Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Some hardware keyloggers work by connecting a small device between the Keyboard's plug and the motherboard, to effectively track and record all keystrokes.

To do so, the user would have to disconnect the keyboard, and reconnect it afterwards with the keylogger device in between.

Is there an ubiquitous way to know if a computer's keyboard was disconnected overnight on any Windows XP/Vista/7 systems?

Thanks

share|improve this question
4  
i'm tempted to tag this [paranoia] ... –  quack quixote Dec 30 '09 at 23:56
4  
Maybe you could super-glue the connector in place so it can't be unplugged? :) ...and wrap the cable in a couple of layers of tinfoil and kevlar while you're at it... –  KristoferA Dec 31 '09 at 2:22
    
Doesn’t this belong on Skeptics? –  kinokijuf Feb 12 '12 at 19:06

3 Answers 3

up vote 3 down vote accepted

It should depend on the machine, but my guess would simply be no.

When you disconnect and reconnect the keyboard or mouse of some older machines, they are not automatically recognised and will not function until you reboot.

With newer machine, it appears that there is no "Intelligence" in the port (although they are better... so intelligence is a weird word), they are just always active if a keyboard is in or not, so I just do not think there is a programmatic way anyone can query or see if the keyboard is connected.

Your best bet will simply to be to look at the back of the machine and check there isn't an unknown device there.

share|improve this answer
2  
+1 - PS/2 (as well as older AT and XT) keyboard connections don't support intelligent hot-plugging, so they don't send a disconenct message, and are only checked for connection during the BIOS check (at boot). If you want to monitor USB keyboards and mice you'd (probably) have to write a custom driver to be able to message to and from the hardware directly. –  Ƭᴇcʜιᴇ007 Dec 31 '09 at 0:53
2  
And even then, how do you detect disconnections if the machine has been powered off for the night? –  Adam Luchjenbroers Dec 31 '09 at 1:54
1  
+1 @Adam, I was just assuming it was left on overnight, but VERY good point!... Thinking outside the box! –  William Hilsum Dec 31 '09 at 2:30

Not a geek answer, but if you're willing to sacrifice a hair from your head, you could try plugging in your keyboard with the hair in between. If it's not there or has moved(?) you know someone's been tampering...

share|improve this answer
3  
If you're already looking at the back, why not just check for the keylogging device? ;-) –  Samir Talwar Dec 31 '09 at 1:54
    
Not a geek answer, but actually a good practical one, I like. –  Gnoupi Dec 31 '09 at 8:22

The keyboard logger could be a passive device. Try putting your AM radio next to the keyboard.

share|improve this answer
    
why would AM help? do all keyloggers broadcast on AM frequencies? i'm thinking if you're that paranoid, you need some serious ham gear or a real frequency scanner. –  quack quixote Dec 31 '09 at 4:29
1  
The keyboard is noisy. You can hear it on AM radio. A passive keyboard logger can capture the data without removing the connector or touching the wires. Check the link for more info. rick-thedigitaldetective.blogspot.com/2009/07/… –  Steve Dec 31 '09 at 8:31
1  
ah, i see. i misunderstood your point; i thought you were suggesting the radio as a tester to detect a keylogger, while you're suggesting the AM radio as a demonstration of how easy it is to capture keystrokes. good point and link (tho for clarity, next time, include the link in your answer). –  quack quixote Dec 31 '09 at 8:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.