Hi people,
I have come across the following idea on the 'Net. With this method you
cannot bypass keyloggers completely, however, you can *REALLY* confuse
them. It works with almost any application, but I'll explain it using
Keepass as an example. It goes like this (more info @
http://cups.cs.cmu.edu/soups/2006/posters/herley-poster_abstract.pdf):
You activate your target window. Now you find any area on that window,
which is unresponsive to keystrokes. For Keepass it is the keyfile
combobox (so you have to use a keyfile, but you should do it anyway :),
i.e. if you click the combo box and press a key, Keepass discards that
key. While the combo box is still open (or closed, doesn't matter, it
should simply must have the focus), just press a random number of keys
in that box. Now, you click the password box and type a character of
your password. Then you click the combobox again and press some more
random keys. And you repeat the process for each character of your password.
The more characters you use, the better. You could use literally
hundreds of chars. For even more confusion, I've added a few things of
my own:
- I'm making the password dialog completely transparent, since some
keyloggers make screenshots after each mouseclick and so they could
analyze the number of chars in your password
- your script can click in the password box in varying order, i.e. begin
with the a char from the middle of your pass, then on next turn, your
script clicks at the very beginning and types the preceding character,
then on next it clicks far right in the password box and types the
succeeding character (to the very first char), and so on.
I think the idea should be pretty clear and it's well suited to be
automated for very sensitive passwords.
Since Keepass 1.x Auto-Type can be easily intercepted, you could even
let PowerPro drag'n drop passwords (which is caught by virtually no
keylogger) from Keepass to target window, though I'm not sure how this
could be implemented in an easily reusable way.
A basic script which sends a single key to the password looks like this,
it sends a fake "a" and a real "b". But you could use any number.
---- CUT ----
local _target = "Open Database - Enter Master Key"
win.show(_target)
win.trans(_target, 255)
local _input_pos = "450 125" ;; relative position of password input
local _dummy_pos = "495 185" ;; relative position of combo-box
local _wsml = 50 ;; duration of shorter waits
local _wbig = 250 ;; duration of longer waits
win.mouse("save")
win.mouse("relative " ++ _dummy_pos ++ " lc")
wait.forinterval(_wbig)
win.keys("{to "++_target++"}a")
wait.forinterval(_wsml)
win.mouse("lc relative " ++ _input_pos ++ " lc")
win.keys("{to "++_target++"}b")
wait.forinterval(_wbig)
; and so on
win.trans(_target, 0)
win.keys("{to "++_target++"}{enter}")
win.mouse("restore")
---- CUT ----
I've no idea yet how could be use more effectively for more passwords.
I've also come across Keeform, which unfortunately works only for IE,
and so I'll post this to Autoit-Forums as well.
(http://www.autoitscript.com/forum/index.php?showtopic=19403)
For more techniques against keyloggers, see:
http://en.wikipedia.org/wiki/Keylogger#Keylogger_prevention
Hope this helps and any suggestions/improvements are most welcome.
Cü
