full-disclosure - Most common keystroke loggers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri Dec  2 00:48:45 2005
From: BlueBoar at thievco.com (Blue Boar)
Subject: Most common keystroke loggers?

Kyle Lutze wrote:
> say somebody's password is foobar, on screen there would be a page that 
> shows the new alignment of characters,such as saying a=c, d=3, b=z, etc. 
> so instead of typing foobar the password they would type in for that 
> session would be hnnzck.
> 
> The next time the screen came up, it would be a=n, b=l, etc. and the 
> password they would enter would be something else. Then, if the computer 
> had a keylogger, not too much anybody could do with that info.

If the only threat in the world were keyloggers, there are many schemes 
you could use.  My main point is that if your computer is fully 
compromised and the attacker can adapt, there's no scheme you can up by 
adding just software to the existing client computers that will help.

Second, the scheme you just proposed is a monoalphabetic substitution 
cipher.  The are considered somewhat weak, i.e. they print them in the 
newspaper to be solved with a pencil during your communte.

						BB