Ethical Hacking - Keystroke Logging and Spyware.pptx

Keystroke Logging and Spyware

1. Keystroke Logging and Spyware Class : III B.Sc Cyber Security Subject : Ethical Hacking Subject Code : XCI503B Presented By Mr. S.Vignesh (AP/CS) Department of Computer Science

2. What is a Keylogger? Software or hardware that records everything a user types. Can also log mouse clicks, visited sites, and opened programs. Often used to covertly monitor user activity.

3. Keylogger Capabilities Records keystrokes (passwords, messages, forms). May capture clipboard, screenshots, and app activity. Can send logs to attacker (e.g., by email).

4. How Software Keyloggers Work Act as a shim between OS and keyboard or hook keyboard APIs. Often installed via Trojans or malicious downloads. Can run in stealth/hidden mode to avoid detection.

5. How Hardware Keyloggers Work? Small devices attached between keyboard and PC (or inside keyboard). Some are wired (store logs locally); others are wireless (send data). Very hard to detect by software — visible only physically.

6. Examples of Hardware Keyloggers Inline adapters that look like keyboard extensions. Wireless loggers using Bluetooth or Wi-Fi. Commercial devices (example: KeyGhost -type adapters).

7. Examples of Software Keyloggers Silent low-level keyloggers that hide their process and files. Keyloggers that encrypt logs and auto-email reports. Monitoring suites that capture keystrokes plus chats and emails.

8. What is Spyware? Malicious code installed without consent that runs in background. Monitors computer & internet usage and reports data to third parties. Often bundled with other software or delivered via droppers.

9. Purposes of Spyware Surveillance: collect browsing habits, preferences, demographics. Advertising: inject/pop-up ads, redirect web traffic for pay-per-click. Data theft: capture credentials or personal information.

10. How Spyware Persists Hides in Registry Run keys or Startup folders to restart on boot. Uses Win.ini/System.ini lines or modifies system files. Alters hosts file to block security updates or redirect traffic.

11. Delivery Methods Trojanized programs, email attachments, drive-by downloads. Droppers/wrappers that install multiple malware components. Bundled with freeware or fake updates.

12. Signs of Infection Unexpected pop-ups or slow performance. Unknown programs in startup or unusual network traffic. Changed homepage or blocked access to security sites.

13. Detection & Removal Use multiple reputable antispyware/antivirus scanners. Check hosts file, Registry run locations, and Startup folder. Keep OS and security software updated; remove suspicious USB devices.