Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pwning a Spammer's Keylogger

blog.spiderlabs.com

Post reply on HN
Print view View original

11–20 of 68 posts

Re: Pwning a Spammer's Keylogger

#11

Post by jiggy2011 »

bockris wrote: post #8
martingordon wrote: post #6

Correct me if I'm wrong, but one of the additional benefits of using a password manager such as 1Password is that it thwarts keyloggers. They may only get your master password (which shouldn't be your password on any site) but your site specific user name and password are never actually typed.

I don't know if you're wrong but how do those password programs work? If they emulate a keyboard by sending keystokes to the appropriate input field they are most likely logged by programs like these. (not HW keyloggers tho). If the password programs use the clipboard, then it is just another source for the keylogger to capture and trivial to add. (edit: a screenshot lower in the article of the 'Perfect Keylogger' op…

Not to mention the fact that once the attacker has enough access to your machine to get a keylogger installed they have pretty much pwned at least your user account so getting cookies/settings or whatever out of your browsers data folders shouldn't be too much of an issue.

Re: Pwning a Spammer's Keylogger

#12

Post by jiggy2011 »

farmdawgnation wrote: post #10

I would have replaced all the existing keylogger files with pictures of Rick Astley and Rebecca Black, but that's just me.

You're getting into dangerous legal territory there (technically you are by just connecting to the FTP I guess).

Bear in mind that many of the servers used by these guys do not belong to them and are probably a neglected server somewhere that was setup by an innocent party for other purposes but was subsequently pwned by the malware people.

Re: Pwning a Spammer's Keylogger

#13

Post by qeorge »

bockris wrote: post #8
martingordon wrote: post #6

Correct me if I'm wrong, but one of the additional benefits of using a password manager such as 1Password is that it thwarts keyloggers. They may only get your master password (which shouldn't be your password on any site) but your site specific user name and password are never actually typed.

I don't know if you're wrong but how do those password programs work? If they emulate a keyboard by sending keystokes to the appropriate input field they are most likely logged by programs like these. (not HW keyloggers tho). If the password programs use the clipboard, then it is just another source for the keylogger to capture and trivial to add. (edit: a screenshot lower in the article of the 'Perfect Keylogger' op…

Its been a while (AOL ;), but IIRC the Windows API lets you SET_TEXT directly by window handle.

Assuming that's how 1Password works, it should be safe. I think that's a fair assumption because using the clipboard or SendKeys to an input box is all kinds of trouble in practice, and the API is easy.

Re: Pwning a Spammer's Keylogger

#14

Post by yread »

Ah good old HIEW. It's the simplest and nicest disassembler - open a file switch to disassembly with one keypress. Move one line or one byte at a time for defeating code that jumps in the middle of instructions, edit the assembly (ok code bytes) in place with live preview what instructions you're writing. All in 130KB of code :) http://www.hiew.ru/

EDIT: I wonder why is the author using a version from 2004 though... I had to double check the date of the article. This tool is well worth the money!!!

Re: Pwning a Spammer's Keylogger

#15

Post by bockris »

qeorge wrote: post #13
bockris wrote: post #8

Earlier quoted context omitted.

I don't know if you're wrong but how do those password programs work? If they emulate a keyboard by sending keystokes to the appropriate input field they are most likely logged by programs like these. (not HW keyloggers tho). If the password programs use the clipboard, then it is just another source for the keylogger to capture and trivial to add. (edit: a screenshot lower in the article of the 'Perfect Keylogger' op…

Its been a while (AOL ;), but IIRC the Windows API lets you SET_TEXT directly by window handle. Assuming that's how 1Password works, it should be safe. I think that's a fair assumption because using the clipboard or SendKeys to an input box is all kinds of trouble in practice, and the API is easy.

But isn't that in itself another vector to 'hook' and redirect (just like the keystokes and clipboard)?

I'm going to agree with jiggy2011. Once you are compromised at that level then it's pretty much game over.

Re: Pwning a Spammer's Keylogger

#16

Post by martingordon »

bockris wrote: post #8
martingordon wrote: post #6

Correct me if I'm wrong, but one of the additional benefits of using a password manager such as 1Password is that it thwarts keyloggers. They may only get your master password (which shouldn't be your password on any site) but your site specific user name and password are never actually typed.

I don't know if you're wrong but how do those password programs work? If they emulate a keyboard by sending keystokes to the appropriate input field they are most likely logged by programs like these. (not HW keyloggers tho). If the password programs use the clipboard, then it is just another source for the keylogger to capture and trivial to add. (edit: a screenshot lower in the article of the 'Perfect Keylogger' op…

I was mostly thinking about the browser extensions, which probably use the extension API to directly set the values on the fields.

FWIW, the 1Password website (http://help.agile.ws/1Password3/security.html) mentions copy and paste in the context of other password managers that require you to copy/paste:

> Not only is this manual work inconvenient, but as soon as “copy and paste” are mentioned, you become vulnerable to keyloggers and phishing attacks.

Re: Pwning a Spammer's Keylogger

#17

Post by evilswan »

underwater wrote: post #9
evilswan wrote: post #2

Great post, really enjoyed following the trail along with the author. The sad part is, knowing how useless a lot of ISP's abuse@ emails are, the FTP might never be taken down this way.

I'm hoping that "emailed the ISP" means "deleted the contents of the server and emailed the ISP".

Or, change the FTP password and email that to the ISP abuse team. Spammer is locked out.

Re: Pwning a Spammer's Keylogger

#18

Post by TazeTSchnitzel »

underwater wrote: post #9
evilswan wrote: post #2

Great post, really enjoyed following the trail along with the author. The sad part is, knowing how useless a lot of ISP's abuse@ emails are, the FTP might never be taken down this way.

I'm hoping that "emailed the ISP" means "deleted the contents of the server and emailed the ISP".

Deleting the contents is illegal, heck, even accessing the server is illegal. Furthermore, it destroys evidence the ISP needs to shut it down.

Re: Pwning a Spammer's Keylogger

#19

Post by datagramm »

"This keylogger program can be legitimately purchased and used, ostensibly for monitoring your kids’ or employees’ browsing habits, etc. As you can imagine, PK can also be used for badness."

Is this person suggesting that using a keylogger to spy on your employees/children without their knowledge is not 'badness'?!

Re: Pwning a Spammer's Keylogger

#20

Post by sequoia »

datagramm wrote: post #19

"This keylogger program can be legitimately purchased and used, ostensibly for monitoring your kids’ or employees’ browsing habits, etc. As you can imagine, PK can also be used for badness." Is this person suggesting that using a keylogger to spy on your employees/children without their knowledge is not 'badness'?!

Recording your employees' use of company computers, given proper disclosure, is an employers prerogative. It's also legal (in some locales) for parents to do this to their children. I find it immoral, personally (the latter), but this is not the point of the story at all and the story was interesting and highly relevant, so I'm really disappointed to see this is the top comment.
Post reply on HN