How to make sure your machine isn't software key logged ?

[Coincrazy]

Hi

I have 100% access to my machine or at least the repair / service guys do the service supervised

So a hardware key logger would be almost impossible

However a software key logger could be possible

How do I ensure that my machine does not have a software key logger ? I.e. that a software key logger isn't already on my machine ?

I use windows


TIA

Regards

Cc

[flavius]

dont download .exes from random emails?

[pekv2]

Anti-Keylogger is trial-freeware and pay for.

Take a read here.
Stay Safe

[FTWbitcoinFTW]

Just no way if the hacker use personnal / modified  source code.

Use Linux or offline PC in any important BTC transaction.
Use 2FA in any hot wallet or sensitive emails

A little trick on unsafe computer : when you start filling your password, you move and clik on the page, type 5 random caracter and come back to finish

Result :
password 12345
What is keylogged : 124$erRZ45

[btcbug]

A little trick on unsafe computer : when you start filling your password, you move and clik on the page, type 5 random caracter and come back to finish

Result :
password 12345
What is keylogged : 124$erRZ45

Wouldn't a decent keylogger also be recording mouse clicks and if you activated another text box and typed in random garbage it would be easy for the hacker to distinguish?

[FTWbitcoinFTW]

It's not in a other text box, this is the trick

The keylogger sees everything, but it doesn’t understand what it sees. The browser also sees everything, but it doesn’t use everything that it sees: it does not know what to do with keys that are typed anywhere other than the text entry fields, and lets them fall on the floor. The keylogger has no easy way to determine which keys are used by the browser and which fall on the floor.

http://arvindn.livejournal.com/123183.html


It's not 100% safe, but a good advice !

[doobadoo]

DON'T RUN WINDOWS AND BITCOIN YOU WILL EVENTUALLY LOSE YOUR WALLET!!!

Get an external USB 3.0 hard drive for like $50 bucks.   Or buy a 32 GB FAST flash card for about the same if you have an sdxc slot ( http://www.amazon.com/SanDisk-Extreme-Class-Memory-SDSDX-032G-AFFP/dp/B007M54E1M/ref=sr_1_3?ie=UTF8&qid=1366473824&sr=8-3&keywords=fast+sdxc )

Download your favorite flavor of linux right from the distro's sight.  Format and install on your external hd/flash card.  Boot from the external drive and run the os's updater, then install bitcoin.

launch firefox.
1)  Go to Tools-->Addons--->plugins and disable java
 2) now hit the addons tab and install addon called NoScript.  
3)restart FF.  

4)  before browsing to sites like mtgox, or blockinfo, enter private browsing mode,
5) Got to the bar at the bottom of browser window and click the "S" icon.   Make NoScript "Forbid Scripts Globally"
you may need to go back to the S icon and allow certain scripts to make the these sites work correctly.  Do so on a one by one basis, and only scripts that come from those sites or have domains you recognize.

6) don't be logged into anything else or have open tabs to other pages when using mt.gox etc.  Not even bitcointalk.org

7)  log out of mtgox or other online wallets. then exit private browser mode.  you can now set noscript back to allowing scripts globally for regular browsing

Don't install additional software on your linux drive.  If you must, make sure you get it from the package manager, and that it is a well followed project that is open source and would be highly unlikely to insert attack code.  Don't install adobe flash.

**EDIT***
Oh yeah, on linux machines the Firefox plugin to disable java is called iced-tea.  you know they rename everything with linux...  Java --->Iced Tea.  Those C++ Jokers!

[Coincrazy]

Thanks to all who replied

[cho]

there's a simple trick no keylogger I know of can fight against.
1. Open some text editor
2. Type "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789,.;-_"... (I typed alphabetically as an example, but a simpler and better strategy is to hit every key on the keyboard in sequence)
3. Copy/paste each character in your password one by one.

This is very solid against keyloggers.
It's a pain with long passphrases, though.
It's very bad against the "people in your back looking over your shoulder" attack too

[cho]

After having written the last post with the copy/paste trick, I've been thinking about this.
What about a keylogger that would log the full content of a textbox everytime it changes ? Has anyone ever seen this in action ? Sounds like a good strategy for a keylogger, isn't it ?

[Kazu]

Back up your files reinstall OS from a boot-up CD. Thats the only real way of making sure.

[NoL1m1tZ]

There is a whole lot of stupid going on in this thread... If you're scared that you have a keylogger disconnect from the internet, boot into a live session of ubuntu, run the obvious virus scans, then reinstall windows. If your smart though you will never have to worry about that.

[bitsalame]

there's a simple trick no keylogger I know of can fight against.
1. Open some text editor
2. Type "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789,.;-_"... (I typed alphabetically as an example, but a simpler and better strategy is to hit every key on the keyboard in sequence)
3. Copy/paste each character in your password one by one.

This is very solid against keyloggers.
It's a pain with long passphrases, though.
It's very bad against the "people in your back looking over your shoulder" attack too

Sounds good if it is a simple keylogger, but sophisticated monitoring software also logs the clipboard.

Just no way if the hacker use personnal / modified  source code.

