Security

Malware

Last updated Jan 1, 2001.

This new section will be devoted to the subject of malware. By malware, we are referring to the viruses, worms, Trojans and other forms of software out there that threaten information security. As we will discuss in coming weeks, malware can undermine all three facets of the CIA (confidentiality, integrity, availability) security model. Depending on the program's intent, sensitive information can be extracted from a victim's computer, files deleted, and denial of service attacks initiated by the infected host to limit the availability of other hosts. This section will investigate these aspects of malware, demonstrate how malware works, and provide tips to help users protect themselves.

Viruses vs. Worms

Is it a virus, or a worm? This question often causes a great deal of confusion, and for good reason: even anti-virus "experts" have never been able to agree on an exclusive definition for each.

The list of possible definitions includes advanced, expert-oriented classifications that define worms as a sub-class of viruses. At the other extreme are newbie-oriented classifications. For example, the Computer Security Division of the National Institute of Standards and Technology (NIST) gives a beginner's introduction to viruses as follows:

"Viruses are the colds and flus of computer security: ubiquitous, at times impossible to avoid despite the best efforts and often very costly to an organization's productivity. NIST recommends using a two-tiered approach for detecting and preventing viruses from spreading: On personal computers, install and use anti-virus software capable of scanning disks, attachments to email, files downloaded from the web, and documents generated by word processing and spreadsheet programs. Use anti-virus software at Internet gateways or firewalls to scan email attachments and other downloaded files. Anti-virus software should be installed when the personal computer is initially configured. The software should be updated weekly with new virus definitions, and your vendor may provide an automated update feature. Organizations may benefit from using several brands of anti-virus software."

Most antivirus researchers will give a common, yet not fully accurate differentiation of viruses vs. worms as follows: "A virus must attach to another program to spread, while a worm spreads on its own." This echoes an ancient post by Purdue Professor Gene Spafford, from 14 years ago, on the public alt.comp.virus newsgroup:

"Well, there are many differing definitions, with one extreme being that all worms are viruses.

"The definitions I think most people use are:

Although this antique delineation is convenient for Internet discussion, it is no longer accurate for academic research involving viruses and worms. In fact no one has ever been able to successfully separate the two, as Nick FitzGerald reported on the public alt.comp.virus newsgroup:

In contrast, commercial vendors often use a working definition, such as

Symantec's:

However, this does not take into account combination worm/viruses, such as the Melissa virus.

In 1996 Fridrik Skulason attempted a more academic definition of a virus on the alt.comp.virus newsgroup:

"#1 A virus is a program that is able to replicate - that is, create (possibly modified) copies of itself.

#2 The replication is intentional, not just a side-effect.

#3 At least some of the replicants are also viruses, by this definition.

#4 A virus has to attach itself to a host, in the sense that execution of the host implies execution of the virus

---

#1 is the main definition, which distinguishes between viruses and Trojans and other non-replicating malware.

#2 is necessary to exclude for example a disk-copying program copying a disk, which contains a copy of itself.

#3 is necessary to exclude "intended" not-quite-viruses.

#4 is necessary to exclude "worms", but at the same time it has to be broad enough to include companion viruses and .DOC viruses."

However, the definition breaks down on the qualifier to #4.

The truth is that no one has been able to delineate viruses vs. worms successfully. Any analogy to medical parasites breaks down very quickly. Thus, when discussing viruses or worms in an academic paper, it is important to define your malware in the context with which you are presenting it.

To date, we prefer Dmitry Gryaznov's classifcation of viruses and worms. From a catholic perspective, it is the most accurate and most suitable for academic research:

Keyloggers

One of the most popular and devastating types of spyware is the keylogger. When one is installed correctly, it has the power to capture and record all the data passing from the input device (keyboard, mouse, etc) to the computer. While the ethical considerations of using such a program are open for discussion, the keylogger is used for numerous purposes. Whether monitoring a child's actions, spying on a spouse, capturing keystroke information for productivity purposes, or even collecting passwords, the keylogger is one of the most commonly used spyware. This section will take a look at the internals of keyloggers and how they work. In addition, we will also discuss the methods by which you can detect keyloggers and protect your computer from nosy intruders.

What are keyloggers

A proper definition of a keylogger is "any device or program that captures information from an input device and places the captured data into a file." What this should tell you is that a keylogger can take many forms; some almost impossible to detect. Regardless of the type, a keylogger generally does one thing; capture the keystrokes from a keyboard. At one time this would have been enough. However, in the last three decades of computer use, many other methods of input have been devised that allow a user to interact with a computer. Mice, touch screens, verbal commands, and even thought control have been used to control a computer. As a result, keyloggers have evolved to include many other methods of monitoring, which extend well beyond the scope of this discussion. Therefore, we will focus mainly on the keylogging abilities, but will address alternate methods of capture at the end of this section.

