Cyberthieves Silently Copy Your Passwords as You Type

NY Times ^ | February 27, 2006 | TOM ZELLER Jr.

[neverdem]

Most people who use e-mail now know enough to be on guard against "phishing" messages that pretend to be from a bank or business but are actually attempts to steal passwords and other personal information.

But there is evidence that among global cybercriminals, phishing may already be passé.

In some countries, like Brazil, it has been eclipsed by an even more virulent form of electronic con — the use of keylogging programs that silently copy the keystrokes of computer users and send that information to the crooks. These programs are often hidden inside other software and then infect the machine, putting them in the category of malicious programs known as Trojan horses, or just Trojans.

Two weeks ago, Brazilian federal police descended on the northern city of Campina Grande and several surrounding states, and arrested 55 people — at least 9 of them minors — for seeding the computers of unwitting Brazilians with keyloggers that recorded their typing whenever they visited their banks online. The tiny programs then sent the stolen user names and passwords back to members of the gang.

The fraud ring stole about $4.7 million from 200 different accounts at six banks since it began operations last May, according to the Brazilian police. A similar ring, broken up by Russian authorities earlier this month, used keylogging software planted in e-mail messages and hidden in Web sites to draw over $1.1 million from personal bank accounts in France.

These criminals aim to infect the inner workings of computers in much the same way that mischief-making virus writers do. The twist here is that the keylogging programs exploit security flaws and monitor the path that carries data from the keyboard to other parts of the computer. This is a more invasive approach than phishing, which relies on deception rather...

[neverdem]

[saganite]

I don't bank online so I'm not worried about that but I was wondering if programs such as AVG (which I use) will find these programs.

[goldstategop]

Its a more insidious threat than phishing. A hidden keylogger can transcribe everything you type and sent it to an unknown server. And you have no way of knowing if a keylogger program is installed on your Windows computer.

(Denny Crane: "I Don't Want To Socialize With A Pinko Liberal Democrat Commie. Say What You Like About Republicans. We Stick To Our Convictions. Even When We Know We're Dead Wrong.")

[goldstategop]

Most anti-spyware and anti-trojan horse scanners will find them. That's why having an anti-virus program is not enough. I run Zone Alarm Anti-Virus and I also run Microsoft Anti-Spyware and Ewido Anti-Malware, which is an anti-trojan scanner.

(Denny Crane: "I Don't Want To Socialize With A Pinko Liberal Democrat Commie. Say What You Like About Republicans. We Stick To Our Convictions. Even When We Know We're Dead Wrong.")

[HiTech RedNeck]

When typing critical data into a Windoze application, use the mouse to move around in the fill-in-the-blank, and enter the characters in a random order.

[goldstategop]

The ultimate defense to a keylogger program is to switch to Linux and Mac OS. Its the ultimate in computing security.

(Denny Crane: "I Don't Want To Socialize With A Pinko Liberal Democrat Commie. Say What You Like About Republicans. We Stick To Our Convictions. Even When We Know We're Dead Wrong.")

[HiTech RedNeck]

So long as the *uxes remain in a decided minority that will be true.

Any *ux that is dummy-friendly enough to displace Windows, will be about as promiscuous.

[neverdem]

When typing critical data into a Windoze application, use the mouse to move around in the fill-in-the-blank, and enter the characters in a random order.

Could you give an example of both?

[HiTech RedNeck]

SSN: 123456789

type 5
mouse in front of the 5
type 2
mouse after the 5
type 9
etc.

[saganite]

A quick google search turned up some antikeylogging software. Any recommendations on which one works?

[goldstategop]

I recommend Ewido and Microsoft Anti-Spyware - they're both free. The guard on Ewido costs extra but is worh it. Don't click on links in e-mail that purport to come from Paypal or your bank and you should be fine. And never ever disclose your passwords to any one. 'Nuff said.

(Denny Crane: "I Don't Want To Socialize With A Pinko Liberal Democrat Commie. Say What You Like About Republicans. We Stick To Our Convictions. Even When We Know We're Dead Wrong.")

[adamsjas]

When typing critical data into a Windoze application, use the mouse to move around in the fill-in-the-blank, and enter the characters in a random order.

Oh for pete sake get real....

Better yet, just get Linux, where the installation of an executable can't happen without your knowledge and cooperation.

Even if you deliver it, its not exectable till you MANUALLY set it as such.

Its been found that people too dumb to realize the risk of running untrusted software are also too dumb to figure out how to set untrusted software to be executable on linux.

Ok, standing back and waiting for all the posts telling me how windows is the be all and end all. No doubt typed by people running windows behind two firewalls, one antivirus, and three anti-spyware programs.

[beaversmom]

Computer security ping

[Turbopilot]

AVG is for antivirus. Go to Zonelabs.com for a good firewall, which will do a lot more to prevent new threats (as opposed to trying to remove existing threats). It's also a good idea to run a hardware firewall - my wireless router does the job for me, but getting a cheap router even if you don't have a laptop or multiple computers isn't a bad idea, as an extra layer of protection.

My comprehensive list of fully-automatic and free (for home use) protection is:
AVG Antivirus from Grisoft
ZoneAlarm firewall
Spybot Search-and-Destroy (including TeaTimer)
SpywareBlaster(even if you don't bother to manually update it)
Microsoft Anti-Spyware (yeah, really)

I use several other products, including Ad-Aware, but you can install and set up the above and, assuming you haven't already been hit with malware, be safe by setting them to operate completely automatically. I personally don't see the problem with actually clicking on a security program once in a while, but because certain fans of non-Windows operating systems believe that they can be secure without doing anything, I enjoy showing Windows users how they can do the same.

[Knitebane]

Strictly speaking, no.

If you're serious you use Trusted Solaris, Tru64, HP-UX BLS, or some other hardened system.

Those systems generally cost bundles of money and run on specialized hardware that costs bundles more.

After that comes OpenBSD. It's probably the most secure OS generally available for commodity hardware today.

Linux (depending on the version), OSX, and the other BSDs come in after that.

Then the not-so-secure distros of Linux (like Linspire).

And Windows at the bottom.

But practically speaking, yes, running Linux or MacOS is so much more secure than running Windows that they are the utlimate in security.

[Knitebane]

A quick google search turned up some antikeylogging software. Any recommendations on which one works?

The one without a built-in keylogger.

[adamsjas]

My comprehensive list of fully-automatic and free (for home use) protection is: AVG Antivirus from Grisoft ZoneAlarm firewall Spybot Search-and-Destroy (including TeaTimer) SpywareBlaster(even if you don't bother to manually update it) Microsoft Anti-Spyware (yeah, really)

What kind of fool would trust the same company that wrote that buggy, total seive of an operating system in the first place write an Anti-Spyware program?

My god man, get a clue.

[D-fendr]

So long as the *uxes remain (more secure)…

…the smart thing is to use them if at all possible.

Mothers don't let their mothers use Windows - especially for banking.

[HiTech RedNeck]

One reason Windows sells so well is that the user doesn't need to know squat about the operating system to install something new. See a cute new program? Whee, here we go, one click, none of this save to and chmod business.

In response, there are Linuxes now that habitually run as root. They are dummy friendly. And dangerous.