Use Linux or offline PC in any important BTC transaction.
Use 2FA in any hot wallet or sensitive emails

A little trick on unsafe computer : when you start filling your password, you move and clik on the page, type 5 random caracter and come back to finish

Result :
password 12345
What is keylogged : 124$erRZ45

The clicking-away-from-the-box-and-then-click-back method would be detected by a software key logger definitely. It doesn't know where you are clicking, but detects the clicks.
Therefore it will be trivial for a human to realize that something is off when he sees something like:

[Active Windows: Chrome - MtGox]
Your@account[TAB]pass[LEFT CLICK]*&3q[LEFT CLICK]word

[RenegadeMind]

There is a whole lot of stupid going on in this thread... If you're scared that you have a keylogger disconnect from the internet, boot into a live session of ubuntu, run the obvious virus scans, then reinstall windows. If your smart though you will never have to worry about that.

+1

The only real way is to have a seriously hardened machine (firewalls, AV software, ports blocked at the hardware level, etc.) and use that machine ONLY for BTC transactions and nothing more. Take it offline when not using it to complete a transaction (i.e. remove the physical connection and do not rely in 'soft' ways, such as disabling a NIC through software).

Whether that machine is from a live CD or whatever is another question, and largely unimportant as far as I can tell. The point is that the machine must be hardened and dedicated and offline except when needed.

[bitsalame]

In short, in security it is said that a compromised computer isn't your computer anymore.
There isn't a way of being SURE that something doesn't exist, and antivirus software will always throw a false negative if a malware is new and they don't have a signature for it.

If you suspect the possibility of being infected, delete everything, reinstall a clean OS (don't use warez, if you want free, use free open source software) and use it only for bitcoins.

[Anon136]

There is a whole lot of stupid going on in this thread... If you're scared that you have a keylogger disconnect from the internet, boot into a live session of ubuntu, run the obvious virus scans, then reinstall windows. If your smart though you will never have to worry about that.

+1

The only real way is to have a seriously hardened machine (firewalls, AV software, ports blocked at the hardware level, etc.) and use that machine ONLY for BTC transactions and nothing more. Take it offline when not using it to complete a transaction (i.e. remove the physical connection and do not rely in 'soft' ways, such as disabling a NIC through software).

Whether that machine is from a live CD or whatever is another question, and largely unimportant as far as I can tell. The point is that the machine must be hardened and dedicated and offline except when needed.

hey ren how do you hardware block ports?

[RenegadeMind]

antivirus software will always throw a false negative if a malware is new and they don't have a signature for it.

This is not true.

You can legitimately hook into keyboard events, e.g. Any program that has global hotkeys must hook the keyboard.

This is common behaviour in some malware, and the basic technique for keyloggers.

So it is not true that AV software will ALWAYS catch malicious behaviour for unknown threats.

Yes, it will OFTEN detect things like keyboard hooks, but not ALWAYS.

You can go to a programming site, like The Code Project, and download software that hooks the keyboard. Just search for "keyboard hook" or "keylogger". You'll see (most likely) that your AV software does not detect it as malware. You can then add code to send the hooked info to some address and see if it is then detected.

[RenegadeMind]

hey ren how do you hardware block ports?

Hahaha!

Well, I haven't done this in a very long time, so off the top of my head, I can't remember the specifics.

This is very old (2006), and applies to Windows XP (or Windows 2003 server - I forget):

http://renegademinds.com/Home/Blog/tabid/60/EntryID/57/Default.aspx

However, the "Options" tab seems to be missing in Windows 7. (Could be a driver issue as well though...)

Ok - After looking around, it seems there's an answer here at Stack Exchange:

http://serverfault.com/questions/197900/where-did-tcp-ip-filtering-go-in-windows-server-2008

Not sure I like the "new" way of doing things... Seems kind of crappy to me. Oh well.

I don't know how to do it on Linux though. But, given how configurable Linux is, there must be a way - just that I don't know it.

[bitsalame]

antivirus software will always throw a false negative if a malware is new and they don't have a signature for it.

This is not true.

You can legitimately hook into keyboard events, e.g. Any program that has global hotkeys must hook the keyboard.

This is common behaviour in some malware, and the basic technique for keyloggers.

So it is not true that AV software will ALWAYS catch malicious behaviour for unknown threats.

Yes, it will OFTEN detect things like keyboard hooks, but not ALWAYS.

You can go to a programming site, like The Code Project, and download software that hooks the keyboard. Just search for "keyboard hook" or "keylogger". You'll see (most likely) that your AV software does not detect it as malware. You can then add code to send the hooked info to some address and see if it is then detected.

Do you understand the term "false negative"?

[RenegadeMind]

antivirus software will always throw a false negative if a malware is new and they don't have a signature for it.

This is not true.

You can legitimately hook into keyboard events, e.g. Any program that has global hotkeys must hook the keyboard.

This is common behaviour in some malware, and the basic technique for keyloggers.

So it is not true that AV software will ALWAYS catch malicious behaviour for unknown threats.

Yes, it will OFTEN detect things like keyboard hooks, but not ALWAYS.

You can go to a programming site, like The Code Project, and download software that hooks the keyboard. Just search for "keyboard hook" or "keylogger". You'll see (most likely) that your AV software does not detect it as malware. You can then add code to send the hooked info to some address and see if it is then detected.

Do you understand the term "false negative"?

Blech. Sorry. Guess I need more coffee... My bad. I somehow was thinking false positive.

Behaviour filters (heuristics) *could* pick up the behaviour, but... that goes to what I'd mentioned above, and not false negatives.