What do they look like?

Hardware keyloggers can be hard to spot. They are typically small and can be plugged into the back of a computer, unseen. They often look like a USB flash drive or a keyboard connector. They are easily found online; even Amazon has several them. If you see any device plugged into a computer that is not yours, consider this a red flag. While there is a good chance the device will look like one shown in the link or below, there are others out there.

Why are they legal?

While they may be useful in fraud and identity theft, they do have valid uses. In testing software, knowing exactly what a user did is useful to programmers. That can effectively pin-point a problem in code. Employers can use them to monitor the progress and productively of employees. Some manufacturers advertise them as a form of backup, keeping each page you write even if the power goes out. While arguments can be made that they are more often used for nefarious reasons, in the right hands, they are a useful tool.

Have they actually been found on public computers?

Yes. Earlier this year, there was a case where hardware keyloggers were found on library computers in Manchester. In three separate locations, the devices were found plugged into public access machines. The type used here was the kind that looked like a USB flash drive. Authorities advise greater vigilance, especially for the employees, but users need to be alert too.

It should be noted that it is generally unwise to use public computers for sensitive data. E-mail, banking sites, and credit card use should be avoided when on these computers. If you have to use them, here are some tips. Ask how the computers are protected. Do they block software installation? Are they wiped on reboot with software like Deep Freeze? If so, could they restart the computer for you (wiping out most software keyloggers)? Always use a secure connection (https) when possible, and be alert to your surroundings (e.g. watch those around you, know what is connected to the PC). This still is not as safe as a home computer running a live CD, but there is not much more you can do.

What do I do if I find one on a work computer?

It should go without saying that you should contact IT and your manager immediately. Should you remove it? Ask. If the company owns a PC, they can install a keylogger on it. What is deemed notification (if required) can vary by state and country. Typically, a software keylogger would be more conventional, so a hardware one is suspect. Chances are that it was planted, but if that is the case, then it is evidence. Physical and digital forensic information can be gathered. Let someone responsible for and trained for this handle it.

Should one of these devices be found on a server, the problem is much more severe. It highlights a lack of physical security. A strong firewall, good anti-virus software, proper permissions, and complex passwords will not protect you from a trick like this.

The Point: Awareness

The point of this article is to be aware of the existence of these deices. They do exist, but they are not commonly seen. If you do see one on a computer, let someone know. Chances are they are not supposed to be there. While they are legal to own, it is illegal to install them on computers for public use or on systems someone does not own.

An example would be an English user who needs to write a German ö. Sure, the user could press the combination Alt+0246 on the numpad to write that letter, but only if the code is known, and chance is it is not if it is not commonly used.

Virtual Keyboard is a Google Chrome extension that offers both benefits. It supports a wide variety of different keyboard layouts, including the default English keyboard, but also German, French, Spanish, Greek, Russian or Cyrillic keyboard layouts. More than 80 different layouts are supported by the extension.

virtual keyboard

The virtual keyboard is automatically displayed on every web page that displays at least one text form. Like the previously reviewed Virtual Keyboard userscript it fails to work on secure (https) sites which severely limits its protection against keyloggers. One would expect an add-on like this to work on secure sites as well, considering that those are often prime targets of attackers.

Only the English keyboard layout is available after installation. The Chrome user can use the options to add layouts to the program, to switch between them on the web pages it is displayed.

It is possible to switch between layouts in the header, or by pressing Ctrl-Q.

keyboard layouts

The lack of support for https sites makes it less usable from a security perspective. It is nevertheless helpful for users who have to type characters from different languages regularly in the web browser.

Google Chrome Virtual Keyboard is available at the Chrome extensions gallery.

Virtual keyboards defeat most keyloggers, who often concentrate solely on the computer keyboard, and not other means of text input.

The UserScript Virtual Keyboard Interface makes it a lot easier to work with virtual keyboards in supported web browsers.

virtual keyboard

Using a UserScript offers advantages over software based virtual keyboards. Two of the biggest advantages are better and faster accessibility of the keyboard on the screen.

Virtual Keyboard Interface supports text fields, password fields and text areas at the moment, which means that it cannot be used in the web browser’s address bar or search form.

The keyboard is displayed on the screen by double-clicking into the text field on the website. We actually had to triple-click to get it working, but that’s a minor problem.

The virtual keyboard is then displayed beneath the text field. It offers different keyboard layouts, for instance for US, Germany, Russian or Japanese users.

Keys are entered by left-clicking with the mouse on them. It is furthermore possible to change the size of the keyboard, which unfortunately does not stick after the page has been closed.

Virtual Keyboard Interface is compatible with Firefox and Google Chrome. Users of those web browsers can download and install the script from the official UserScripts website. Firefox users need the Greasemonkey extension before they can install the script.

Most security software programs detect and prevent keyloggers that are running on the computer system. The Anti-Keylogger Tester has been designed to test seven different methods of recording keystrokes on a computer system. A good security software should notice all seven methods and prevent access of the program. A bad one might catch only a few or none at all.

The portable software program works by clicking on one of the seven buttons in the main interface. Each button activates a different key logging method on the system. The security software should display a warning message once the buttons are pressed but at the latest when the user changes the focus to another window or application in the operating system.

All seven methods can be tested in a few minutes on a computer system. As mentioned earlier a good security software should spot all seven different key logging methods. It might be time to do some research for another one if it does not catch all or any of the key loggers.

