How to make sure your machine isn't software key logged ?

[Coincrazy]

Hi

I have 100% access to my machine or at least the repair / service guys do the service supervised

So a hardware key logger would be almost impossible

However a software key logger could be possible

How do I ensure that my machine does not have a software key logger ? I.e. that a software key logger isn't already on my machine ?

I use windows


TIA

Regards

Cc

[1715235799]

1715235799

[1715235799]

1715235799

[1715235799]

1715235799

[1715235799]

1715235799

[flavius]

dont download .exes from random emails?

[pekv2]

Anti-Keylogger is trial-freeware and pay for.

Take a read here.
Stay Safe

[FTWbitcoinFTW]

Just no way if the hacker use personnal / modified  source code.

Use Linux or offline PC in any important BTC transaction.
Use 2FA in any hot wallet or sensitive emails

A little trick on unsafe computer : when you start filling your password, you move and clik on the page, type 5 random caracter and come back to finish

Result :
password 12345
What is keylogged : 124$erRZ45

[btcbug]

A little trick on unsafe computer : when you start filling your password, you move and clik on the page, type 5 random caracter and come back to finish

Result :
password 12345
What is keylogged : 124$erRZ45

Wouldn't a decent keylogger also be recording mouse clicks and if you activated another text box and typed in random garbage it would be easy for the hacker to distinguish?

[FTWbitcoinFTW]

It's not in a other text box, this is the trick

The keylogger sees everything, but it doesn’t understand what it sees. The browser also sees everything, but it doesn’t use everything that it sees: it does not know what to do with keys that are typed anywhere other than the text entry fields, and lets them fall on the floor. The keylogger has no easy way to determine which keys are used by the browser and which fall on the floor.

http://arvindn.livejournal.com/123183.html


It's not 100% safe, but a good advice !

[doobadoo]

DON'T RUN WINDOWS AND BITCOIN YOU WILL EVENTUALLY LOSE YOUR WALLET!!!

Get an external USB 3.0 hard drive for like $50 bucks.   Or buy a 32 GB FAST flash card for about the same if you have an sdxc slot ( http://www.amazon.com/SanDisk-Extreme-Class-Memory-SDSDX-032G-AFFP/dp/B007M54E1M/ref=sr_1_3?ie=UTF8&qid=1366473824&sr=8-3&keywords=fast+sdxc )

Download your favorite flavor of linux right from the distro's sight.  Format and install on your external hd/flash card.  Boot from the external drive and run the os's updater, then install bitcoin.

launch firefox.
1)  Go to Tools-->Addons--->plugins and disable java
 2) now hit the addons tab and install addon called NoScript.  
3)restart FF.  

4)  before browsing to sites like mtgox, or blockinfo, enter private browsing mode,
5) Got to the bar at the bottom of browser window and click the "S" icon.   Make NoScript "Forbid Scripts Globally"
you may need to go back to the S icon and allow certain scripts to make the these sites work correctly.  Do so on a one by one basis, and only scripts that come from those sites or have domains you recognize.

6) don't be logged into anything else or have open tabs to other pages when using mt.gox etc.  Not even bitcointalk.org

7)  log out of mtgox or other online wallets. then exit private browser mode.  you can now set noscript back to allowing scripts globally for regular browsing

Don't install additional software on your linux drive.  If you must, make sure you get it from the package manager, and that it is a well followed project that is open source and would be highly unlikely to insert attack code.  Don't install adobe flash.

**EDIT***
Oh yeah, on linux machines the Firefox plugin to disable java is called iced-tea.  you know they rename everything with linux...  Java --->Iced Tea.  Those C++ Jokers!

[Coincrazy]

Thanks to all who replied

[cho]

there's a simple trick no keylogger I know of can fight against.
1. Open some text editor
2. Type "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789,.;-_"... (I typed alphabetically as an example, but a simpler and better strategy is to hit every key on the keyboard in sequence)
3. Copy/paste each character in your password one by one.

This is very solid against keyloggers.
It's a pain with long passphrases, though.
It's very bad against the "people in your back looking over your shoulder" attack too

[cho]

After having written the last post with the copy/paste trick, I've been thinking about this.
What about a keylogger that would log the full content of a textbox everytime it changes ? Has anyone ever seen this in action ? Sounds like a good strategy for a keylogger, isn't it ?

[Kazu]

Back up your files reinstall OS from a boot-up CD. Thats the only real way of making sure.

[NoL1m1tZ]

There is a whole lot of stupid going on in this thread... If you're scared that you have a keylogger disconnect from the internet, boot into a live session of ubuntu, run the obvious virus scans, then reinstall windows. If your smart though you will never have to worry about that.

