5 ms·

Thank heavens this was software based - now imagine if they shipped keyboard firmware with a built in keylogger! Who knows, may be some do - that would be nearl

Thank heavens this was software based - now imagine if they shipped keyboard firmware with a built in keylogger! Who knows, may be some do - that would be nearly impossible to detect as they can encrypt it. On a related note - My bank requires me to use a on-screen virtual keyboard to log into the online account. The keys of this virtual keyboard are randomly rearranged every time it is invoked. That could certainly beat keyloggers.

deleted 16y ago
[deleted]
deleted 16y ago
[deleted]
JakeSc 16y ago
Which bank? That is very smart. Is the virtual keyboard built into the website (i.e., Javascript)?
- blinkingled 16y ago
  Citibank - you can try it here - http://www.online.citibank.co.in/ http://www.online.citibank.co.in/ . AFAICT it is JavaScript based - don't see any plugin used on the login site.
- brown9-2 16y ago
  ING Direct has something similar for entering your PIN.
darren_ 16y ago
You'd think so, but actually there exist keyloggers that take screenshots on mouseclicks, precisely to bypass this.
- blinkingled 16y ago
  Of course :) On the other hand, security is about putting as many deterrents as practically possible - nothing can be 100% secure. So to that extent it is still better to have measures like on screen keyboard than not. And then even if you somehow perfected the on-screen keyboard to not give out screenshots - there is always browser based malware that can send your session or creds to the attacker without bothering about keylogging!
- shrikant 16y ago
  I've played around with a few, and imho most of the common ones easily available on public torrent trackers have the ability to take screenshots on mouseclicks, with a nice little animation pointing out where the mouse pointer was when the click event happened too. 'Keystroke' logs include text, pictures and even videos in these toolkits. Basically if you've been taken over by keystroke logging malware, it'd be safest to assume that everything on the machine's been compromised.
naner 16y ago
My bank requires me to use a on-screen virtual keyboard to log into the online account. That is ridiculous.
- jrockway 16y ago
  But cheaper than sending each user a $1 SecurID token.
sedachv 16y ago
This is why the insistence of people like RMS and Theo de Raadt on completely open firmware and drivers is important. Binary blob drivers aren't "convenient," they are a violation of your privacy. The ACPI and EFI firmware interfaces in newer PCs are particularly bad in this respect.
- listic 16y ago
  Can you please explain in wihich respect ACPI and EFI is worse than BIOS ?
  - jarek 16y ago
    I'd guess it's because BIOS doesn't require OS drivers to work properly.
  - sedachv 16y ago
    EFI is basically binary DRM spyware, and by specification it's impossible to build a fully open source EFI BIOS: http://www.wilderssecurity.com/showthread.php?t=236384 http://www.wilderssecurity.com/showthread.php?t=236384 http://archive.fosdem.org/2007/interview/ronald+g+minnich http://archive.fosdem.org/2007/interview/ronald+g+minnich ACPI drivers are bytecode blobs that the BIOS passes to the kernel, and expects the kernel to interpret in priveleged mode: http://lwn.net/2001/0704/kernel.php3 http://lwn.net/2001/0704/kernel.php3 With the old PC BIOS and APM, it is possible to implement a fully Free Software firmware, with no 3rd party binary crap or DRM malware. http://www.coreboot.org/ http://www.coreboot.org/ does this.

deleted 16y ago

[deleted]

deleted 16y ago

[deleted]

JakeSc 16y ago

Which bank? That is very smart. Is the virtual keyboard built into the website (i.e., Javascript)?

blinkingled 16y ago
Citibank - you can try it here - http://www.online.citibank.co.in/ http://www.online.citibank.co.in/ . AFAICT it is JavaScript based - don't see any plugin used on the login site.
brown9-2 16y ago
ING Direct has something similar for entering your PIN.

darren_ 16y ago

You'd think so, but actually there exist keyloggers that take screenshots on mouseclicks, precisely to bypass this.

blinkingled 16y ago
Of course :) On the other hand, security is about putting as many deterrents as practically possible - nothing can be 100% secure. So to that extent it is still better to have measures like on screen keyboard than not. And then even if you somehow perfected the on-screen keyboard to not give out screenshots - there is always browser based malware that can send your session or creds to the attacker without bothering about keylogging!
shrikant 16y ago
I've played around with a few, and imho most of the common ones easily available on public torrent trackers have the ability to take screenshots on mouseclicks, with a nice little animation pointing out where the mouse pointer was when the click event happened too. 'Keystroke' logs include text, pictures and even videos in these toolkits. Basically if you've been taken over by keystroke logging malware, it'd be safest to assume that everything on the machine's been compromised.

naner 16y ago

My bank requires me to use a on-screen virtual keyboard to log into the online account. That is ridiculous.

jrockway 16y ago
But cheaper than sending each user a $1 SecurID token.

sedachv 16y ago

This is why the insistence of people like RMS and Theo de Raadt on completely open firmware and drivers is important. Binary blob drivers aren't "convenient," they are a violation of your privacy. The ACPI and EFI firmware interfaces in newer PCs are particularly bad in this respect.

listic 16y ago
Can you please explain in wihich respect ACPI and EFI is worse than BIOS ?
- jarek 16y ago
  I'd guess it's because BIOS doesn't require OS drivers to work properly.
- sedachv 16y ago
  EFI is basically binary DRM spyware, and by specification it's impossible to build a fully open source EFI BIOS: http://www.wilderssecurity.com/showthread.php?t=236384 http://www.wilderssecurity.com/showthread.php?t=236384 http://archive.fosdem.org/2007/interview/ronald+g+minnich http://archive.fosdem.org/2007/interview/ronald+g+minnich ACPI drivers are bytecode blobs that the BIOS passes to the kernel, and expects the kernel to interpret in priveleged mode: http://lwn.net/2001/0704/kernel.php3 http://lwn.net/2001/0704/kernel.php3 With the old PC BIOS and APM, it is possible to implement a fully Free Software firmware, with no 3rd party binary crap or DRM malware. http://www.coreboot.org/ http://www.coreboot.org/ does this.