Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux terminal keylogger in userspace

average-coder.blogspot.com.ar

Post reply on HN
Print view View original

1–10 of 36 posts

Re: Linux terminal keylogger in userspace

#3

Post by zx2c4 »

Here's a solid way to log actual keys from the keyboard (rather than just terminal input) using evdev. It's not good for, say, logging keys of a headless server, but it is good for logging keystrokes from a computer with a monitor and keyboard.

source code: http://git.zx2c4.com/evdev-keylogger/tree/

  zx2c4@Thinkpad ~ $ git clone http://git.zx2c4.com/evdev-keylogger/
  Cloning into 'evdev-keylogger'...
  zx2c4@Thinkpad ~ $ cd evdev-keylogger/
  zx2c4@Thinkpad ~/evdev-keylogger $ make
  cc -O3 -march=native -fomit-frame-pointer -pipe    logger.c keymap.c keymap.h evdev.c evdev.h process.c process.h   -o logger
  zx2c4@Thinkpad ~/evdev-keylogger $ ./logger -h
  Evdev Keylogger by zx2c4
  
  Usage: ./logger [OPTION]...
    -d, --daemonize                     run as a background daemon
    -f, --foreground                    run in the foreground (default)
    -u, --force-us-keymap               instead of auto-detection, force usage of built-in US keymap
    -e DEVICE, --event-device=DEVICE    use event device DEVICE (default=auto-detect)
    -l FILE, --log-file=FILE            write key log to FILE (default=stdout)
    -p FILE, --pid-file=FILE            write the pid of the process to FILE
    -n NAME, --process-name=NAME        change process name in ps and top to NAME
    -h, --help                          display this message
It has the ability to daemonize, log to a file, and mask itself in the process table. Far from what a real kernel rootkit logger could do, but instead it's clean and reliable.

I used to actually have this in my git repository with a little thing in there that would connect back to my server when run, and then I had a README and notices all over in the source code and makefile and everywhere that you should remove this part of the code before compiling, under all circumstances. Anybody reasonable would have seen the notices and removed the code. The idea was that this way I'd know how many script kiddies were abusing it, and if maybe it was a bad idea to keep it up there. Well, in fact I did get a lot of connections, and it was kind of horrible to see. Then I forgot about it, until seeing this post. So I figured, either I take it down, because script kiddies, not people who are merely curious to see how a key logger works, are using it, or I keep it up there. In the end, I decided to stop being a dick, remove the connection thinger, and now the HN crowd will hopefully find something interesting to learn in it. A failed experiment at dealing with the script kiddie situation, oh well. At least, now, my code is untainted.

Anyway feel free to email me or leave a comment here if you find any bugs or have patches, or whatever. The code should be pretty basic to understand.

Re: Linux terminal keylogger in userspace

#6

Post by lordlicorice »

iopuy wrote: post #5
bcoates wrote: post #2

Is there a way to send a secure attention command to su/sudo to protect against this?

Echo the LD_PRELOAD environment variable first and check for anything suspect.

Unless the shared object file also includes an override for the function that expands environment variables to lie about the true value of LD_PRELOAD.

Re: Linux terminal keylogger in userspace

#7

Post by gizmo686 »

zx2c4 wrote: post #3

Here's a solid way to log actual keys from the keyboard (rather than just terminal input) using evdev. It's not good for, say, logging keys of a headless server, but it is good for logging keystrokes from a computer with a monitor and keyboard. source code: http://git.zx2c4.com/evdev-keylogger/tree/ zx2c4@Thinkpad ~ $ git clone http://git.zx2c4.com/evdev-keylogger/ Cloning into 'evdev-keylogger'... zx2c4@Thinkpad ~ $…

Speaking from personal experience, some of your incoming connections may not have been people abusing your keylogger. Personally, the first thing I do when I play around with any source code is compile, run, and test it.

Re: Linux terminal keylogger in userspace

#8

Post by zx2c4 »

gizmo686 wrote: post #7
zx2c4 wrote: post #3

Here's a solid way to log actual keys from the keyboard (rather than just terminal input) using evdev. It's not good for, say, logging keys of a headless server, but it is good for logging keystrokes from a computer with a monitor and keyboard. source code: http://git.zx2c4.com/evdev-keylogger/tree/ zx2c4@Thinkpad ~ $ git clone http://git.zx2c4.com/evdev-keylogger/ Cloning into 'evdev-keylogger'... zx2c4@Thinkpad ~ $…

Speaking from personal experience, some of your incoming connections may not have been people abusing your keylogger. Personally, the first thing I do when I play around with any source code is compile, run, and test it.

There were lots of notices. You couldn't have missed it.
Post reply on HN