Printable View
How do I setup an alarm that will go off if someone installs and runs a keylogger in my network?
Could I also prevent the person from accessing the logger by having the system auto-set a password (non-default) before he does? maybe that would prevent him from even getting a chance to use it.
what sort of network?
what sort of keylogger?
what monitoring/control software do you already have in place?
why are you so worried about key loggers specifically?
are your users trusted enough to even install software in the first place?
Dont make them-users- administrators of the machine...usually limits the install of software...assuming windoz here
as for hardware keyloggers....dont know/?
MLF
and what about self contained programs that just run without an install.
Security is a mutli level issue...
one of those levels is monitoring....and the software installed on machines...
Have an AUP...(acceptable use policy)
If user violates it...fire them
MLF
this is a semi-public network at a technology and entertainment education center where access and installations are necessary. i hang out with the admins but don't run the show. he kicked out this guy who installed stealthkeylogger or spy____ (i think)... saw him while he was patrolling the lab. my friend was looking for a setup/program that could auto-detect such installs without denying ordinary program installs. i dont know the details of his network platforms or logs, and probably wont see him anytime soon until i get a job.
Give the users limited accounts. As for software app to stop the execution of a program run off a flash disk - I dont know ...
as i just posted, i cant set 100% limited accounts bc users need to have ability to install and run their own programs. or if i do, would i have to list all the programs they can/cant run? gonna be a long research till i can make a huge library. i'd hate to have to do that.Quote:
Originally Posted by Cider
You could try this:
http://dewasoft.com/privacy/kldetector.htm
You would need to check that it was still installed and running.
Basically the scenario you describe is a no hoper. I would imagine that the machines are shared by multiple users.
If you used something like the above, you would have to educate the users to check that it started and was still running before they logged out. It would require a script to disable it and re-enable it which would be beyond the wit of most skiddies.
There again, you can get a demo of a process protector from DiamondCS, that allows you to protect one process. You would have to buy it if you wanted to protect more.
You will not be able to detect a physical keylogger with software.
And, put a warning on each screen "This system is not secure.......do not use it to transmit personal, confidential or financial data"
As a scanner, A-Squared is very good at finding keyloggers in particular......... run that every night?
As I said, pretty much a no-hoper there.
well, lets ask the extra question,
WHY do users need to be able to install their own software? I know its annoying to have to install every single piece of software, but I can't imagine the chaos if our users could install software. Never mind keyloggers, what if they put a bit torrent client on there? Never mind the spray of viruses you could get from the net.
thought occurs that things that just run won't persist after logoff, need an installer to add registry keys. Of course, if users have access to the registry.....
Good point there Aard~,
We are told that this is a "Technology and Entertainment Education Centre"?...... that sounds pretty ominous for a start......... like an open invitation to download/install pirated software, warez, malware and God knows what? AFAIK if an institution has illegal software on its systems it is legally responsible? :eek:
It sounds very much as if the users have local admin rights which would give them access to the Registry?
I cannot remember what this software is called, but I did hear of something that stores a secure image, and when you log off it wipes the current image. When someone else logs on it reinstalls the stored image. I believe it was intended for educational and public access environments.
Other ideas worth looking at, would be a virtual machine and a virtual sandbox?
Hmmm. UMIST used that imaging technique while I was there. Not at logoff, but every night the machines just reimaged. We had write access to the local drive which was actualyl handy. Meant that when it came to doing a huge document we could save it to the hard drive, work on it, print it then delete it without the quota driving us nuts. Had to finish it in a day though :P
I suspect norton enterprise edition might be capable of that sort of thing. There are probably others too.
Yes, institutions are responsible for what is on their systems as they are the owner of the box/connection in question. Similar to the way the owner of a car gets the speeding ticket irrespective of who was driving, but with more recourse to change that.
I guess if you had conclusive proof that it was user X that did something, then yeah. But of course, having a swat team storm in, shutdown your network and arrest the company isn't going to do good for your rep even if you can prove who it was.
I really can not imagine any situation where I would want users installing software.
Very true!
Also, when they raid places they tend to seize anything and everything that looks like it belongs to a computer, and you can bet you won't see it back for months :eek:
Sort of disruptive I would have thought?
Is it effective and reliable to boot at startup? you said something about having the user double check that it is running before logging off, but wouldnt want to scare the whole network (implying that our network is insecure).Quote:
Originally Posted by nihil
I dont know all the details of why, but i can say that users need the flexibility the machines can offer. ever been to a library and used their computers? u cant use the CTRL key or RIGHT-CLICK or do anything natural. same concept. its an education center, that offers web design, programing, graphic design, architectural design, etc etc. look at whos the audience... generally computer savy ppl. the center tries to allow preferences to add to productivity. rarely do we get problems. im not the main man regulating the network; therefore, i cant give you a perfect answer. Besides criticism, solutions and productive information always help more.Quote:
Originally Posted by Aardpsymon
Answered above. ^ ^ ^ ^Quote:
Originally Posted by nihil
I like that idea. heard of it before... but i never knew if it existed.Quote:
Originally Posted by nihil
Aardpsymon, so norton enterprise ed ?
