Keystroke Loggers - Detection and Prevention

Keystroke loggers, aka keyloggers, can take many forms and have evolved over the years. As the name implies, they log the keystrokes of your keyboard. After they log the keystrokes, they can send the logs to the person(s) who created/deployed the keylogger. Unfortunately, keylogging is still a worry in this day and age, but the good news is that with the prevalence of two-factor authentication, that worry is slightly diminished.

Keyloggers used to be mainly hardware based, and in recent years there has been some clever research in the security field to get users to willingly plug in a device that says it’s one thing, but is actually another. Some are disguised as a phone charger or a keyboard itself! There seems to be no shortage of tutorials and information on creating or buying a hardware keylogger.

Hardware keyloggers used to be easy to spot, but only if you looked for them. Often when dealing with a mess of wires, or even tucking away a wireless keyboard receiver, one could insert a keylogger and go unnoticed. They can’t really be detected from the computer itself, but with physical inspection, you should be able to spot them… however, as the links above show, there are some very clever people out there and a professional such as myself would probably never take notice of a “keysweeper” type of device.

With software, there are 1,001 ways to log keystrokes. Software keyloggers have the advantage over most hardware keyloggers, because software can make use of the network card and send the keystrokes to an attacker in real time. Windows 10 comes with the equivalent of a keystroke logger built in! You can opt out, but you are never asked to, therefore many people (and companies) continue on with the software sending keystrokes to Microsoft. Some of HP's computers have an audio driver that is supposed to listen for a certain keystroke, but is overzealous and listens to all keystrokes once a user logs in.

Again, there are tons of ways to get your keystrokes and not all of them are directly logging them from the keyboard. A screenshot could be effective, as can looking through your PC’s memory, or even the hibernation file in search of certain strings that help you locate things like passwords. That last item is an attack that is used against the popular password manager Keepass. (I covered what a password manager will and will not protect you from in two other articles—1, 2.) That is not to say a password manager hurts your security—quite the contrary. If you can, please use a reputable password manager. They avoid hardware keyloggers 100% of the time, and unless the malware/keylogger is specifically created to look for a password manager, you’re a lot safer having the manager input the password than not.

So again, I’ve painted a pretty bleak picture of what you can possibly be facing. On the upside, some of this is just research, and as for the others, anti-virus technology is pretty good about detecting their presence.