It’s unfortunately only available in German but since it does not require lots of user input it can be valuable for non-German speakers as well. The only required input is a click on the button “Suchlauf Starten” to start the scan of the system. A check of the box below that button will perform a long scan of the system that requires a reboot.

Once started the application moves the mouse around and tests several behaviors. After a while it asks the user to input text. This happens three times to see if any of the running processes are reacting on the data input.

In the end all potentially dangerous applications are listed. The software seems to have troubles with Mozilla software because it did list several Firefox and Thunderbird files as potentially dangerous. The most dangerous files are listed at the top with their system path.

The KGB Keylogger can be configured to monitor all users or only selected users on the operating system. Each of the different ways to monitor a user can be activated and deactivated with ease. The logfile that is accessible is giving exact details about the activity, the data and time it took place, the event type (screenshot, website, keystroke for example) and the application that has been used.

The logs can be filtered by date and activity as well. The most important feature of a keylogger however is to remain hidden in the background. It would not make much sense to run a keylogger that is detected by the task manager or an antivirus software.

KGB Keylogger has a stealth function which hides it from various means of detection. AntiVir detected the keylogger during installation but it was not able to detect it running in the background after activating the stealth features. The keylogger is not visible in the task manager afterwards and does not appear in the system tray, as an desktop icon or start menu entry as well.

The keylogger can be configured to not only record keystrokes that are visible but also those that are not visible. The combination CTRL + ALT + TAB would also be recorded this way for instance.

It is possible to exclude applications from being logged or set a filter that only logs applications that have been added to it. You could configure it to only log activities in email clients and web browsers for instance.

Reports can additionally be send my email or uploaded to ftp with the option to clean the logs after a successful operation. This is a good way to keep an eye on a computer that is not locally accessible.

Features:

• Stealth mode and visible mode of work
• Logs keyboard input, including language-specific characters
• Logs Clipboard entries
• Monitors and logs network activities
• Custom list of monitored applications
• Detailed information for each log entry, including the time stamp, application name and window caption
• Screenshots at custom frequency (regular intervals or on mouse clicks)
• Export of logs into HTML

KGB Keylogger is a very versatile software that works incredibly well if you activate the stealth feature.I suggest you give it a try if you are looking for a great keylogger.

Some would say that this is the same principle that keyloggers use to record keys and they are basically right. Save my work saves every keystroke and everyone may access those if he knows where to look for them. While keyloggers try to disguise themselves the icon of this program is always accessible from the system tray.

I do however find it quite fascinating that Antivir did not object when I started save my work. The main feature is still the ability to save text automatically and copy / paste it when needed to avoid data loss.

Since WordPress (the blog software I’m using) introduced a auto save function I’m in no need of such a program anymore but it would have been handy before that. Another easier method would be to simply use CTRL + C to copy the text into the clipboard every now and then.

Save my work could be a security risk as well. It records all keystrokes which means that it also records usernames and passwords of sites that you visit. I would not recommend to start it with Windows, maybe only open it when you open your word processing program / email program and the like.

I would never use keyloggers to spy on someone but I have no problems using them on a computer that I use alone. It is up to you and your conscience if you want to use a keylogger like the perfect keylogger lite. If you do you should make sure to deactivate the anti-virus software and other security related programs that would detect the keylogger. I had troubles installing it on my system because Antivir popped up about 20 times warning me to continue.

If you use the keylogger you should make sure that it is really hidden from the task manager and the system tray. It should also be invisible in the start menu and the uninstallation dialog. The right tools will still detect the keylogger and disable it pretty quickly.

I had to link to the tucows download because the download of the lite keylogger was not working at the developers homepage.

This little device has apparently been used to pull of one of the greatest bank heist in history. You attach this device to the keyboard cable at the back of the pc and it´s able to record 130000 keystrokes. The bank robbers installed this device inside the bank and got access to Sumitomo Bank’s wire transfer capability. With all the information at their hand they proceeded to transfer more than 400 million $ to various foreign accounts.

The article at zdnet that I´am using as a source is called Super Glue, guess what the banks officials decided to do after they found out ? Right, they decided to glue the keyboard cables to the computer, making it impossible to connect a device in between.

The Anti-Keylogger does the same thing, only difference is, that its a tool that is started like every other windows program. After the tool is started you simply use the displayed keys to enter your passwords or other data on websites or even local programs.

Protection Details
MyPlanetSoft Anti-Keylogger (AKLog) will protect you against all system wide keyloggers. Almost all commercial keyloggers fall into this category.

AKLog will not protect you against:

• hardware keyloggers – theoretically if someone can access your computer, s/he can change the hardware of the computer so it can radio transmit remotely the keys you type
• keyboard drivers keyloggers – it is possible for someone to change your system keyboard driver with a custom one and log the keys
• keyloggers written specially for a given application – these keyloggers make use of knowledge of how a given application works and work only with that particular application

Its a nice little freeware tool that you can download at myplanetsoft.com.

Update: The program has not been updated for a while. Viable alternatives include the free version of SpyShelter which can protect the system from keyloggers, screen capturing and clipboard capturing malware, Anti-keylogger Free which protects against five types of keyloggers, and Keylogger Detector that tries to detect keyloggers that are installed or running on the system.

You can also install free security programs that include anti-keylogging apps. This includes the excellent Anti-Malware Free by Malywarebytes and SuperAntiSpyware Free.