[bitsalame]

there's a simple trick no keylogger I know of can fight against.
1. Open some text editor
2. Type "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789,.;-_"... (I typed alphabetically as an example, but a simpler and better strategy is to hit every key on the keyboard in sequence)
3. Copy/paste each character in your password one by one.

This is very solid against keyloggers.
It's a pain with long passphrases, though.
It's very bad against the "people in your back looking over your shoulder" attack too

Sounds good if it is a simple keylogger, but sophisticated monitoring software also logs the clipboard.

Just no way if the hacker use personnal / modified  source code.

Use Linux or offline PC in any important BTC transaction.
Use 2FA in any hot wallet or sensitive emails

A little trick on unsafe computer : when you start filling your password, you move and clik on the page, type 5 random caracter and come back to finish

Result :
password 12345
What is keylogged : 124$erRZ45

The clicking-away-from-the-box-and-then-click-back method would be detected by a software key logger definitely. It doesn't know where you are clicking, but detects the clicks.
Therefore it will be trivial for a human to realize that something is off when he sees something like:

[Active Windows: Chrome - MtGox]
Your@account[TAB]pass[LEFT CLICK]*&3q[LEFT CLICK]word

[RenegadeMind]

There is a whole lot of stupid going on in this thread... If you're scared that you have a keylogger disconnect from the internet, boot into a live session of ubuntu, run the obvious virus scans, then reinstall windows. If your smart though you will never have to worry about that.

+1

The only real way is to have a seriously hardened machine (firewalls, AV software, ports blocked at the hardware level, etc.) and use that machine ONLY for BTC transactions and nothing more. Take it offline when not using it to complete a transaction (i.e. remove the physical connection and do not rely in 'soft' ways, such as disabling a NIC through software).

Whether that machine is from a live CD or whatever is another question, and largely unimportant as far as I can tell. The point is that the machine must be hardened and dedicated and offline except when needed.

[bitsalame]

In short, in security it is said that a compromised computer isn't your computer anymore.
There isn't a way of being SURE that something doesn't exist, and antivirus software will always throw a false negative if a malware is new and they don't have a signature for it.

If you suspect the possibility of being infected, delete everything, reinstall a clean OS (don't use warez, if you want free, use free open source software) and use it only for bitcoins.

[Anon136]

There is a whole lot of stupid going on in this thread... If you're scared that you have a keylogger disconnect from the internet, boot into a live session of ubuntu, run the obvious virus scans, then reinstall windows. If your smart though you will never have to worry about that.

+1

The only real way is to have a seriously hardened machine (firewalls, AV software, ports blocked at the hardware level, etc.) and use that machine ONLY for BTC transactions and nothing more. Take it offline when not using it to complete a transaction (i.e. remove the physical connection and do not rely in 'soft' ways, such as disabling a NIC through software).

Whether that machine is from a live CD or whatever is another question, and largely unimportant as far as I can tell. The point is that the machine must be hardened and dedicated and offline except when needed.

hey ren how do you hardware block ports?

[RenegadeMind]

antivirus software will always throw a false negative if a malware is new and they don't have a signature for it.

This is not true.

You can legitimately hook into keyboard events, e.g. Any program that has global hotkeys must hook the keyboard.

This is common behaviour in some malware, and the basic technique for keyloggers.

So it is not true that AV software will ALWAYS catch malicious behaviour for unknown threats.

Yes, it will OFTEN detect things like keyboard hooks, but not ALWAYS.

You can go to a programming site, like The Code Project, and download software that hooks the keyboard. Just search for "keyboard hook" or "keylogger". You'll see (most likely) that your AV software does not detect it as malware. You can then add code to send the hooked info to some address and see if it is then detected.

[RenegadeMind]

hey ren how do you hardware block ports?

Hahaha!

Well, I haven't done this in a very long time, so off the top of my head, I can't remember the specifics.

This is very old (2006), and applies to Windows XP (or Windows 2003 server - I forget):

http://renegademinds.com/Home/Blog/tabid/60/EntryID/57/Default.aspx

However, the "Options" tab seems to be missing in Windows 7. (Could be a driver issue as well though...)

Ok - After looking around, it seems there's an answer here at Stack Exchange:

http://serverfault.com/questions/197900/where-did-tcp-ip-filtering-go-in-windows-server-2008

Not sure I like the "new" way of doing things... Seems kind of crappy to me. Oh well.

I don't know how to do it on Linux though. But, given how configurable Linux is, there must be a way - just that I don't know it.

[bitsalame]

antivirus software will always throw a false negative if a malware is new and they don't have a signature for it.

This is not true.

You can legitimately hook into keyboard events, e.g. Any program that has global hotkeys must hook the keyboard.

