2.4 Software Keyboard Spies
157
In solving tasks of protection from information leakage, sometimes only software
means for spying on the user’s work are considered. However, in addition to software
means, there are also hardware ones:
– Installation of a tracking device in the keyboard cable (for example, such device
can be designed as a PS/2 adapter);
– Embedding a tracking device into the keyboard;
– Data reading by means of TEMPEST registration;
– Visual tracking of the keyboard.
Hardware keyloggers are much rarer than software ones. However, when checking
extremely critical computers (e.g., the ones used to carry out banking operations),
the possibility of hardware monitoring of keyboard input shall not be disregarded.
2.4.2.4 Typical Example of a Keylogger
There are currently hundreds of keyloggers; let us consider a fairly well-known
commercial program ActualSpy (http://www.actualspy.ru) as an example. This
program can register keyboard input (recording the window heading and program
name), take screenshots according to a schedule, register program starts and stops,
and track the clipboard, printer, and files created by the user. Moreover, the program
provides tracking of Internet connections and visited sites. ActualSpy is used here
as an example (Fig. 2.13).
The program has the simplest way of protection from detection: it cannot be seen
in the standard list of Windows tasks. For analysis of the collected information, the
program forms protocols in the HTML format. Operating principle of ActualSpy is
based on the hook registering keyboard events.
Other examples can include SpyAgent (http://www.spytech-web.com), ActMon
(http://www.actmon.com), SpyBuddy (http://www.actmon.com), PC Activity
Monitor (http://www.keyloggers.com), KGB Spy (http://www.refog.ru/), etc. This
list could go on and on; however, in most cases modern keyboard spies have approximately identical functionality and differ in service functions and quality of masking
in the system.
2.4.2.5 Methods of Detection of Keyloggers
1. Signature-based search. This method is identical to typical methods of virus
search. Signature search helps the user unambiguously identify keyloggers; with
correct selection of signatures, the possibility of a mistake is close to zero.
However, a signature scanner is only capable of detecting previously known
objects described in its database.
2. Heuristic algorithms. As is evident from the name, these search methods are based
on specific features of a keylogger. Heuristic search is probability-based. Practice
shows that this method is especially effective when searching for keyboard spies
157
In solving tasks of protection from information leakage, sometimes only software
means for spying on the user’s work are considered. However, in addition to software
means, there are also hardware ones:
– Installation of a tracking device in the keyboard cable (for example, such device
can be designed as a PS/2 adapter);
– Embedding a tracking device into the keyboard;
– Data reading by means of TEMPEST registration;
– Visual tracking of the keyboard.
Hardware keyloggers are much rarer than software ones. However, when checking
extremely critical computers (e.g., the ones used to carry out banking operations),
the possibility of hardware monitoring of keyboard input shall not be disregarded.
2.4.2.4 Typical Example of a Keylogger
There are currently hundreds of keyloggers; let us consider a fairly well-known
commercial program ActualSpy (http://www.actualspy.ru) as an example. This
program can register keyboard input (recording the window heading and program
name), take screenshots according to a schedule, register program starts and stops,
and track the clipboard, printer, and files created by the user. Moreover, the program
provides tracking of Internet connections and visited sites. ActualSpy is used here
as an example (Fig. 2.13).
The program has the simplest way of protection from detection: it cannot be seen
in the standard list of Windows tasks. For analysis of the collected information, the
program forms protocols in the HTML format. Operating principle of ActualSpy is
based on the hook registering keyboard events.
Other examples can include SpyAgent (http://www.spytech-web.com), ActMon
(http://www.actmon.com), SpyBuddy (http://www.actmon.com), PC Activity
Monitor (http://www.keyloggers.com), KGB Spy (http://www.refog.ru/), etc. This
list could go on and on; however, in most cases modern keyboard spies have approximately identical functionality and differ in service functions and quality of masking
in the system.
2.4.2.5 Methods of Detection of Keyloggers
1. Signature-based search. This method is identical to typical methods of virus
search. Signature search helps the user unambiguously identify keyloggers; with
correct selection of signatures, the possibility of a mistake is close to zero.
However, a signature scanner is only capable of detecting previously known
objects described in its database.
2. Heuristic algorithms. As is evident from the name, these search methods are based
on specific features of a keylogger. Heuristic search is probability-based. Practice
shows that this method is especially effective when searching for keyboard spies