Hardware Keylogger

Hardware keyloggers are small lipstick shaped devices that are placed inline, between your keyboard and computer (see figure 1). Since they are connected near the back of the computer, which is often hidden from site, these devices are rarely noticed or detected, as figure 2 indicates. Unfortunately, this easily overlooked device has the power to record hundreds of thousands of keystrokes, including passwords, credit card numbers, or adulterous conversations.

Figure 1Figure 1: Hardware Keylogger





Figure 2Figure 2: Installation of keylogger

The hardware keylogger is a very straightforward device. It simply captures the electronic signal from the keyboard and stores it in a local data buffer within the tube shaped device. In order to extract the data from the internal buffer, the device constantly monitors the incoming keystrokes until it detects a secret password. This will in turn trigger a program located on the keylogger that allows the user to output the captured data into a waiting program, such as Word or Notepad. While this is usually done at the target computer after hours or when the target is away on an errand, it is just as simple to remove the keylogger for future analysis at any computer.

Hardware based loggers have the advantage of remaining mostly invisible to the average user. Since most users don't have a clue about what should or shouldn't be plugged into their computer, they won't notice the small device. In addition, since there are no processes or programs running on the target computer, it is invisible to any nosy users or antivirus/keylogger detection programs. Related to this, a hardware keylogger is impervious to hardware crashes, system formats, or even complete changes to an operating system. If your target user dual boots their system between Linux and Windows, this type of keylogger could be your best choice.

Unfortunately, there are several disadvantages that could make this type of keylogger impractical. First, the cheapest version costs about $60 for the 32k version. This will provide enough space for a few days of data capture, depending on how heavily the computer is used. There are more expensive versions that can store 128k for about $89.00, but when compared to software based keyloggers, some of which are free, the price could be a major deterrent. Another disadvantage is that a hardware logger requires local manual installation, which means you must have access to the machine. Most software loggers can be installed and then monitored remotely, which reduces the chance of getting caught red handed. Finally, you will have to extract the data regularly or risk the chance that the buffer will fill up. This means replacing the device with a spare, or spending time at the user's computer reading the keystrokes. Finally, many of these devices have one standard password that allows you to access the captured data. If someone inadvertently types this password, they will end up with a rather interesting surprise.

GetAsyncKeyState

By far, this is the simplest and fastest method to create a keylogger program. Using Visual Basic, which has a reputation for being easy to program with, a programmer can create a loop in which they repeatedly call the GetAsyncKeyState function to determine if a key state has changed since the last time the function was called. Since the state changes when a key is pressed, it is easy to detect a change in the KeyState status. The program then reacts to the change in state by appending the corresponding character to a log file. While this does make for a rather straightforward program, using this method is notorious for slowing a computer down because a GetAsyncKeyState command must be execute for each and every possible key value, regardless of whether any were pressed. In other words, this program will run constantly in the background, thus stealing processing time from other programs. The following is an example of how this method is used. You can see that this is a very harsh program, with regard to efficiency.

Private Declare Function GetAsyncKeyState Lib "user32" (ByVal vKey As Long) As Integer

'You are checking each character stroke in decimal...though your typical 'ASCII characters are decimal 32 – 126
For i = 1 To 255
  state = 0
  state = GetAsyncKeyState(i)

  'This checks to see if the state is on or off
  'If on, they you got your key stroke
  If result = -32767 Then
   keyText = Chr(i)
   'Keytext can then be stored into a file

Next i

There are ways a programmer can optimize this general process. For example, a program could monitor the keyboard state for changes and then check each key state or it could include a filter to only capture valid keystrokes. Examples of this are easy to find online, and often are the creation of college students looking to expand their programming skills while donating something "hackerish" to the public. As a result, many of these programs are buggy or could include a hidden surprise that are just as, if not more, dangerous than the keylogger.

The Hook

This is the most commonly used method by which programs monitor key strokes with a reported 90% usage rate. This type of logging is accomplished via SetWindowsHookEx() function that is used to monitor all windowing messages. Generally, a keylogger using this technique will come packaged as an executable (.exe) file that initiates the hook, and a dll file that handles the logging functions.

