how to beat keystroke logging??

ok here's the deal: Im planning on travelling around the world and my only connection to my financial institution would be via web access - primarily using cyber cafes. I've read that there are possibilities of admin's running keystroke logging on these boxes. How can you beat something like that to prevent them from getting my login/passwd for my bank accounts? I've though about simultaneously opening a notepad and cycle keystrokes between the cgi and notepad to jumble the logs but can those loggers log mouse movements or button clicks? Another possible security risk would be screen monitoring - how to beat or how to recognize someone's watching you? Anyhow - I would hate to find out in the middle of my 6 month trip that someone just cleaned out my bank account!! :eek: any ideas would be appreciated

Bring your own computer (laptop) and link into they cyber cafe networks or hotel, etc.

Just get a really good list of all the places that have WIFI, or allow you to access...

OR... get an AOL account. Don't they have servers all over the world? You can just change the dial up numbers...

Make sure to get the adapters for the power plugs all over...

Other than that... I'm not sure.

Have a pre set list of passwords to your online account and have someone you TRUST (like your mom... or etc) change the passwords every tuesday. Only access your account on monday... the password will change next day or monday night?

Really don't know...

Why can't you use touchtone banking and calling cards?

I've heard that a good way to defeat a lot of keyloggers is to type in a bunch of garbage, then, highlight and delete the parts you don't use. Example:

Say the password was: 3ct0

You could type in 3658li
Then, highlight everything after the 3, and hit backspace.
Next, type in a4c0et
Highlight the a and 4 and hit backspace. Then, highlight the 0et and hit backspace.
Then, type in 576t0kjle
Highlight the stuff before, hit backspace. Highlight the stuff after the t0 and hit backspace.

Most keyloggers will see that you typed in a bunch of characters and that you hit the backspace key. Some keyloggers, (not any free ones that i've seen, but possibly commercial ones) will log the mouse actions too. But, unless it logs everything (including the point the mouse is at, and all the other events), you're pretty safe using this method.

Other than that, if you are allowed to use some type of diskette or CD, store a file with the password in it, then c/p to the password box.

Of course, that won't work if the logging software cuts a copy to the HD for later inspection or if it just watches what goes through the clipboard. Maybe a combination of this method with the CD and the above method would work well.

FlamingRain: Thats a really good idea. A pain in the a$$... but good none the less.

Just hopefully, they aren't using screen capture software too...

hmmm, arent passwords masked most of the time, so any screen capture or over the shoulder peeking would just see a bunch of ********.

Flaming Rain probably has your best solution - that is if you must use these public systems to do your work... Although phishphreek80's suggestion to bring your own laptop (either yours or one you borrow from someone) would obviously be the better choice if its an option for you...

Otherwise, for in general beating them there is 'anti-keylogger' software that I've heard works to prevent most any keylogger from working properly... The only problem with it is, on most of these 'public like' system - you don't have the ability to download and install software.

It can be found here, incase you want to take a look at it anyway:
http://www.newfreeware.com/search.php3?q=combat

RRP

Well it depends instronics.

I've used keyloggers on several of my friends computers when they type their password in I can still open up the logs and find it. Because this keylogger only captures text it sees what you typed in.

Also the keylogger I used told me what windows this stuff was being typed into.

So even though it only shows as a bunch of ***** the text keylogger will still capture it.

I've seen some keylogger that pick up anything, if you backspace once, itll remove the last character, so they could still get your password even if you did the backspace thing i believe. I guess the best way is to just bring your own laptop.

Yeah, i used to use jthAbcKeylogger on my machine just to see what people did (family computer). It dumped out the window name and what people typed in and all, but it had a sucky check rate. (Anything that i typed at above 40wpm was essentially missing every other letter). It was nice and stayed somewhat stealthy when i was running explorer as my shell, but as soon as i loaded geoshell instead, it was plainly visible in my window tiler.

I have yet to see any truly powerful and free logger. (ie, stores applications, mouse actions, keystrokes, and even screen captures.) It'd be difficult to get around one of those unless you manage to disable it somehow to begin with.

you should also check to see if there are any hardware key loggers and remove them if there is one. they are little electronic devices that go in between the keyboard cord and the computer's ps/2 port.

Most of the Public Access systems I've seen are Internet Koisks. IE, they have a touch screen and a "Virtural Keyboard" on the screen that you type into. These machines usually run Windows 2000, and I have seen a few that crashed to a MS-DOS looking startup screen where several system files were corrupt and required recovery...

These machines didn't run Internet Explorer, but rather some other browser software that relied on Internet Explorer to work. I think they were vulnerable to what IE was vulnerable to, but anyways...

If you run into a software keyboard and it has a keylogger you are probably screwed. If I remember right, the one I used would take your text into the Virtural Keyboard's text buffer, and the program would paste it into the textarea box on the webpage. If that was running a keylogger, there is no way to bypass that since it would simply log the result of the buffer. Of course that is a little paranoid, but it is possible. If the machine has a normal keyboard, it may have a hardware keylogger which connects between the keyboard and the PC. It can't or shouldn't be able to log mouse movements, since the keyboard port is/should be unidirectional, it can't send data out to the keylogger or keyboard. Instead, hardware keyloggers will wait for a key combination from the keyboard, and then paste their buffer into the PC by essentially typing everything in there. Maybe trying keycombinations will discover these. I have no other ideas for different kinds of software keyloggers or ways to detect them. A little paranoid, but there you have it. BTW, I've used some pay internet koisks in Guam to check my hotmail account and I haven't seen any weird stuff in my sent box or anything... I can't gurantee the same thing for you though.

