Keylogger: Why is it a Serious Threat and How to Protect Yourself
Cybercriminals are always finding innovative and more sophisticated ways of stealing and compromising your personal information, which can cause substantial damage. Using a malware variant such as keylogger, either through phishing campaigns or software supply chain attacks, allows them to gain unauthorized access to a network or personal devices.
Motivated by financial profit, criminals may leverage the capabilities of keyloggers to steal Protected Healthcare Information (PHI) or users’ payment and credit card data. User credentials and credit card data are lucrative assets on the dark web.
Keyloggers also pose a real threat to businesses. In 2018, criminals compromised Cathay Pacific Airlines system by installing a keylogger on their vulnerable server and exposed personal data of 9.4 million Cathay passengers. And in 2019, according to IBM X-Force, HawkEye keylogger campaigns were detected, targeting various business users and industries.
Although the use of keyloggers seems like a scene coming out of Mission Impossible or Mr. Robot, the threat is real, and it can happen to anyone.
What is a Keylogger?
Keylogger is a software monitoring program that secretly records users’ keystrokes. Legitimate programs may also have a keylogging functionality which allow IT security teams and administrators to troubleshoot outages and malfunctions on corporate computers.
A notable example of a legitimate and meaningful use of keylogging software is parental control. Parents can install and monitor their children’s online activity and they could opt to be notified if they attempt inappropriate web content.
Adversarial use of otherwise legitimate tools and software may result to the theft of sensitive information, such as employee credentials or compromised customer data.
Once a keylogger infects a computer, it leverages algorithms that monitor keystrokes through pattern recognition or other techniques. The information collected is then sent back to the criminal by “calling back” to them. The amount of information collected vary per keylogger.
As many keyloggers have a rootkit functionality that allows them to hide themselves in the infected system, detecting them is a priority.
How Keyloggers Spread
Keyloggers can be used by criminals to launch man-in-the-middle attacks and intercept information entered via the user’s keyboard. This information can be anything like credit card numbers and PIN codes entered in e-commerce sites, passwords to online apps and services, email addresses, usernames, etc.
The key tactics used by cyber criminals is to lure people into installing malicious code or disclosing personal information. Therefore, phishing campaigns and social engineering attacks are the key methods deployed by adversaries to trick users into downloading keylogging malware.
The most basic forms may only collect the information typed into a single website or application, while more sophisticated ones may record everything a user types in no matter the application, including information they copy and paste.
Variants of keyloggers targeting mobile devices may go even further. They can record and disseminate information such as phone calls, messaging apps data, geolocation information, print screens, and even camera capture.
Credential and personal data gathered from keyloggers can be leveraged to launch further attacks. Compromised credentials can be used to either impersonate legitimate users or create fraudulent credentials to access online services or even launch a phishing website. Falling a pray to impersonation attack can have serious consequences.
Finally, keyloggers can be used as tools to commit both industrial and political espionage, accessing data which may include proprietary information and classified government resources which could compromise the security of commercial and state-owned organizations.
Best Practices to Detect and Remove Keylogger Malware
The good news is that most leading antivirus software have already known keyloggers in their databases. Hence, protecting against keyloggers is no different than protecting against any other type of malicious program.
However, you shouldn’t opt for a single layer solution since new variants can appear any day. Considering that the main purpose of keyloggers is to extract sensitive or confidential data, the following best practices can help you both detect and protect yourself against unknown keyloggers:
Identify and monitor resources and traffic
Having a clear and updated visibility into the corporate infrastructure and understanding how these resources communicate internally and externally is the foundation for detecting keylogger malware. You may leverage this corporate registry to monitor processes and outbound traffic to identify abnormal communication because of a keylogger activity.
Keep your antivirus suite updated
Keyloggers are often bundled with other forms of malware, such as ransomware. It is therefore essential to be able to discover keylogger malware well in advance because it might be an indication of a large-scale attack. Having a powerful internet security suite and keeping it updated will remove known keylogger malware and help you keep your computer systems safe from advanced cyber-attacks.
Use virtual keyboards
The use of virtual keyboard reduces your chance of becoming a victim to a keylogging malware. Virtual keyboards allow the input of user information in a different way than traditional, physical keyboards. In fact, many security suites are already including virtual keyboards in their services. Although they might not be so handy and might impact productivity, they are a solution worth considering, especially you are required to enter banking information.
Disable self-execution of files on external devices
Disabling the self-running of executable files on externally connected devices such as USBs and establishing a strong USB usage policy can help organizations reduce the possibility of being infected by keylogger malware.
Don’t download files from unknown sources
Phishing emails are one of the most common ways employed by criminals to spread malware. Users should be able to spot those phishing emails and understand the dangers of downloading files from untrusted sources. These files may be the carriers of keylogger malware, which will start their sneaky operations once in your system. As the mantra goes, “it takes only one” infected file for the damage to be done.
Use a strong password protection
Passwords and other credentials typed in are the key target of keyloggers. You can eliminate the impact of keyloggers by following a strong policy that promotes passwordless authentication. Using software tokens, such as digital certificates and single sign-on policies is the preferred way of getting rid of passwords.
If a passwordless authentication is not feasible, you may opt for a strong password managers. Password managers allow you to create unique, strong passwords, which are entered automatically, rendering keystrokes redundant.
Finally, two-factor authentication must be enforced for all online services since it is an extra barrier for an attacker to surpass. Even if they get hold of your password, they will have to overcome the problem with the second authentication factor, which is usually something only you possess.
Although keylogger malware does not harm infected computers directly, they pose a real threat to users’ data privacy. Spread through phishing campaigns or advanced software supply chains, keyloggers are used to compromise sensitive information which can be leveraged to further large-scale attacks.
Individuals and organizations should take proactive measures to defend themselves against keyloggers, in order to protect privacy and integrity of their personal data.