0

Can one test if a device entails a "hardware" key logger?

I already checked How do I detect keystroke loggers in a reliable way?

In particular I am interested to know if hardware key loggers can be embedded inside a USB of a WiFi mouse or keyboard? & is there a way to test them?

I'd like to add to the question: how? How can I detect a hardware logger in a generic device?

3
  • 2
    Detected by what? Sight, software, heat, RF? Or by anything?
    – Dave
    Dec 24, 2012 at 12:21
  • 1
    anything; detect it with all possible means!
    – user10853
    Dec 25, 2012 at 16:30
  • I've edited the question asking how?
    – user10853
    Dec 26, 2012 at 22:04

4 Answers 4

2

Well, there is a way to test for it, but it depends on what protocol is being used.

For example, the purpose of a logger is to send the details some where, so maybe the UAC in Windows, an advanced Firewall or AV can detect the message being sent out.

However, if the logger is built with a SIM or similar, then no!

If it is a physical device then you can detect it by eye, but I doubt software could detect it.

3
  • 2
    Think the OP is talking about hardware dongles that are put between input hardware and computer and later on read by disconnecting/accessing them.
    – Mario
    Dec 24, 2012 at 12:07
  • @Mario - thank you for the comment, I've updated my answer to reflect this.
    – Dave
    Dec 24, 2012 at 12:13
  • @DaveRook exactly; for example it could be added to the mini usb wifi! But how well could an one hide it?
    – user10853
    Dec 25, 2012 at 16:31
4

I've recently asked myself the same question, just for (probably more common) pluggable hardware keyloggers like e.g. USB or PS/2 keyloggers.

To answer that question for myself I recently bought an USB keylogger for experimenting. While there are surely different devices on the market and not all work in the same way, the one I bought (KeeLog USB Keygrabber) seems to be a tough nut to detect.

Using Software

What I tried so far (under Linux):

  • lsusb and lsusb -t
  • lshw
  • powertop
  • tail -f /var/log/syslog

None of these commands showed any difference depending on whether the keylogger was in use or not. No additional device is showing up, no strange error messages in the log, no different bus addresses for the same device, etc.

So the keylogger I bought does not behave like a USB hub or such, it just seems to pass through (and capture) every packet on the bus.

But since the keylogger has to be inserted between the computer and the keyboard, you might consider any USB keyboard unplug events as suspicious. I though expect quite some false positives.

The only way I could see a difference so far was with additional hardware:

Measuring Power Consumption

I used the USB Charger Doctor from Adafruit between my computer and the keylogger and it showed 0.04 A more than without the keylogger. But so far I was not able to see this difference in power consumption with software, i.e. with powertop.

But this kind of detection has several drawbacks:

  • Hitting Caps-Lock and/or Num-Lock on the keyboard also caused additional power consumption from its LED and that was in about the same range according to the USB Charger Doctor: 1 LED = 0.03 A, 2 LED = 0.05 A.

  • If I have to check the USB Charger Doctor everytime before I use a PC, I very likely will also detect an USB keylogger sitting at the same place or nearby.

Using Additional Devices On The Same USB Port

If you look for keylogger at e.g. Amazon, you'll notice that some won't work if there's an USB hub in the keyboard (and others claim that their product does). So I put a simple USB hub behind the keylogger and plugged the keyboard into the USB hub (i.e. Computer → Keylogger → USB Hub → Keyboard).

Result was that ­— at least with the keylogger model I bought — neither the USB hub nor the keyboard were detected by my computer anymore, no traces in the logs as usual when I plug in an USB device. The power LED on the USB hub was on though.

So one way to mitigate (and nothing more) the danger of not detecing an USB hardware keylogger is to use an USB extension cable from the back of your PC ending on a visible place on your desktop, plugging in an USB hub there and the keyboard into the hub. If then suddenly the keyboard stops working, you will likely check the whole USB chain and might notice a keylogger that way.

So my personal recommendation is:

Make Sure You Can Check Your Keyboard Connector Easily

Set up your desk and PC in a way that the connector of your keyboard is always or at least often enough visible:

  • Plugin the keyboard into a frontside USB socket if your PC is sitting on your desktop. Currently keyloggers are still big enough to be noticed that way.

  • If you don't need any of the frontside stuff of your PC (e.g. CD ROM drive) and don't mind its ugly backside, turn your PC around so that you can see all backside connectors while working.

  • If you have enough space around your desk and your PC is a tower case sitting under your desk, set it up in a way that you pass the PC's back of your desk regularly and have a look at the back of your PC e.g. every morning when you arrive at work or so.

Further Discussion

This topic has also been covered over at StackExchange's IT Security site in the question "Detecting Hardware keyloggers… elegant solutions?".

2
  • 1
    Thank you for your detailed answer. This is informative.
    – user10853
    Dec 1, 2016 at 19:55
  • I see near trackpad of my laptop, the place is raised like a bubble inside. I suspect any device inside laptop,which was inserted. I remember a square like object in laptop keyboard size box ~ 4 by 4 inches - was sticking inside keyboard which was looking odd. I think that has raised it. How to check using software? Aug 14, 2018 at 19:16
0

It is possible (in theory anyway) to embed an acoustic keylogger into pretty much anything, and that will make this possible (and it is not possible to detect).

5
  • If it is not possible to detect, then how is it accessed by whoever installed it?
    – user
    Dec 24, 2012 at 12:58
  • @MichaelKjörling hardware keyloggers will usually have a key combination which triggers them and dumps the stored data.
    – Renan
    Dec 24, 2012 at 13:18
  • @MichaelKjörling or in this case, it could just have its own transmitter
    – soandos
    Dec 24, 2012 at 19:53
  • 1
    @Renan If it is hardware, it has to have at least some amount of circuitry. That circuitry, while perhaps non-obvious and likely concealed, would surely be possible to detect in some manner. Whether it would be easy is quite another matter.
    – user
    Dec 24, 2012 at 22:19
  • @soandos definitely it should have a transmitter; then why would the keylogger be there? Moreover, the data could be sent through internet; most systems allow (by default) all outgoing traffic! Of course that somehow can be detected by monitoring the traffic.
    – user10853
    Dec 25, 2012 at 16:35
0

Are we talking about generic hardware or some supposed-to-be-made secure hardware?

First case you're probably out of luck unless the logger makes some mistake.

Second case I could imagine some kind of encryption, which would obviously break compatibility as a standard HID device/keyboard.

2
  • well I was thinking of a regular wifi keyboard/mouse from some known company; couldn't someone add to it a logger?
    – user10853
    Dec 25, 2012 at 16:44
  • Yes, as long as it's a generic keyboard/mouse, you can add hardware in the line to parse/record data without it being noticeable.
    – Mario
    Dec 25, 2012 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .