Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Suppose we go to a cyber cafe that uses chromebooks. Since the OS is designed to make difficult to install software keyloggers (by tampering the OS), and it is also difficult to instal hardware keyloggers, should I fear my keystrokes could be being logged?

share|improve this question

2 Answers 2

up vote 13 down vote accepted

Yes. Always assume that your activity -- including your keystrokes -- could be monitored/recorded any time you are using a computer that you do not physically control.

Sure, Chrome OS may make it nigh impossible to install a software keylogger, but "difficult" or even "extremely difficult" is not the same as "impossible". Further, you have no way of knowing that the OS at that cyber cafe is in fact Chrome OS, as opposed to something else that's been carefully designed to look like Chrome OS. Or, alternatively, it might be a completely legit Chrome OS, but running under a hypervisor of some kind that is itself logging your keystrokes.

As for hardware keyloggers: They aren't difficult to install at all. If the keyboard isn't physically built into the computer (i.e. not a laptop keyboard), it's as simple as plugging in a potentially very tiny device (apparently these things are now wi-fi enabled even!) between the keyboard's cord and the port on the computer. And you know those little round thingies you often see on e.g. monitor cords? In theory (though in practice I know of no such device) a keylogger could be designed to be attached to the keyboard cable in much the same way, reading the keyboard input via the magnetic field the electrical signals inherently generate without actually making physical contact with any wires. (I do know of "vampire" attachments for hardware network sniffers that function in this manner.) Further, keyboards can have built-in keyloggers, requiring someone to merely swap out a legit keyboard with an identical-looking on with a built-in keylogger.

Upping the complexity a little, a legit keyboard almost always has a single controller chip on it; this chip could relatively easily be replaced, or another chip added to the same connectors, to turn a legit keyboard into one with a built-in keylogger.

Laptop keyboards are much harder to get hardware keyloggers into, but, again, "much harder" is not the same thing as "impossible".

share|improve this answer
1  
Just to fuel the paranoia a bit, have a look‌​. –  Eroen Mar 20 '12 at 7:17
    
@Eroen Yikes! I've known of TEMPEST for a long time, but this new one is far more plausible and actually achievable! –  Kromey Mar 20 '12 at 23:18

Currently a lot of Chrome OS is being used based on one person (hexxeh) compilation (Flow, Lime, Vanilla etc.), it doesn't seem to be anyone involved or co-operate with him. So as far as you know he could be putting a keylogger in his build and laughing all the way to the bank - how can you tell !? (Has anyone actually investigated/monitored his build !?)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.