Software that is used to obtain private user information such as a users keystrokes
Show
December 3, 2021 Think about everything you do on a computer or phone in a given day. You might compose work emails, sign in to Now imagine finding out someone had been hiding behind you, watching every single key you typed. Keylogging, also known as keystroke logging, is the act of recording a user’s keyboard interactions and device activity. Though it can be performed legally, it’s also a form of data monitoring that hackers and identity thieves use to acquire people’s personal information. There may not be anything inherently unethical about a keylogger, but in the hands of a malicious user, a keylogger can cause serious damage. Keylogger-based malware has become another dangerous weapon in cyberattackers’ arsenals. It’s important to understand what a keylogger is, how to spot one, how to prevent keylogging malware, and how to secure your personal information. What is a keylogger?A keylogger (or keystroke logger) is a type of software or hardware used to track and record what someone types on their keyboard. Keyloggers can be used legally (some people even install them on their own devices), and you may have even used a computer with software installed to log keystrokes for monitoring and ensuring safe or approved use. But what keylogging means for everyday users is very different from what it means for cybercriminals. Malicious actors can also use them to capture your personal and financial information, PIN codes and account numbers, credit card numbers, usernames, passwords, and other sensitive data — all of which can be used to commit fraud or identity theft. How keylogging works
Whether the use is legal or illegal, all keylogging mechanisms work essentially the same way. They record every keyboard interaction a user has, allowing a third party to see a complete log of every email, instant message, search query, password, username, or other keyed sequences that user types. Keystroke malware comes in a variety of forms:
Keylogging malware can infect your computer through many of the same mechanisms as other common viruses, but it can also be intentionally purchased and downloaded. In short, keyloggers can either be tools or weapons, depending on who is installing them and how they’re using the acquired information. Types of keyloggersFor the general public, keyloggers are most commonly spread online via phishing scams, Trojan viruses, and fake websites. Hackers’ main goal is to obtain victims’ passwords, personal information, usernames, and banking information, enabling them to make bank transfers, open credit lines, and make purchases. Malicious keylogging mechanisms break down into two broad categories: software and hardware. Software-based keyloggersMany software-based keyloggers have rootkit functionality, meaning they’re able to hide in your system. These Trojan-spy programs can track your activity (including keystrokes and screenshots), save the data to your hard disk, and then forward the information to cybercriminals. Some of them are also able to track everything from information copied to your clipboard to location data and can even tap your microphone and camera. These tools can reach you at a few different levels: Kernel level: These are complex and difficult to write, so they aren’t especially common. Once installed, keyloggers affecting your device at the core of its operating system are especially difficult to diagnose and eradicate, as they’ve essentially been handed the “keys” to your device.
Keylogging software is much more common than keylogging hardware because it’s discrete, can be packaged as malware, and is readily available today from online vendors. However, hardware-based keyloggers are still used for a variety of reasons and should not be ignored. Hardware-based keyloggersThese keystroke loggers have a physical component to their implementation, either in the wiring or hardware of a device or in the setting around it. A common example of a hardware-based keylogger is the keyboard overlay on an ATM. Every time a bank customer presses the buttons on the criminal’s fake keypad — thinking it’s the legitimate ATM keypad — the keylogger records the keystrokes and forwards the information to the cybercriminal. These keyloggers can’t be detected by antivirus software because they aren’t installed on the computer, and they use their own internal memory to store and encrypt data. There are several general types of hardware-based keystroke loggers that range in their sophistication:
While keylogging hardware may not be as common as its software-based counterpart, it can still be highly dangerous and can compromise vital data. What are keyloggers used for?
But is a keylogger illegal in and of itself? Not necessarily. Here’s how legal usage breaks down. Legal keylogging examplesThe legal use of keyloggers depends on user consent (depending on local laws), whether they’re used maliciously to steal personal information, who owns the devices they’re installed on, and whether the use victimizes someone in a manner that breaks any other applicable law. Here are a few examples of potentially legal keylogging:
Essentially, legal use comes down to local laws, user consent, and no intent to misuse user information. Illegal keylogging examplesIllegal keylogging gets tricky because sometimes potentially legal usage can straddle the line between unethical and illegal. Generally speaking, the use becomes illegal primarily when it leads to stolen confidential data or when software/hardware is installed on a device owned by someone else, as outlined below:
In general, what makes keylogging illegal is a lack of user consent or the use of keyloggers on someone else’s property, though specific laws on usage can vary by location. The threats of keyloggers
As noted above, cybercriminals may use keylogging malware for more overtly dangerous data like bank account numbers, PINs, or Social Security numbers, but they can also steal more personally sensitive content like browsing data, conversations, and even video or audio recordings. After cybercriminals access this information, you could be susceptible to any of these threats:
This is in no way an exhaustive list of the ways in which keylogging can be used against you. It’s vital to protect your methods of accessing, transferring, and recording your data so you can mitigate these and more keystroke-monitoring threats. How to prevent keylogging
