TLDR from the document "The keylogger generates a small transparent window which is always under the mouse pointer requesting focus. Hence, local listeners are capable of capturing the entire user input (keystrokes and mouse clicks). In the following, this keylogger window closes while the captured user input is imitated.".
It has a lot of drawbacks, that make it easily noticeable that something is not right. (Browser autocompletion not working for example.) Though it's an interesting concept.
But it only doesn't work once. After which it closes, you put your password in and you just think it was a one-off glitch or you did something wrong. Browser autocomplete often doesn't work or gets cleared so I don't think many would find it suspect.
Given the sheer number of ads, video overlays and extensions that most users have to contend with - even on mainstream sites (I'm looking at you cnn.com) - I'd bet that a large percentage of users would just think that their browser was acting strange and proceed as normal.
I don't see why it would interfere with autocompletion - the keystrokes are passed onto the browser, after all.
Interfering with focus might be more noticeable, although Windows 10 has made this much less obvious than it used to be.
It does rather drive home the extent to which the "desktop" model is at odds with the user being able to run multiple mutually hostile applications from different sources. And sometimes the ability to read and inject keyboard input is legitimate.
There is at least one password manager autocomplete system that works by examining the title of the current active window, so if that's not the browser, it will fail.
But presumably the transparent keylogger window must know which is the supposedly-active window (in order to be able to pass on keystrokes to it), so the transparent window could emulate the supposedly-active window's title?
Personally, based on my experiences thus far I'd put it down to a web page that's interfering with autocomplete or blocking default actions (like pasting) in the name of "security".
IOW, web designers have already set the precedent for broken autocomplete, no keylogger required.
If an application has access to send keystrokes to another application, isn't it necessarily true that it could just install a keyboard hook in that application (on Windows at least)?
Perhaps, but that's more likely to trip behavioral detection. The technique proposed in the OP is interesting because it may not be detected as a keylogger.
If I have code exec on your everyday system, it's game over. There are very few viable defenses without a complete architecture overhaul which would probably remove too much usable functionality to be a viable option anyway. It's just game over.
There are viable defenses. There was similar work at three letter agencies back in 2001 - 2004 time frame and defenses were interactive. Ie flood the mouse or other logger with real enough looking data or use steganography
Could the defenses be hooked? Sure. But there were defenses against that ...
In the end since most password are 123456 it was decided that these solutions were like building Fort Knox but Having the key to the front door under the mat. Attackers follow the path of least resistance.
> Could you elaborate what you're talking about? Stealing passwords/sensitive info from Chrome temporary files?
Yes. Your browser stores passwords in a reversible format locally. If it's done well it may require root/ring0 privileges to abuse, but I'm unclear on how well local secret stores actually work for application-level secrets. However, if chrome temporary data becomes 100% secure I'll just steal all your documents, ssh keys and other application metadata - thus code exec is game over.
> How can one mitigate this threat?
Don't give me code exec on your box (eg don't run malware).
On a more actionable level, sandboxing every application should mitigate lots of malicious behaviors - iOS and (I've heard) chromebooks do this well, I think MacOS has some degree of sandboxing too. That being said, I don't think it'd be a practical solution for a 'power user' such as a web developer etc given the permissions power tools require are the same ones that are damaging in the hands of an attacker.
I mean, this is why things like "secure elements" and "trusted platform modules" exist.
You have a piece of hardware that stores encrypted data, and it can't be accessed until that hardware is convinced that the operator is requesting the access. The simplest example is a U2F key. It will not even sign an authentication request for a website until it detects that a human operator has asked it to do so (by touching it while flashing). That prevents malware from authenticating on your behalf. (You can still be tricked into authenticating, through, and then the malware will just steal the cookie you got. That is why things like secure boot exist; if the hardware verifies the OS and the OS verifies the hardware, then you can be reasonably sure that security protections are in place and that random software downloaded from the Internet can't interact with secure areas of your hardware. Modulo bugs in the OS, which is hardly a guarantee given how complex they are these days.)
