybe we could use it once, and then return it.
Homer: Marge, we're not talking about a toothbrush here.
If they can store terabytes upon terabytes of email, I'm sure they keep track of the last several IPs that the user logged in with. The government works especially hard with companies on stuff like this just so they can have access if they need it. They don't like it when it's impossible to find out info on someone.
You'd be suprised at how much is kept on users with the free *anonymous* email accounts.
My guess is that if you sent an email out using Hotmail/Yahoo to several news outlets saying that you were going to kill the president or someone, you would get a knock on the door by the FBI/CIA within a day or two.
http://www.keyghost.com/securekb.htm
The mouse truly *is* your friend. I haven't seen anybody suggest another rather *obvious* way to make sure your password is not being logged properly(at least by a keylogger): (1) When typing a password, type a "Cloaked" password. That is, add (groups of) characters that don't belong in your password (2) Before submitting your password, delete the groups of characters that don't belong AS BLOCKS. (3) IMPORTANT! Make sure the superfluous groups of characters added to your password is exactly the same *every* time (read on...) So, for example, if your password is really, "Star9!", get used to always typing something like: "Star123456789!" Then, before hitting enter, highlight with your mouse and delete the superflous characters AS ONE BLOCK in the appropriate place (in this case, a single block of eight characters, starting from the third leftmost). In this case, all what the keylogger will log is: Star123456789! *DeleteKey* So, for the person who reads you keylog file, his/her first impression will be that your password is "Star123456789". Then, even if they catch on to the fact that you are cloaking your password, they will have to try deleting every combination of keys, and GROUPS of keys, from your pre-DEL password. Good Luck to them. Chances are, unless the person trying to get your password is targeting you specifically, they will give up and move on to the next person for whom they have a keylog file. But even if it your husband/wife spying on you, with this method their goal of figuring out your password is at least encumbered somewhat. As for the "IMPORTANT" part in step (3), consider the case that for the password "Star9!", one day you use the cloak "Star123456789! *DeleteKey* ", and another day you use the cloak "Star987654321! *DeleteKey* ". The bastard reading the keylog file would have to be an idiot to not figure out, from those two cloaks, what your password is. So, memorize your "cloak" as well as you memorize your password, and you should be safe from keyloggers. Cheers, Mikey123
Damn corporate security policies!
Man, you really need that seminar!
Alt text: Windows automatic spell checker
I'm thinking your idea could easily be defeated by someone who knows how to get the keylogger installed on a remote computer.
That's just my opinion.
Ops, I shuld have usd the prevuwe but in.
et alli means "and other people." You want et cetera which means "and other things."