Defeating Key Loggers with Common Sense

I read an interesting story in one article of 2600: The Hacker Quarterly a while ago. The author, who goes by the name Xyzzy narrated his experience about the security holes he came across at Time Warner Cable.

Nature of the Hack

It all began when a schedule was set to fix intermittent downtime on Xyzzy’s cable Internet connection. To his amazement, the technician sat down at his laptop and started checking if his connection is already fixed. Apparently, the technician used a Web browser and opened a URL that’s exclusively used by his company. He then logged on to the page (using his username and password) to check his customer’s status. Afterwards, he closed the browser window and confirmed that the connection was already fixed.

What the Technician Didn’t Know

A ninja always carries with him some handy tools. Being a type of ninja that he is, Xyzzy runs a key logger on his laptop 24/7. So there you go- instant login credentials! But it doesn’t stop there. As mentioned earlier, the browser wasn’t closed entirely, so authorization session was still cached. Xyzzy then pulled up a packet sniffer, ran the telnet command, used the login credentials he previously captured, and voila! Some sort of customer database shows up. What can he do with that? Well, what can you do with a customer name, account number, address, phone number, IP address, MAC address, and a Web server’s name and version? What if you knew the data needed to verify an account on telephone support? Xyzzy can actually do a lot of things if he was a bad ninja.

Moral of the Story

Whether using someone’s computer, a computer at work, or a computer in a public place, it’s difficult to know if big brother’s lookin’. Who knows what other programs are installed in there? There are quite a few things that you can do to detect hidden programs like key loggers, but nothing beats common sense. Here’s a tip featured in BBC’s Click from an e-mail sender (Dr. John from Kuala Lumpur, Malaysia):

When entering a username or password, deliberately miss out one letter or number, then click with the mouse at the position of the missed letter and type it.

The key logger then gets the wrong sequence…

Now why haven’t I thought of that? From now on, when you’re checking e-mails or browsing future purchases on eBay, or even logging in to instant messaging accounts or in social networking Web sites in computers other than yours, make it a habit to intentionally miss out on a certain character and then use your mouse to highlight it and type the correct character over it. You’ll definitely be more at peace after your Internet session. Remember, an ounce of prevention is better than a pound of cure. Stolen identities and credit cards will be minimized as long as this simple, common sense thing is kept in mind. Happy surfing!

Other Sources

1. Keystroke Logging @ Wikipedia
2. BBC Click video archive - March 1, 2007

This entry was posted on Saturday, June 9th, 2007 at 23:19 and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.