Internetworkers: http://www.ibiblio.org/internetworkers/

["Shea Tisdale" <shea AT sheatisdale.com>]

TaB wrote:

> Shea Tisdale wrote:
> > And don't forget that if I really want to know what you are putting into
> > your documents I'll just use a keystroke grabber...
> 
> Okay, humor me here.  Wouldn't a keystroke grabber require:
> - compromising my computer to install the grabber
> - avoiding detection by my various and sundry malware detectors
> - sending data back to you without being noticed by ZoneAlarm or some
> other firewall?
> 
> I reckon the FBI could do this if they really wanted to.  So what would
> effective protection against this look like?  In addition to keeping my
> laptop within reach at all times and giving up my wireless connection,
> is there readily available software that would provide further
> protection and/or intrusion detection?
> 
> Thanks for your indulgence.

There are a number of keystroke grabbing programs that are easily delivered
and raise few if any alarms.  Many include options for starting up
automatically, running in hidden mode, and hiding in the process list.
These can be delivered remotely through an email, by attaching them to
another file, or by using an existing exploit.

The really good ones mask themselves as another process that should be
running so as to not raise alarms.  The super clever ones replace key DLL's
as well, and when they operate appear to be part of the standard OS on the
machine.

Some, such as Perfect Keylogger can also make screenshots and store them.

ZoneAlarm would probably catch the outgoing datastream, although perfect
keylogger claims to be invisible.  Even if they are seen, the good one mask
themselves such that the message in the firewall (zone alarm) would be
common enough that you probably wouldn't do anything.  I mean have you seen
how many OS things on your machine try to contact the outside world...even
before you install other programs.