Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

HW/SW/whatever keyloggers are there. How to find out? E.x.: Regularly check the cable of the keyboard, because there could be HW keyloggers:

http://i.imgur.com/TeMwo.jpg

But what about other HW keyloggers, or Software keyloggers? [Using a Linux, e.x.: Fedora or Ubuntu for OS!] - How to track keylogger softwares/solutions? What are the "best-practises?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

If your system has been compromised at the root level, then the attacker can hide a keylogger from anything you try to detect it - by linking in a custom kernel module that intercepts the system calls that might lead to its detection at the kernel level.

If that's what you suspect has happened, your only way to be reasonably sure you'll find it is by booting from a known safe live-CD image and manually scan for anything suspicious or out of place. Software like chkrootkit and debsums (the latter only applicable for debian-based distros, obviously) will help.

share|improve this answer
    
that's ok, but I was thinking of soultion like are there any system calls that can be submerged - that something is catching the keypresses? –  LanceBaynes Oct 30 '11 at 16:57
    
If your system is compromised at the root level then the hacker can already "submerge" those system calls and nothing at the console level would even be able to notice. –  Shadur Oct 30 '11 at 17:56
    
@lancebaynes The essential problem is that at that point you're basically asking the kernel "are you lying to me?", and I'm not sure why you'd expect the answer to be other than 'yes'... –  Shadur Sep 2 '13 at 10:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.