OT: The European Union Data Library publishes the paper, and the webpage is in English. English is the international language of many domains, including business and science. However,
1. The UK is exiting the EU, leaving no members with English as their first language (unless I am overlooking someone).
2. AFAIK, English became the international language because of the cultural predominance of the U.S. and the consequences of the former British empire. The U.S.'s cultural impact seems to have greatly receded since 2016, and its relative power had already greatly receded since the end of WWII, when it produced half the world's economic output. The British Empire is a distant memory.
3. Some EU members, such as France, have long pushed back against English's dominance.
Will the EU continue to use English, officially and unofficially? To the same degree as today? If not, what will they use? I realize some of the answer is impossible to predict, but some is EU policy. Is there any discussion of it?
The Republic of Ireland has two official languages Irish and English.
Irish is the first national language as it is both culturally important and distinctive - though English is the dominant language with 93% of all people in the country speaking it fluently or as their only language.
24 comments
[ 3.1 ms ] story [ 49.4 ms ] threadOn first sight, this looks quite silly..
Interfering with focus might be more noticeable, although Windows 10 has made this much less obvious than it used to be.
It does rather drive home the extent to which the "desktop" model is at odds with the user being able to run multiple mutually hostile applications from different sources. And sometimes the ability to read and inject keyboard input is legitimate.
Interfering with focus is what breaks autocompletion. (This drawback is explained in the paper itself.)
IOW, web designers have already set the precedent for broken autocomplete, no keylogger required.
Could the defenses be hooked? Sure. But there were defenses against that ...
In the end since most password are 123456 it was decided that these solutions were like building Fort Knox but Having the key to the front door under the mat. Attackers follow the path of least resistance.
Maybe times have changed with MFA use...nah!
No if you create rock-solid keylogging preventions I'll just scrape chrome temporary files instead lol.
How can one mitigate this threat?
Yes. Your browser stores passwords in a reversible format locally. If it's done well it may require root/ring0 privileges to abuse, but I'm unclear on how well local secret stores actually work for application-level secrets. However, if chrome temporary data becomes 100% secure I'll just steal all your documents, ssh keys and other application metadata - thus code exec is game over.
> How can one mitigate this threat?
Don't give me code exec on your box (eg don't run malware).
On a more actionable level, sandboxing every application should mitigate lots of malicious behaviors - iOS and (I've heard) chromebooks do this well, I think MacOS has some degree of sandboxing too. That being said, I don't think it'd be a practical solution for a 'power user' such as a web developer etc given the permissions power tools require are the same ones that are damaging in the hands of an attacker.
You have a piece of hardware that stores encrypted data, and it can't be accessed until that hardware is convinced that the operator is requesting the access. The simplest example is a U2F key. It will not even sign an authentication request for a website until it detects that a human operator has asked it to do so (by touching it while flashing). That prevents malware from authenticating on your behalf. (You can still be tricked into authenticating, through, and then the malware will just steal the cookie you got. That is why things like secure boot exist; if the hardware verifies the OS and the OS verifies the hardware, then you can be reasonably sure that security protections are in place and that random software downloaded from the Internet can't interact with secure areas of your hardware. Modulo bugs in the OS, which is hardly a guarantee given how complex they are these days.)
I think I'd try using a window that is equal to the screen size, hide it, take a screenshot, and unhide it with the screenshot image displayed.
1. The UK is exiting the EU, leaving no members with English as their first language (unless I am overlooking someone).
2. AFAIK, English became the international language because of the cultural predominance of the U.S. and the consequences of the former British empire. The U.S.'s cultural impact seems to have greatly receded since 2016, and its relative power had already greatly receded since the end of WWII, when it produced half the world's economic output. The British Empire is a distant memory.
3. Some EU members, such as France, have long pushed back against English's dominance.
Will the EU continue to use English, officially and unofficially? To the same degree as today? If not, what will they use? I realize some of the answer is impossible to predict, but some is EU policy. Is there any discussion of it?
Irish is the first national language as it is both culturally important and distinctive - though English is the dominant language with 93% of all people in the country speaking it fluently or as their only language.