Have you ever driven thru a red light and the camera took pictures (driver, front of car, back side, and plate) and sent you a ticket thru mail? Try ducking below ur dashboard right before it tries to take ur picture. U'll be suprized on what happens.Quote:
Originally Posted by Aardpsymon
Not if i were the janitor. FREE BREAK!Quote:
Originally Posted by nihil
yeah, you'll forgive me if I DON'T test that theory. Driving through red lights is kind of nuts to start with. Ducking to avoid the camera really just pushes it from insane to suicidal.Quote:
Originally Posted by e><ius
as well I was talking in the situation where someone genuinely was driving your car.
hey, what do u think the police would say if they saw those pix of nobody in the driver seat? u think YOU would get a ticket? or could u say that it was stolen? eh eh eh?!!!
I think I would get the ticket because someone who stole a car would not be hiding from the camera trying to avoid a ticket because its not their car.
Actually, the law relating to motor vehicles and to computers is very similar..... you are guilty until proven innocent.
With a vehicle it is the registered owner who is responsible........... pretty much the same with a computer, or those real time black lists would be illegal ;)
You don't need a photograph (other than to prove your innocence)......... the owner is the default value in the eyes of the law :eek:
seems fair enough to me.
Basically, don't lend your car to a nutter who will drive through red lights.
nihil
i was wondering about "real" English. when i say Center, you say Centre, why's that? im just spectulating that its Centre because its not a person (i.e. Destroyer, Runner, Spitter), rather a place. true?
I say centre, colour, neighbour
I aint proper english :bigsmile:
thems Canadian
MLF
Hi, English spelling does differ slightly from American.
Basically, I think that America has adopted phonetic spellings (sounds like) in some cases, whereas the traditional English is probably truer to the originating word (Latin, Greek, Viking, Saxon, Old French, Indian and so on)
:)
We also have different interpretations of words............ for example a "fag" is a cigarette or a junior boy at a public (fee paying) school who has to run errands for senior boys.
"Can't be fagged" means cannot be bothered.
"fagged out" means tired.................................
quite a contrast! i would hate to have to use the word 'fag' in the UK... i'd really very awkward.
morganlefayCanadia's BC aint UK English?
oh...I just cant be bahverd
;)
MLF
It gets better :D
A "faggot" is:
1. A bundle of sticks or twigs
2. A spicy meatball served in a thick brown onion gravy (sauce)
ANY BODY WANT A FAGGOT?!?!?!?!
I know I do!
Back on topic:
e><ius, please look at this outfit:
http://www.fortresgrand.com/
Maybe "Clean Slate" would do the job............... I have only tried the virtual sandbox, but even that might work?
:)
im liking it! just what i wanted. im gonna give it a test run. thanks nihil!
Is there currently a keylogger that can actually penetrate the system? i.e. bypassing Spyware and AntiVirus programs? So far, i've tested a large variety and so i think every single one had trouble either installing or running. AVG aint bad at all.
Yes there are..................lots of them.
1. New, custom built ones.
2. Ones installed with interactive scanning turned off.
3. Legitimate commercial ones.
4. Ones installed in places that the AV and AS programs ignore.
No anti-malware is 100% bulletproof and futureproof. When it comes to new stuff they mostly don't get above 80% and many do worse than that:eek:
If you let people onto your system with administrative rights......................
lol! u raggin on me?
i've tried a bunch of commercial programs... they're all worthy of throwing off the balcony. Couldnt go undetected in stealth. and even when i "turned off" the AVG & Spy, it gets detected in realtime. it just tells you how fast their great products get out-of-date.
which languages would apply?Quote:
Originally Posted by nihil
Hmmmm,
I don't think that matters (within reason)? All you are running is a compiled binary executable, so virtually any high level language would do. The real limitation would be the operating system in my opinion. Most are written for Windows because it is the most common OS by far.Quote:
which languages would apply?
Incidentally, you need to be very careful when evaluating this sort of commercial software unless you buy the full product. The demonstration and evaluation copies are limited in their functionality for obvious reasons.
:)
I have used a program called Deep Freeze in the past which works early well. It lets users do whatever they want and then you merely reboot the machine and its back to the way you imaged it.
http://www.faronics.com/
Thanks Net2Infinity,
Deep Freeze was the other one I was thinking of when I mentioned that concept earlier.............I could only remember Fortres Grand though, as I have been using it recently.
As I recall it works pretty well and would also do the required job. Unfortunately I have not been in a position to do any comparative testing. :(