Suppose we go to a cyber cafe that uses chromebooks. Since the OS is designed to make difficult to install software keyloggers (by tampering the OS), and it is also difficult to instal hardware keyloggers, should I fear my keystrokes could be being logged?
|
feedback
|
|
Yes. Always assume that your activity -- including your keystrokes -- could be monitored/recorded any time you are using a computer that you do not physically control. Sure, Chrome OS may make it nigh impossible to install a software keylogger, but "difficult" or even "extremely difficult" is not the same as "impossible". Further, you have no way of knowing that the OS at that cyber cafe is in fact Chrome OS, as opposed to something else that's been carefully designed to look like Chrome OS. Or, alternatively, it might be a completely legit Chrome OS, but running under a hypervisor of some kind that is itself logging your keystrokes. As for hardware keyloggers: They aren't difficult to install at all. If the keyboard isn't physically built into the computer (i.e. not a laptop keyboard), it's as simple as plugging in a potentially very tiny device (apparently these things are now wi-fi enabled even!) between the keyboard's cord and the port on the computer. And you know those little round thingies you often see on e.g. monitor cords? In theory (though in practice I know of no such device) a keylogger could be designed to be attached to the keyboard cable in much the same way, reading the keyboard input via the magnetic field the electrical signals inherently generate without actually making physical contact with any wires. (I do know of "vampire" attachments for hardware network sniffers that function in this manner.) Further, keyboards can have built-in keyloggers, requiring someone to merely swap out a legit keyboard with an identical-looking on with a built-in keylogger. Upping the complexity a little, a legit keyboard almost always has a single controller chip on it; this chip could relatively easily be replaced, or another chip added to the same connectors, to turn a legit keyboard into one with a built-in keylogger. Laptop keyboards are much harder to get hardware keyloggers into, but, again, "much harder" is not the same thing as "impossible". | |||||||
feedback
|
|
Currently a lot of Chrome OS is being used based on one person (hexxeh) compilation (Flow, Lime, Vanilla etc.), it doesn't seem to be anyone involved or co-operate with him. So as far as you know he could be putting a keylogger in his build and laughing all the way to the bank - how can you tell !? (Has anyone actually investigated/monitored his build !?) | |||
|
feedback
|
