Which of the following is a well known example of spyware which captures the keystrokes of the user?

Unauthorized Entry

How attackers gain illicit entry to a corporation’s premises depends on the company’s security posture. One way is for the attacker to loiter by the company entrance and wait for an authorized person to unlock the door. Once open, the attacker follows the person inside, thus, piggybacking on that person’s authorization [also known as tailgating]. Another way is blending in with a group of people. If an attacker has to display a badge, they have to steal one. Alternatively, materials for making fake IDs are available on the Internet at www.myoids.com. A more brazen approach is to talk his or her way inside.

If a door requires a Personal Identification Number [PIN] for entry, shoulder surfing [i.e., observing someone else enter their PIN on the keypad] can be used to learn a valid PIN. If the PIN has to be used in combination with a badge, a combination of attacks is needed.

Once unauthorized entry is achieved, the attacker can take photographs of computer screens and any other materials. He or she can steal manuals, storage media, and documents [e.g., the company directory]. The attacker can even install a hardware keystroke logger.

Keystroke loggers [also known as keyloggers] record the keystrokes typed on a computer’s keyboard. Keystroke loggers record passwords and capture the information before encryption is used on the password. There are two types of keystroke loggers: hardware and software.

Some advantages of hardware keystroke loggers are that they are completely undetectable by software, can record all keystrokes, and can record keystrokes before the operating system is loaded [such as the Basic Input Output System [BIOS] boot password]. One disadvantage is that the attacker has to return to retrieve the hardware keystroke logger. An attacker can also be an insider [e.g., co-workers, a disgruntled employee, or someone on the cleaning crew].

As you can see in Figures 9.1 and 9.2, hardware keystroke loggers have a male connector on one end and a female connector on the other end. It is placed between the keyboard jack on the computer and the plug on the keyboard.

Some Web sites selling hardware keystroke loggers are:

www.KeyKatcher.com [see Figure 9.1]

www.KeyGhost.com [see Figure 9.2]

www.KeyLogger.com

To make your own hardware keystroke logger go to www.KeeLog.com.

Software keystroke loggers have many advantages over their hardware counterparts. They can be installed through social engineering attacks, can discern which program is accepting the keyboard input from the user, and can categorize the keystrokes for the attacker. They can send the captured keystrokes to the attacker via e-mail, Internet Relay Chat [IRC], or other communication channel. Some popular software keystroke loggers are:

Spector Pro [www.spectorsoft.com] Takes screenshots, records e-mail messages that are sent and received, and records keystrokes [see Figure 9.3].

Ghost Keylogger [www.download.com] Uses an encrypted log file and e-mails logs.

IOpus STARR PC and Internet Monitor [www.pcworld.com/downloads/file_description/0,fid,22390,00.asp] Captures Windows login.

System Surveillance Pro [www.gpsoftdev.com/html/sspoverview.asp] Inexpensive and easy to use [see Figure 9.3].

Detecting software keystroke loggers can be accomplished a couple of ways. The most common is using scanning software to inspect files, memory, and the registry for signatures of known keystroke loggers and other spyware. A signature is a small portion of a file [i.e., a string of bytes] that always appears in spyware programs. Another method of finding spyware is real-time detection of suspicious activity.

Some programs that detect keystroke loggers and other spyware are:

FaceTime Enterprise Edition [www.facetime.com]

Windows Defender [www.microsoft.com/athome/security/spyware/software/default.mspx]

Ad-Aware [www.lavasoftusa.com]

Spybot Search & Destroy [www.spybot.info]

Webroot Spy Sweeper Enterprise [www.webroot.com]

Spyware Doctor [www.pctools.com/spyware-doctor]

Anti-spyware programs also have different supplemental tools. Spybot Search & Destroy has some nice tools such as a registry checker for inconsistencies [see Figure 9.4], which integrates with their file information program, FileAlyzer.

Tools & Traps…

Introduction

Congratulations, you have made it through the first part of cyber-spy school. By now you should have a basic understanding of the spy process and quite a few tricks to help you pry into people's online lives. You may be feeling computer savvy, and even a little dangerous. Be warned, this is just the beginning. We have given you a few basic tricks and scenarios, which will work most of the time, especially in ideal situations. Of course, one of the most important rules of cyber-spying [all spying, in fact] is that there are no ideal situations.