Enable two-factor authenticationTwo-factor authentication is one of the most effective forms of virus, malware, and keylogger prevention. Also known as 2FA, this solution adds an extra log-in step such as a fingerprint or temporary PIN sent to your phone, helping verify that the person logging into your account is really you. Enable 2FA whenever you can to help ensure that if your information is stolen, cybercriminals can’t sign into your accounts remotely. Don’t download unknown filesThe next best way to protect yourself from malware is to refrain from downloading any unknown files and avoid strange links altogether. Phishing attacks are getting more sophisticated, but be skeptical of anyone—even contacts you know—telling you to download attachments or click links out of the blue. Consider a virtual keyboardThis solution displays an interactive keyboard on your screen so you don’t have to physically type on an analog one. While a virtual keyboard isn’t an airtight prevention tactic, it does circumvent keylogging hardware and any keylogging software specifically designed to record interactions with your physical keyboard. Some software can still monitor your on-screen interactions, however, so this should be seen as a supplemental tool and not a complete solution. Use a password managerPassword managers are not only convenient ways to ensure you don’t forget the seemingly endless number of logins we all have to juggle these days — they’re also great keylogger protection. By logging in with a password manager, you don’t display your passwords or physically type them, so keystroke monitors can’t capture them. Install antivirus softwareLook for antivirus software that includes anti-spyware and anti-keylogger protection. As with all forms of viruses, new, more sophisticated keystroke malware is being written all the time, so be sure to keep your software up to date to stay secure. Consider voice-to-text conversion softwareSimilar to a virtual keyboard, voice-to-text conversion software can circumvent forms of keylogging that specifically target your physical keyboard. How to detect and remove keyloggers
Keylogging malware may show many common virus warning signs, including slower computer performance when browsing or starting programs, abnormal delays in activity, pop-ups, new icons on your desktop or system tray, or excessive hard drive or network activity. If you detect any of these, you may want to follow the steps below to identify and remove keylogging malware. 1. Do a software inventory checkSuccessful keystroke logger detection starts with taking stock of the programs and processes running on your computer. While many of these may have unfamiliar or even suspicious-looking names, they may blend in with the names of other software. 2. Do a browser extension checkSome keylogging malware is designed specifically to monitor your web usage and may show up as a browser extension. Check your browser menu and navigate to the list of active extensions. If there are any you don’t recognize or never downloaded, deactivate and remove them. 3. Remove keyloggersKeyloggers can be removed in much the same way you would remove other forms of malware. You should always exercise extreme caution when handling computer programs. Even if a program seems suspicious, it could be a necessary tool, and disabling it could cause problems. Once you’ve identified a program you’re 100% certain is a keylogger, disable, uninstall, and/or delete it from your device. 4. What to do if you don’t find a keyloggerIf you fail to identify any malicious keyloggers but still want to make absolutely certain your device is free of malware, you could reinstall your device’s operating system or perform a factory reset, which will effectively wipe all the data and programs from your device that were installed beyond the factory defaults. In a perfect world, you’ll never need to know what keylogging is. But the reality is that today, there are many Keylogger FAQsBelow are answers to some of the most commonly asked questions regarding keyloggers. What is a keylogger?A keylogger is software or hardware designed for monitoring and recording a user’s interactions with their keyboard and the associated device. What does a keylogger do?A keylogger surveils what someone types on their keyboard, recording their interactions with browsers, word processors, webforms, and other text-based media. What are keyloggers used for?Keyloggers are used to monitor how a user interacts with their keyboard as a means of recording their behavior, usage, or personal information. Is a keylogger illegal?While keylogging tools are not illegal in and of themselves, they are often used in an illegal manner by cyberattackers, identity thieves, or other malicious users to surreptitiously steal information or track activity without user consent. What is the history of keyloggers?Early cases of keylogging in the 1970s
involved government surveillance of electronic typing machines. Today, Do mobile devices get keyloggers?Mobile devices can be monitored using keylogging applications. Some of these programs may be able to monitor Can a keylogger be detected?Keyloggers may be difficult to detect, but
they are identifiable. The most common way to detect a keylogger is How can I tell if I have a keylogger infection?If your device has been infected by keylogger malware, you may notice system lag, noticeable overheating, or the How can I protect myself from keyloggers?One of the best ways to protect yourself from keyloggers is to refrain from downloading files or clicking links from suspicious emails, messages, or contacts. Enabling two-factor authentication is also helpful in preventing identity theft that may result from malicious keylogging. How can I remove keyloggers?If you detect a strange program that may be a keylogger in your browser extensions, system processes, or software list, remove it immediately. Browser extensions can be easily removed from your list of extensions, and device applications can be deleted, moved to the trash, or uninstalled.
Cyber threats have evolved, and so have we.Norton 360™ with LifeLock™, all-in-one, comprehensive protection against viruses, malware, identity theft, online tracking and much, much more. Try Norton 360 with Lifelock.
Copyright © 2022 NortonLifeLock Inc. All rights reserved. NortonLifeLock, the NortonLifeLock Logo, the Checkmark Logo, Norton, LifeLock, and the LockMan Logo are trademarks or registered trademarks of NortonLifeLock Inc. or its affiliates in the United States and other countries. Firefox is a trademark of Mozilla Foundation. Android, Google Chrome, Google Play and the Google Play logo are trademarks of Google, LLC. Mac, iPhone, iPad, Apple and the Apple logo are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc. Alexa and all related logos are trademarks of Amazon.com, Inc. or its affiliates. Microsoft and the Window logo are trademarks of Microsoft Corporation in the U.S. and other countries. The Android robot is reproduced or modified from work created and shared by Google and used according to terms described in the Creative Commons 3.0 Attribution License. Other names may be trademarks of their respective owners. What is the ability to identify the person or entity with whom you are dealing on the Internet?Internet identity (IID), also online identity or internet persona, is a social identity that an Internet user establishes in online communities and websites.
Which of the following statements about PKI is not true?All of the following statements about PKI are true except: PKI guarantees that the verifying computer of the merchant is secure. A digital certificate contains all of the following except the: subject's private key.
Which dimension S of security is spoofing a threat to integrity availability integrity and authenticity availability and integrity?test like questions from ecommerce 2012 8/e. Which of the following is one of the basic business objectives for an e commerce site?The primary goal of e-commerce is to reach maximum customers at the right time to increase sales and profitability of the business. Functions of e-commerce include buying and selling goods, transmitting funds or data over the internet.
|