Ask HN: Latest best practices to detect keyloggers on Windows/Mac/Linux? | Hacker News Reader

Ask HN: Latest best practices to detect keyloggers on Windows/Mac/Linux?

2 pointseigenvalue4 comments

Keyloggers are a particularly scary form of infiltration, because over a long enough period they can accumulate a critically damaging amount of secret stuff (passwords, messages, etc.) without the user having any clue it's happening.

Other than your everyday well-known antivirus techniques (e.g., looking at signatures of executables and comparing to a known list of viruses), are there any super reliable ways using low-level kernel operations to see any running executable/service that is accessing keyboard events?

Even if it's a big list, if you could eliminate most of the processes because they are known applications (say, by crowdsourcing a list of known safe processes), you could come up with a subset of them and decide for yourself if any look suspicious.

The best approach should be able to detect and stop even a custom tailored attack on a high value target, where none of the code is reused from known exploits, and every trick in the book is used to obfuscate and evade automated detection. I feel like an open source package like this that had been inspected by a lot of smart people and vetted to work reliably under Windows/Mac/Linux would be a huge benefit to global security.

It's basically a lost cause: for whatever approach you take, the enemy piece of software will always be one ring below you - completely safe from your memory access.

In academics there is nothing really interesting about key loggers specifically. It's just a software, that reads memory.

You could whitelist processes, but the attacker will patch itself into whitelisted programs at runtime and run under their hood - low level kernel operations are the things, that an attacker ignores, when she already is a kernel module or sits in your ME. That's why Antivirus solutions are basically useless against a skilled attacker.

There's many ways to make a keylogger, from userspace down to the SMM layer of UEFI.

Perhaps a better way to approach this would be to turn the threat model around? If they have a keylogger, assume they have a rootkit. What needs to remain secure even when the platform is comprised?

Try to get it down to some cryptographic keys, which you can then store on a smartcard, that you use with a card reader with hardware PIN pad. There's no keylogging the PIN on one of those, as the PIN is sent directly to the smartcard, without relying on the host.

Obviously at that point the software asking you to sign something is probably compromised, but your cryptographic keys will remain protected, as will the PIN.

Yes clearly once you have a key logger installed you have been compromised and have to assume the worst. But it would still be really useful to know that your keystrokes are being observed and recorded. I wonder if you could make a little dongle that would encrypt your keystrokes as they leave your keyboard and have them decrypted via some “Secure Enclave” on your device’s CPU, which can only be accessed by the lowest level (signed) kernel code.

Isn't a lot of antivirus software just operating from a whitelisted group of software creator signatures crowdsourced from various companies? Isn't this very similar to email spam lists back in the day? Have you tried checking white papers from various cyber security providers? Or research papers? This isn't exactly my field of expertise.

Reply on news.ycombinator.com