Virtual keyboards and monitoring software foil keystroke loggers

ism tech

Posted Thursday, 17 April 2008, 01:51 HST @410

From Lifehacker comes a link to a free virtual keyboard called Neo’s SafeKeys. The keyboard is displayed on the computer screen, and lets a Windows user type their password without accessing the computer’s keyboard.

It’s trivial to monitor keystrokes through software and hardware called keystroke loggers or keyloggers. This New York Times describes a new phishing attack against executives, involving an email with a link to a fake subpoena. Click the link and a Windows keystroke logger gets installed.

Executives are excellent targets for such attacks. CXOs often want to bypass corporate security systems for the sake of personal convenience. When executives insist on carrying confidential or valuable corporate data on their laptop’s hard drive, they may as well paint a target on their foreheads.

CXOs might also disable virus scanners and security software to make the computers run faster. This only makes their personal computers much more vulnerable. When executives are reluctant to admit their mistakes or ask for help, the damage is already done.

I’ve seen virtual keyboard systems deployed on banking web sites, so that users can use a mouse to enter their passphrase. Of course, this can be very tedious if the user has a long passphrase. These virtual keyboard systems may become more common as banks implement multifactor authentication schemes that address consumer, regulator and compliance issues.

Keyboards and keystrokes

It’s still possible to use a keyboard for multifactor authentication, however. This article from Windows in Financial Systems describes a system from BioPassword that requires the user to enter their password ten times in a single enrollment session. Software determines the rhythm of their keystrokes, and stores that data along with the user’s account on a Microsoft Active Directory server. Anyone who tries to access the account will have to simulate that user’s typing behavior for that specific password.

In this 15 May 2007 article, ha.ckers.org pointed out some potential problems with BitPassword’s system. The timing needs to be loose enough to accommodate different keyboard styles. A laptop computer’s keyboard often is laid out differently from a standard desktop keyboard. otherwise, the timing checker might flag users who include numerics, international characters (such as € £ ß Ω) and typographical symbols (like % @ © ^#~) in their passphrase.

Dots and dashes

The concept dates back to the 19th century. Experienced telegraph operators could identify each other by through their fist, or their distinctive patterns of keying Morse code. The same concept was also used during both World Wars to match radio operators with their message content.

Some banks might have each user to enroll several different passphrases, as many banks now require for their web-based customer portals.

BioPassword’s software is designed for business and enterprise users. PC Magazine has an excellent review here, and the London Times and Baseline have good recent articles. This Wired article from 2000 describes how the system was used by a Canadian company, Musicrypt.com, as part of a user management service for music web sites.