up vote 1 down vote favorite
share [g+] share [fb]

I'm concerned that a program installed on my Mac (LittleSnitch) may be logging keystrokes and transmitting them to a remote host.

Ironically LittleSnitch is supposed to prevent other programs from doing this.

Is there any software for the Mac that would help me to verify this?

link|improve this question
100% accept rate
Is this the same as this question? superuser.com/questions/50475 – Telemachus Oct 3 '09 at 23:46
No, that question was asking whether there is a way to monitor LittleSnitch itself. This question is about how to investigate whether the computer is infected with a keylogger. – Karl Oct 3 '09 at 23:48
feedback

1 Answer

up vote 1 down vote accepted

Fire up WireShark and look for unusual network traffic periodically. Most keyloggers don't transmit logged keys on every keypress, negotiating all of those connections wouldn't be the best idea. Instead, keylogging software usually logs to a file for a specified amount of time or until the logfile reaches a certain size.

link|improve this answer
Figuring out which IP destinations are legitimate and which are not is what I'm not sure about. – Karl Oct 3 '09 at 23:46
@Karl: You can use sites such as dnsstuff.com to find out the locations of IPs. – Chealion Oct 3 '09 at 23:53
@Chealion: Geographic locations? How would that help me determine if the IP destination of the network activity is legitimate or not? I don't believe a particular geographic location would provide any clues as to the legitimacy of the type of network activity being directed there. – Karl Oct 3 '09 at 23:59
You can do a reverse DNS lookup: remote.12dt.com – John T Oct 4 '09 at 0:00
@Karl: It's not perfect but knowing that your request is supposed to go to their data centre and that IP coincides with their whois records? Anything more than that and you may as well just nuke and pave because it's not worth the effort. – Chealion Oct 4 '09 at 0:07
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.