Once the hook is established, the program has access to all window messaging information, including window titles, button labels, and more. At this point, the programmer must filter and convert the information it captures and append the relevant information into a text file. If this sounds complex, you are right. This method is much more difficult to implement than either of the previously discussed methods; however, the effort is often worth it because this type of keylogger grants the keylogger program to much more than just keystrokes.

Depending on the programmer, a hook based keylogger can obtain the autotype text, passwords, and other information normally hidden from a keylogger. Since autotype text is not generated from any type of input, the hardware or VB based keylogger will never see the 'typed' character. As a result, many of the professional keyloggers use this type of hook and then build upon it to add all sorts of power and control. Unfortunately, the hook method is easy to detect and many AV programs monitor files for the SetWindowsHookEx function and flag it as a risk.

An example of this type of program is GhostLite, which captures program names, URLs, characters, and more. The following is a short excerpt from GhostLite that demonstrates the amount of information this type of program can capture.

[ ** USER sfogie on COMPUTER 8200XP ** ]

[Ghost Keylogger] - Wed Jun 23 15:55:35 2004
[Disarm ALL software keyloggers and hardware keyloggers on your PC and servers! - Netscape] - Wed Jun 23 15:55:39 2004
 [Keys]
 {
  c
  
 }
 [URL] { http://www.anti-keylogger.com/ }
[Ghost Keylogger] - Wed Jun 23 15:55:49 2004
[Ghost Key Logger Lite Configuration] - Wed Jun 23 15:55:50 2004

Ironically, this demonstrates both the strengths (lots of detail) and weakness of this type of keylogger. You can see from the log file that I hit the letter "c". This letter was entered in my address bar of Netscape, which promoted a dropdown box with several URLs listed. From this list I clicked on cnn.com, which caused http://www.cnn.com to load. As you can see, GhostLite did not automatically fill in the rest of the generated address automatically, and when it did capture a URL, it got the wrong one. I suspect that because Netscape opens different websites in tabbed windows, GhostLite accidentally focused on the wrong tab, which caused it to post the wrong URL and web information.

Kernel/Driver keylogger

A kernel keylogger operates at operating system level, which means it is first in line for the data coming from the keyboard. In many ways, a kernel keylogger replaces or alters the core software that is responsible for interpreting the keystrokes and turning them into the characters you see on the screen. How this is accomplished varies depending on the hardware and OS.

Within Linux, an attacker could alter the code of any system file (e.g. keyboard.c) and rebuild the kernel. This would cause the keylogger code to become part of the core OS, which would load each and every time the computer was booted. A Window driver level keylogger could easily be installed by overwriting a core .dll or .exe file that is loaded when the OS is booted up. Depending on the OS, the keyboard logger could be loaded right after the operating system detects the hardware connected to the computer, which would give it full control of the entire system and even provide access to the authentication information required by the end user to access the computer. In other words, the keylogger would have more power and access than the user.

The benefit of this type of keylogger is that it can be undetectable. Because the keylogger is executed before the rest of the computers programs, it can take precautions to hide itself. Unfortunately, this also means the keylogger may miss some information that passes at the application layer, such as autocompletes and address bars. Despite this, a kernel keylogger is generally considered to be the best because it is undetectable.

Other types

There are many other devices out there that could become a target for a keylogger. Dumb terminals, ATMs, phones, and even PDAs are all possible victims. For example, Windows Mobile, the OS that runs on millions of Pocket PCs, can be infected with a keylogger. This is a unique situation because PDAs do not have physical keyboards, but instead use a software based keyboard called a Soft Input Panel(SIP). The default SIP is part of the core OS that is burnt into the devices ROM. This means it can not be overwritten. However, with a little registry editing, Windows Mobile can be tricked into ignoring the default keyboard and load a fake keyboard with a logging capability built into it. This requires some extensive programming, but the reward is a completely invisible keyboard logging program.

Protection

It is possible to detect most key loggers. Hardware keyloggers can be detected with a quick scan of the wire from your keyboard, most software loggers can be detected via AV programs or spyware programs like spybot or anti-keylogger. It is also not a bad idea to operate a firewall to block any keylogger that connects to a network to send out its collected information. In general, a keylogger is not too different than a virus, and should be prevented in much the say way (i.e. do not install unknown programs, etc).

Summary

This section outlined what a keylogger can do, and how it works. As you can see, they are not all built the same. While keyloggers have a definite place in this world, they can be used with malicious intent. In many ways, they are like security cameras; they provide the power to monitor and detect problems, but can be abused to hurt. In addition, what a keylogger is not to be completely trusted. As one person said, "My husband has no clue that I know he is spying on me."