This is common behaviour in some malware, and the basic technique for keyloggers.

So it is not true that AV software will ALWAYS catch malicious behaviour for unknown threats.

Yes, it will OFTEN detect things like keyboard hooks, but not ALWAYS.

You can go to a programming site, like The Code Project, and download software that hooks the keyboard. Just search for "keyboard hook" or "keylogger". You'll see (most likely) that your AV software does not detect it as malware. You can then add code to send the hooked info to some address and see if it is then detected.

Do you understand the term "false negative"?

[RenegadeMind]

antivirus software will always throw a false negative if a malware is new and they don't have a signature for it.

This is not true.

You can legitimately hook into keyboard events, e.g. Any program that has global hotkeys must hook the keyboard.

This is common behaviour in some malware, and the basic technique for keyloggers.

So it is not true that AV software will ALWAYS catch malicious behaviour for unknown threats.

Yes, it will OFTEN detect things like keyboard hooks, but not ALWAYS.

You can go to a programming site, like The Code Project, and download software that hooks the keyboard. Just search for "keyboard hook" or "keylogger". You'll see (most likely) that your AV software does not detect it as malware. You can then add code to send the hooked info to some address and see if it is then detected.

Do you understand the term "false negative"?

Blech. Sorry. Guess I need more coffee... My bad. I somehow was thinking false positive.

Behaviour filters (heuristics) *could* pick up the behaviour, but... that goes to what I'd mentioned above, and not false negatives.

[doobadoo]

Back up your files reinstall OS from a boot-up CD. Thats the only real way of making sure.

I thought we had to take off and nuke the whole site from orbit.  Its the only way to be sure.

[Kazu]

Back up your files reinstall OS from a boot-up CD. Thats the only real way of making sure.

I thought we had to take off and nuke the whole site from orbit.  Its the only way to be sure.

Don't troll. AVs are a joke and if you've got a lot of money in bitcoin wallets its not worth risking it on your own ability to identify keyloggers. Could be a rootkit for all you know in which case you're really screwed.

[bitsalame]

Back up your files reinstall OS from a boot-up CD. Thats the only real way of making sure.

I thought we had to take off and nuke the whole site from orbit.  Its the only way to be sure.

Considering how valuable are these digital goods, there would be no problem in investing time and money in developing some very nasty 0 ring rootkits.
Even if you scan with an AV a harddrive as slave or from a bootable disk, it still doesn't ensure the cleanness of a drive if it wasn't on a sterile environment... ESPECIALLY if it is running Windows.

Considering the AmiBIOS source leak, accessing ring 0 would be trivial, and a BIOS Rootkit would be impossible to be cleaned up by an AV.
I would normally not worry that much, but with bitcoins a certain level of paranoia is expected.

There is no need of worrying as long as you follow very simple rules:
Ideal:
1) Nuke everything and start from zero.
2) Make a new partition and install Linux
3) Never use root
4) Use that partition only for Bitcoins and never use it for leisure browse anything.

If you are using Windows 7 (if you are still using previous version, you better kill yourself):
1) Nuke everything and start from zero.
2) Create a user with user privileges.
3) Use sandboxie for browsing, even with Chrome. Thinking of it... better sandbox everything. Sandboxie is your internet condom. Cherish it, learn to love it.
4) Use Kaspersky Antivirus. Better something than nothing.

[Kazu]

Back up your files reinstall OS from a boot-up CD. Thats the only real way of making sure.

I thought we had to take off and nuke the whole site from orbit.  Its the only way to be sure.

Considering how valuable are these digital goods, there would be no problem in investing time and money in developing some very nasty 0 ring rootkits.
Even if you scan with an AV a harddrive as slave or from a bootable disk, it still doesn't ensure the cleanness of a drive if it wasn't on a sterile environment... ESPECIALLY if it is running Windows.

Considering the AmiBIOS source leak, accessing ring 0 would be trivial, and a BIOS Rootkit would be impossible to be cleaned up by an AV.
I would normally not worry that much, but with bitcoins a certain level of paranoia is expected.

There is no need of worrying as long as you follow very simple rules:
Ideal:
1) Nuke everything and start from zero.
2) Make a new partition and install Linux
3) Never use root
4) Use that partition only for Bitcoins and never use it for leisure browse anything.

If you are using Windows 7 (if you are still using previous version, you better kill yourself):
1) Nuke everything and start from zero.
2) Create a user with user privileges.
3) Use sandboxie for browsing, even with Chrome. Thinking of it... better sandbox everything. Sandboxie is your internet condom. Cherish it, learn to love it.
4) Use Kaspersky Antivirus. Better something than nothing.

