From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ww0-f50.google.com (mail-ww0-f50.google.com [74.125.82.50]) by mail.saout.de (Postfix) with ESMTP for ; Wed, 14 Apr 2010 15:11:50 +0200 (CEST) Received: by wwi18 with SMTP id 18so60051wwi.37 for ; Wed, 14 Apr 2010 06:11:50 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <4BC4CC14.6080408@redhat.com> References: <20100412171540.GA3138@tansi.org> <20100412175856.GA12353@fancy-poultry.org> <20100413154850.GA19142@tansi.org> <20100413193831.GA8772@fancy-poultry.org> <4BC4CC14.6080408@redhat.com> Date: Wed, 14 Apr 2010 15:11:50 +0200 Message-ID: From: Olivier Sessink Content-Type: text/plain; charset=UTF-8 Subject: Re: [dm-crypt] avoid keyloggers: enter password with mouse (virtual keyboard) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de 2010/4/13 Milan Broz : > On 04/13/2010 09:38 PM, Heinz Diehl wrote: >> On 13.04.2010, Arno Wagner wrote: >> >>> If he has a hardware Keylogger on his system, somebody >>> did physically manipulate his machine and all bets >>> are off anyways. >> >> Of course. >> >> So this boils down to the fact that a software keyboard is useless :-) >> If somebody had physical access to the machine, there will be no >> way to detect any backdoors, and if somebody had been able to install a >> software keylogger, this person has already gained root access to the machine >> and could simply have read the master key from memory or whatever, you >> name it. > > I just remember schoolbook example with "software keyboard" where > such keyboard was used to enter PIN using mouse. > > Instead of sending the key scan code back to hidden logger program, > it simply send rectangular areas on screen (screenshot) centered to > mouse clicks... > So attacker can easily read pin code from these few-bytes small pictures > of visual keyboard:-) 1) a hardware keylogger costs about $100,-, can be ordered on many places, and requires no technical expertise whatsoever. A hardware keylogger is 100X easier than software modifications, or a hardware-mouse-sniffer (I've never seen them) 2) we have protected ourselves from software modifications already (boot from USB). So a hardware keylogger is our biggest threat. 3) most virtual keyboards I have seen are randomly positioned on the screen, so you really need a well-positioned camera to capture the password (which, again, is much more complex than a hardware keylogger, requires a lot of technical expertise). Olivier