13

I may be dreaming here,

But is there a reliable method for keylogger software detection? I'm primarily a developer but I run a couple servers and the thing that worries me most is a software keylogger on my personal system that does a good job of keeping quiet.

Is there any way to be sure there isn't a software keylogger on my personal system snagging all my RDP passwords?

|improve this question
  • This would be one argument for using a password manager that can enter your passwords automatically, so you don't have to type them in every time. – David Z Jul 12 '09 at 2:01
  • Doesn't RDP allow for using client certificates, like supported by SSH? If not, then what about using SSH to tunnel into the server and then somehow start RDP? (On the other hand: if one is afraid of having a key logger installed, then a client certificate could be copied as well...) – Arjan Jul 12 '09 at 10:30
5

If you aren't careful about how you trust and authenticate your RDP connections - your passwords and anything else you type is easily snaggable in near real-time over the network any way... so why worry about local keyloggers? ;)

As some have already said, no - there is no reliable way. A rootkit can easily make itself completely undetectable for all eternity without even having to disguise as another processes. Nothing is secure. Stuff is just insecure to varying degrees ^^

One trick could be to wipe the system and install it without being connected to a network. Set up Bitlocker using TPM and have it verify that all system files are unmodified on each boot - and let it deny you booting/decrypting if not (then you'll have to do a controlled wipe again). Still, there are certainly still flaws where a keylogger could be installed without being detected.

All in all, using only passwords aren't nearly good enough for anything requiring a moderate level of security. Two-factor authentication with one-time-use passwords would help, as would smartcard-based authentication or other independent device certificate-based authentication.

|improve this answer
2

Ideally, your servers will be pretty tight - are these corporate servers or personal servers which also are used for web surfing?

In general, I don't believe there is any "one" way to reliably detect any arbitrary keylogger, but these general things may help.

  • Check the Task Manager. If there is any task running that you do not recognise look it up using Google.
  • Use msconfig to determine what is running at start up
  • Ensure your anti-virus software is up-to-date
  • Run a program like Malwarebyte's Anti-Malware, or Spybot Search&Destroy
  • Perform a search for the most recent files stored and check anything which is continually being updated
|improve this answer
  • 1
    The servers are tight, it's the my machines connecting to the servers I'm concerned about. I've done all of the above but none of those present a sure way of detecting a keylogger. Tasks disguise themselves as svchost or rundll, there are plenty of other ways an app can start besides what's in msconfig, anti-virus doesn't catch everything and keyloggers could be keeping all my keystrokes in memory – Spencer Ruport Jul 12 '09 at 0:21
2

There can be no reliable way unless you fully control the client system's hardware, because there are also hardware keyloggers.

And even if you do, there is still the old camera trick.

|improve this answer
  • I'm the only one connecting to these servers so I'm not worried about hardware keyloggers or cameras. Just software. – Spencer Ruport Jul 12 '09 at 0:19
0

You could try running something like KeyScrambler to protect yourself. From what I understand, it hooks into the system at the kernel level and sends any programs hooked into the global keyhooks (keystroke loggers) gibberish information.

Other than that, theoretically you can create a program that monitors at least the api calls, but I wasn't able to locate one.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.