To be as prepared as possible for these non-ideal conditions, you need to develop skills that will expand your knowledge base and make you as versatile as possible. One major thrust of this chapter is to improve and build upon some of the techniques discussed earlier in this book. We want you to take what you have learned and convert it from basic to guru, so that when you encounter those odd cases, you still have a few more tricks up your sleeve.

Although this book focuses mostly on personal computers [PCs], they are only a small part of the entire cyber-realm. While they are generally most people's gateway to cyberspace, they are not the only area a good cyber-spy should focus on. As cell phones, personal digital assistants [PDAs], and even video game consoles become more advanced, there are more ways to get online and to store and use information. All of these devices can hold clues about how their owner lives. A cyber-spy should not overlook this potential gold mine of information. Harnessing the Internet and its many powerful search engines and online databases should also be a tool in every spy's arsenal. Many people still do things the old-fashioned way–by paper. Detailed credit card statements, phone bills, and other periodic paper documents are a great place for collecting even more information. Viewing the entire picture and collecting and correlating data from different sources is a very important part of spying, and an advanced technique that even professional spies have a hard time mastering.

Tips and Tricks

The Industry Responds

At the TechEd 2006 conference in Boston, Microsoft confirmed that “well-organized mobsters have established control [of] a global billion-dollar crime network using keystroke loggers, IRC bots, and rootkits,” according to “Microsoft: Trojans, Bots Are ‘Significant and Tangible Threat,’” an article by Ryan Naraine in the June 12, 2006, edition of eWEEK.com. Microsoft is basing this conclusion on data collected by its Malicious Software Removal Tool [MSRT]. The article says that MSRT has removed 16 million instances of malicious code on 5.7 million unique Windows systems. Sixty-two percent of these systems were found to have a Trojan or bot client.

The Alliance Against IP Theft, an organization in the U.K., published a document titled “Proving the Connection—Links between Intellectual Property Theft and Organised Crime” [www.allianceagainstiptheft.co.uk] that supports Microsoft's claim.

On August 10, a group of information security professionals, vendors, and law enforcement gathered at Cisco Headquarters in San Jose. With little notice, the “Internet Security Operations and Intelligence Workshop” attracted around 200 attendees. Led by the enigmatic Gadi Evron [security evangelist for Beyond Security and chief editor of the security portal SecuriTeam], speaker after speaker painted a bleak and complex picture. Many lamented the increasing ineffectiveness of the prevailing strategy, which focused on identifying and taking out C&C servers. This is the “kill the head of the snake” approach. Bots have begun to evolve beyond this weakness now. Some now have multiple C&C servers, and, like a Hydra, if you cut off one C&C server, two more pop up. Some used protocols that lend themselves to a more decentralized organization. Some are using “Fast Flux” DNS technology [see Chapter 3] to play an electronic version of the shell game with the C&C server. There was much wailing and gnashing of teeth by the security and network professionals. However, amidst the lamentations, some very interesting and innovative ideas were presented.

These ideas involve different methods of detecting botnets, aggregating this information, and sharing it for the benefit of all. Some ideas were so tempting that participants began trying out aspects of the idea during the presentation. When all was said and done, 200 minds knew what only a handful knew before. Further, a “call to action” had been issued. Come out of our shell, share what we know, organize our responses.

Collecting Passwords and Buddy Lists

While there is a lot of information that can be gleaned from IM conversations, there are some situations where just having knowledge of who is on your mark's buddy list may be sufficient. This piece of information alone can shed valuable light onto the composition and nature of your target's online relationships; after all, these are the people your mark feels are worth having only a click away. Also, depending on the messenger service, it can be useful to have block/ignore lists as well. Once obtained, it may be necessary to impersonate your mark to determine some of his or her contacts’ relevance and relationship with your mark. This impersonation usually requires your mark's password, another important piece of data to collect. In some cases, the password is hidden and scrambled in registry settings; in others, it sits in a plain text file.