Dude, windows XP is super legit. You can get full source now. XP > Lunix.

[bitsalame]

Back up your files reinstall OS from a boot-up CD. Thats the only real way of making sure.

I thought we had to take off and nuke the whole site from orbit.  Its the only way to be sure.

Considering how valuable are these digital goods, there would be no problem in investing time and money in developing some very nasty 0 ring rootkits.
Even if you scan with an AV a harddrive as slave or from a bootable disk, it still doesn't ensure the cleanness of a drive if it wasn't on a sterile environment... ESPECIALLY if it is running Windows.

Considering the AmiBIOS source leak, accessing ring 0 would be trivial, and a BIOS Rootkit would be impossible to be cleaned up by an AV.
I would normally not worry that much, but with bitcoins a certain level of paranoia is expected.

There is no need of worrying as long as you follow very simple rules:
Ideal:
1) Nuke everything and start from zero.
2) Make a new partition and install Linux
3) Never use root
4) Use that partition only for Bitcoins and never use it for leisure browse anything.

If you are using Windows 7 (if you are still using previous version, you better kill yourself):
1) Nuke everything and start from zero.
2) Create a user with user privileges.
3) Use sandboxie for browsing, even with Chrome. Thinking of it... better sandbox everything. Sandboxie is your internet condom. Cherish it, learn to love it.
4) Use Kaspersky Antivirus. Better something than nothing.

Dude, windows XP is super legit. You can get full source now. XP > Lunix.

Either that is a joke or you are a joke.

[Kaiji]

Can your computer become infected with a keylogger just by clicking on a compromised website link?

[w00t]

Can your computer become infected with a keylogger just by clicking on a compromised website link?

Theoretically yes.

[Kaiji]

Can your computer become infected with a keylogger just by clicking on a compromised website link?

Theoretically yes.

So does that mean it could be done but hackers don't usually use that method?

[bitsalame]

Can your computer become infected with a keylogger just by clicking on a compromised website link?

Theoretically yes.

So does that mean it could be done but hackers don't usually use that method?

No. It isn't just theoretically, but very practically exploited that way.
It is heavily exploited in pass-by exploits.
Either with Adobe PDF vulnerabilities, Flash, and especially Java.

[w00t]

Can your computer become infected with a keylogger just by clicking on a compromised website link?

Theoretically yes.

So does that mean it could be done but hackers don't usually use that method?

No. It isn't just theoretically, but very practically exploited that way.
It is heavily exploited in pass-by exploits.
Either with Adobe PDF vulnerabilities, Flash, and especially Java.

Yes if you have any of those above enabled. I though more of vulnerability in the browser itself.

[CRkfx1]

How do I ensure that my machine does not have a software key logger ? I.e. that a software key logger isn't already on my machine ?

Like others have stated, you can never be absolutely sure you're not infected, unless you're using cold storage and the container has a physical lock and is under constant trusted surveillance, even then it's not truly secure.

In the meantime, I'd recommend using an offline password manager such as http://keepass.info/.

[bitsalame]

Can your computer become infected with a keylogger just by clicking on a compromised website link?

Theoretically yes.

So does that mean it could be done but hackers don't usually use that method?

No. It isn't just theoretically, but very practically exploited that way.
It is heavily exploited in pass-by exploits.
Either with Adobe PDF vulnerabilities, Flash, and especially Java.

Yes if you have any of those above enabled. I though more of vulnerability in the browser itself.

Which are also exploited with 0day exploits, even for Chrome.
There is nothing theoretical about that.
If you want to browse securely use Sandboxie, that's your internet condom.

[jdbtracker]

What about using it in a virtual environment? It is a secure sterile environment with controllable variables, I've read up on it since I have a lot of dangerous programs on my computer, to test them they have to be run in a Virtual Environment for security and monitoring purposes, it could work for the Bitcoin wallet as well.

Does anyone know any drawbacks to this method? because if they are using a hardware Keylogger or maybe it's one of those keyloggers that uses the tilt sensor to decipher keys pressed on a smart phone, it is not going to be very effective.

[bitsalame]

What about using it in a virtual environment? It is a secure sterile environment with controllable variables, I've read up on it since I have a lot of dangerous programs on my computer, to test them they have to be run in a Virtual Environment for security and monitoring purposes, it could work for the Bitcoin wallet as well.

Does anyone know any drawbacks to this method? because if they are using a hardware Keylogger or maybe it's one of those keyloggers that uses the tilt sensor to decipher keys pressed on a smart phone, it is not going to be very effective.

I would propose the inverse, use the virtual environment for browsing and anything network related.
In the real operating system use the client with USER privileges, either you use Windows or Linux.