2.2 Implants: Types, Ways of Injection, and Methods of Protection
127
Unfortunately, both of these conditions aren’t met in any of the operating systems
except for Windows NT. Therefore, in order to improve their protection from imitators, one can use administrative measures, e.g., oblige every user to promptly inform
the system administrator if the first login attempt fails regardless of the correctly
entered identification name and password.
2.2.4.3 Filters
Filters are after all the data input into the operating system user with the help of a
keyboard. The most basic filters simply transfer the intercepted keyboard input to the
hardware or another place accessible by the intruder. More sophisticated implants of
this type analyze the intercepted data and filter the information associated with user
passwords.
Filters are resident programs intercepting one or several interceptions related to
processing of keyboard signals. These interception operations return the information
on the key pressed and symbol input, which is analyzed by filters to identify data
related to the user password.
Several filters are known that were specially created for various versions of DOS
operating system. In 1997, filters for operating systems Windows 3.11 and Windows
95 were created.
It should be noted that creation of such software implant is not exactly a difficult
task. Windows 3.11 and Windows 95/98 employ a special software mechanism,
which helps solve a number of tasks related to accessing the keyboard input, including
the problem of support of national keyboard layouts. For example, any keyboard
Russifier for Windows is nothing but a filter, since it is designed to intercept all
data input by the user with the help of the computer keyboard. It is not difficult to
improve such programs to make them intercept passwords in addition to their main
function (support of national keypad layout). Moreover, Windows user manuals and
tutorials contain source codes of software keyboard Russifiers. After tuning this
Russifier to make it assume the keylogger functions, it can be embedded before the
actual Russifier or after it; as a result, all the information input by the user with the
keyboard will pass through the keylogger. Thus, filter creation becomes so simple
that it doesn’t even require the intruder to have any type of special knowledge. The
intruder only needs to introduce the created implant in the operating system and hide
its presence artfully.
In general, it can be said that if an operating system allows the user to switch
keyboard layout during password input, it is possible to create a filter for such system.
Therefore, to protect a system from filters, one needs to ensure compliance with the
following three conditions:
• Switching between keyboard layouts during password input is not allowed;
• Only the system administrator can configure the chain of software modules taking
part in operation with the user password;
• Only the system administrator has access to files of these modules.
127
Unfortunately, both of these conditions aren’t met in any of the operating systems
except for Windows NT. Therefore, in order to improve their protection from imitators, one can use administrative measures, e.g., oblige every user to promptly inform
the system administrator if the first login attempt fails regardless of the correctly
entered identification name and password.
2.2.4.3 Filters
Filters are after all the data input into the operating system user with the help of a
keyboard. The most basic filters simply transfer the intercepted keyboard input to the
hardware or another place accessible by the intruder. More sophisticated implants of
this type analyze the intercepted data and filter the information associated with user
passwords.
Filters are resident programs intercepting one or several interceptions related to
processing of keyboard signals. These interception operations return the information
on the key pressed and symbol input, which is analyzed by filters to identify data
related to the user password.
Several filters are known that were specially created for various versions of DOS
operating system. In 1997, filters for operating systems Windows 3.11 and Windows
95 were created.
It should be noted that creation of such software implant is not exactly a difficult
task. Windows 3.11 and Windows 95/98 employ a special software mechanism,
which helps solve a number of tasks related to accessing the keyboard input, including
the problem of support of national keyboard layouts. For example, any keyboard
Russifier for Windows is nothing but a filter, since it is designed to intercept all
data input by the user with the help of the computer keyboard. It is not difficult to
improve such programs to make them intercept passwords in addition to their main
function (support of national keypad layout). Moreover, Windows user manuals and
tutorials contain source codes of software keyboard Russifiers. After tuning this
Russifier to make it assume the keylogger functions, it can be embedded before the
actual Russifier or after it; as a result, all the information input by the user with the
keyboard will pass through the keylogger. Thus, filter creation becomes so simple
that it doesn’t even require the intruder to have any type of special knowledge. The
intruder only needs to introduce the created implant in the operating system and hide
its presence artfully.
In general, it can be said that if an operating system allows the user to switch
keyboard layout during password input, it is possible to create a filter for such system.
Therefore, to protect a system from filters, one needs to ensure compliance with the
following three conditions:
• Switching between keyboard layouts during password input is not allowed;
• Only the system administrator can configure the chain of software modules taking
part in operation with the user password;
• Only the system administrator has access to files of these modules.