Question

I might write a program to detect malicious (or non-malicious) software that is key logging (logging key strokes to gain information).

1. What tactics would be used?
   • Is there certain code to look for?
   • Are there certain locations I should search?
2. I prefer Java or Perl as I am fluent in those languages
   • Would these languages work?
   • Is there a better language to use for this case?
3. What would be used?
   • Code?
   • Algorithms?
   • Function?

Answer 1

I think it depends on what you are attempting to do. If you are looking for known keylogging programs, you could use any software that can search the file system to view file signatures. However, it sounds like you want to detect unknown programs. I do not believe this is strictly possible. Keylogging applications can passively listen to the keystrokes so there is not an active signature you could look for. It would probably be easier to understand the software that is supposed to run on your computer and then detect any new software that starts to run. It wouldn’t necessarily be keystroke logging software, but it would be unauthorized software (or at least yet to be authorized software).

Keystrokes are broadcast to the system as events that you can subscribe to in your application. This is how games and other programs use the keyboard input. The entire system knows when a key is hit and which key it was. You can’t know who is listening.

To put it another way, if this were possible, it would kill software keystroke loggers since every anti-virus and anti-spyware application would have an option to detect and remove all of these types of software. They have an option similar to this, but it is based upon known signatures of known keystroke loggers.