Like has been mentioned, your own laptop or PC may be the best defense. Then you have to worry about packet sniffers, but as long as your data is encrypted you'd be fine. Just get a software firewall so you don't get rooted while you are away. Good luck on your trip.

All good advice above. You do not say where you will be travelling to, but wherever it is I would try to use facilities in an hotel, or bank. OK they will charge, but want to stay in business, so you will be safer.

I would look at the "other end" so to speak :) you need a bank account with a small amount in it, say $750?.....have that "topped up" from your main account on a daily or weekly basis. That way you can only get hit for a small amount.

My current account has £300 in it............that gets replenished from a feeder account, which in turn gets replenished from my main account.........but only if I tell my bank to do so. I also have a separate credit card for online transactions. And I live in the UK :D , but I am a little :eek4:

I would also expect that anywhere that has a "cybercafe" will also have a bank with an ATM in it? and there are always those things called travellers cheques? If you are that remote, what good is internet banking anyways? where are you going to get the cash from except an hotel or bank?

Good luck

Quote:

---

My current account has £300 in it............that gets replenished from a feeder account, which in turn gets replenished from my main account.........but only if I tell my bank to do so. I also have a separate credit card for online transactions. And I live in the UK , but I am a little

---

WOW!

I got to say nihil, that is by far one of the most paranoid things I've heard of someone actually doing. (Not that its a bad idea - just more caution then I've heard of someone actually using)....

RRP

Hi bpiedlow,

Merry Christmas to you mate!


I did not tell the whole truth just then. You see the main account earns 4%pa and the feeder 1%, and the current account with the £300 only 0.1%.

So, if money gets paid into the current account and the balance is over £300 at the end of the month, this automatically gets transferred back up to the feeder account. If the feeder account goes over £3,000, the rest automatically goes up to the main account, that is earning the 4%.

This saves a lot of effort, and is secure in that money will not automatically go from the main account unless I tell them.

This is something that the bank set up for me, not my own idea :) I guess they have decided that it is time that they earned their living?

Cheers

Hey thanks for all the great ideas ..bringing a laptop would be a really last resort ..im gonna be backpacking across the world and I dont want to lug around a laptop plus all the cables and so forth ..most of my time will be heading out to 3rd world tourist countries like egypt, india, nepal, thailand, cambodia and so on (with a few weeks stop in europe) ..I've thought about a decent pda type of device that has a browser but the power supply is gonna be a PITA ..as far a personal cash ..im planning on carrying enough $$ to last me the whole trip ..but I was trying to make sure my bank pays my bills while im gone away ..so needless to say it will be a small amount of instances that I really have to access the accounts ..i guess just have someone like mom access my account and make sure its ok ..I like the baby account with a feeder account setup tho from nihil ..maybe worth looking into ..thanks for the tips

Quote:

---

Originally posted here by cheyenne1212
Well it depends instronics.

I've used keyloggers on several of my friends computers when they type their password in I can still open up the logs and find it. Because this keylogger only captures text it sees what you typed in.

Also the keylogger I used told me what windows this stuff was being typed into.

So even though it only shows as a bunch of ***** the text keylogger will still capture it.

---

Oh yes, i understood that part, i was just referring to screen captures, or if someone was looking over the shoulder.

In combination with what FlamingRain said i think its not such a bad idea without having to use software to help out. I cant imagine that a web cafe will go through so much trouble, as to log the mouse pointers, whats been highlighted etc..... That would need a really knowledgable person todo so........... But you never know what tricks people come up with. i would say the golden rule for here is to not use a public box for sensitive work at any cost...... Even if you would use your own laptop.... that would bring in other risks in general.

Anyways, like i said, i like the idea FlamingRain mentioned... but its not 100% secure either.

Choose your poison ;)

To defeat a software keylogger carry a Knoppix CD around with you & reboot the machine at the cybercafe with the knoppix CD first & browse from there.

Then all you need to do is defeat a hardware keylogger and the way to do that is since it doesn't know what window/app you are typing into have gedit & browser open and mix the typeing between the two applications, using the mouse to switch windows.

Job done.

http://www.knoppix.org/

Steve

Many banks rely on a one-time code, where you insert you card into a portable device, type your pincode and it spits out a code, this code changes everytime you use it, and the bank will be expecting the next ones, so after you typed in the code, the key would be useless to any one else, even if it was logged. Check to see if your bank has a system like this, only hting you have to worry about then is some one hijacking your session, to prevent this, make sure you log out when your done.

- Noia

If you were to login to one of your own (*nix) boxes I'd suggest using S/KEY one time passwords (like Noia's banks does, which is really neat!)...
S/KEY is also useful for when you absolutly need to login from telnet for example; you'd generate yourself a list of passwords from a secure terminal (ssh or local console) then use these one time passwords with insecure protocols. Of course this doesn't protect the session's transmition but at least you won't compromise your secure password.

[edit]
Come to think of it, if you run a *nix box, you could setup s/key, generate yourself a list of passwords, then use some utility that will remember and auto-complete your diverse website (in your case bank). Then when you use an insecure host, login to your box with your s/key passwords and browse from your computer with the utility to log yourself in to your banking site...

Ammo