Helping people with computers... one answer at a time.
Keystroke loggers can log a lot more than just keystrokes. We'll look at a couple of ideas for bypassing them, and the chances that you can.
Is there a way to bypass keyloggers? Suppose you go offline (file, work offline) to type in the password and go back online to submit the web page? Or suppose you use the on screen keyboard to enter the password or copy and paste the password?
Yes, no and maybe.
It all depends on the specific keylogger, but the answer is mostly no.
In fact, that's the only answer you can really depend on.
Let's look at your suggested work-arounds and why for the most part they might not work.
First off, a quick definition: a keylogger is spyware that does exactly what its name implies: it "logs" or records your keystrokes. Thus when you type in your user name and password to a web site or anything else, the keystrokes are recorded, the information saved, and somehow made available to the hacker that put the keylogger there.
Keyloggers can work several different ways:
They can send each keystroke immediately to some remote listener over the internet.
They can collect each keystroke in a temporary file, and then periodically upload that file to the author's location over the internet.
They can collect each keystroke in a temporary file, and much like a spam bot, listen for and receive instructions from the author - in other words the logger could upload the collected information when requested.
The collected keystrokes could never be uploaded. Instead, if someone has remote access to your machine, or ever worse physical access to your machine, they could simply come by and copy the information manually.
Finally, the information may not even be kept on your machine. There are hardware keyloggers that include a little flash memory and can be quickly inserted in between keyboard and computer to capture all the data. Some time after installing the person behind it stops by and picks up the device containing all your information.
Your "File, Work Offline" approach won't work because that's an instruction specifically to Internet Explorer or the application that has that option. Keystroke loggers are not going to play nicely by paying attention to that setting.
But even if they did, or even if you physically pulled the internet connection from the back of your machine, all but the first of those approaches will still work. They'll quietly collect data and then send it when an internet connection is available, or by some other means.
Now, let's look at exactly what a keystroke logger can log.
The most common, as the name would indicate, is keystrokes. Loggers typically do this by hooking into the keyboard driver, or some other low-level point within Windows where they can see each keystroke as it's being typed.
However, loggers can log other things as well, or use a different technique to log keystrokes. For example, rather than hooking into the "sending" device, like the keyboard, they can hook into the "receiving" software.
It's a little more complicated, but to use your copy/paste ideas as an example the logger could hook into all the data entry fields on a web page - including the password field. Then, when you hit "paste" it "sees" not the fact that you hit paste, but rather it sees the actual data that you're pasting in: your password.
There's another complication as well. By using the on-screen keyboard I'll assume you're using your mouse to "type". A sophisticated logger could easily:
Log your mouse movement and clicks
Take a screen shot each time you click
With those two alone the logger can see exactly what you "typed" by using the on-screen keyboard.
As you can see, a keystroke logger can log a lot more than just keystrokes.
The bottom line is simply this: you should never assume there's a way to bypass keystroke loggers. They could easily be more sophisticated than your attempts to work around them.
By far the only sure way to deal with keystroke loggers is simply not allow your machine to be compromised in the first place.
Comments on this entry are closed.
If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.
If you don't find your answer, head out to http://askleo.com/ask to ask your question.