Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm concerned that a program installed on my Mac (LittleSnitch) may be logging keystrokes and transmitting them to a remote host.

Ironically LittleSnitch is supposed to prevent other programs from doing this.

Is there any software for the Mac that would help me to verify this?

share|improve this question

closed as off-topic by Ƭᴇcʜιᴇ007, Nifle, Frank Thomas, Kevin Panko, mdpc May 5 at 18:40

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they become outdated quickly and attract opinion-based answers. Instead, describe your situation and the specific problem you're trying to solve. Share your research. Here are a few suggestions on how to properly ask this type of question." – Ƭᴇcʜιᴇ007, Nifle, Frank Thomas, Kevin Panko, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Is this the same as this question? superuser.com/questions/50475 –  Telemachus Oct 3 '09 at 23:46
    
No, that question was asking whether there is a way to monitor LittleSnitch itself. This question is about how to investigate whether the computer is infected with a keylogger. –  Karl Oct 3 '09 at 23:48

1 Answer 1

up vote 1 down vote accepted

Fire up WireShark and look for unusual network traffic periodically. Most keyloggers don't transmit logged keys on every keypress, negotiating all of those connections wouldn't be the best idea. Instead, keylogging software usually logs to a file for a specified amount of time or until the logfile reaches a certain size.

share|improve this answer
    
Figuring out which IP destinations are legitimate and which are not is what I'm not sure about. –  Karl Oct 3 '09 at 23:46
    
@Karl: You can use sites such as dnsstuff.com to find out the locations of IPs. –  Chealion Oct 3 '09 at 23:53
    
@Chealion: Geographic locations? How would that help me determine if the IP destination of the network activity is legitimate or not? I don't believe a particular geographic location would provide any clues as to the legitimacy of the type of network activity being directed there. –  Karl Oct 3 '09 at 23:59
    
You can do a reverse DNS lookup: remote.12dt.com –  John T Oct 4 '09 at 0:00
    
@Karl: It's not perfect but knowing that your request is supposed to go to their data centre and that IP coincides with their whois records? Anything more than that and you may as well just nuke and pave because it's not worth the effort. –  Chealion Oct 4 '09 at 0:07

protected by slhck May 4 at 9:11

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.