«

Can keyloggers be defeated by using the on-screen keyboard when typing in
passwords?

* On Thu, 24 Jun 2004 15:19:08 -0700, bbford wrote:
> Can keyloggers be defeated by using the on-screen keyboard when typing in
> passwords?
>


No. Anything on stdin counts as a keypress. Even cut & paste.

--
Of all the things I've lost, I miss my mind the most -- Ozzy

bbford wrote:

> Can keyloggers be defeated by using the on-screen keyboard when
> typing in passwords?

Nope, I just tested it with "Perfect Keylogger" and it got the keys.

HOWEVER, I am a developer who has come up with a way to type phrases
into applications (and web pages, etc) that, so far, NO keylogging
application has been able to track. I've tried 6 keylogging apps so
far (including "Perfect Keylogger" above) and they've all failed.

So, my question is: What are the so-called "best" keyloggers out there
that I can test with my technique? Do you know of any "bulletproof"
ones that claim to catch all? I want to see if they can put their
money where their mouth is. Thanks!

Are you familiar with how to detect a keylogger ?


"Me" <> wrote in message news:...
> bbford wrote:
>
> > Can keyloggers be defeated by using the on-screen keyboard when
> > typing in passwords?
>
> Nope, I just tested it with "Perfect Keylogger" and it got the keys.
>
> HOWEVER, I am a developer who has come up with a way to type phrases
> into applications (and web pages, etc) that, so far, NO keylogging
> application has been able to track. I've tried 6 keylogging apps so
> far (including "Perfect Keylogger" above) and they've all failed.
>
> So, my question is: What are the so-called "best" keyloggers out there
> that I can test with my technique? Do you know of any "bulletproof"
> ones that claim to catch all? I want to see if they can put their
> money where their mouth is. Thanks!
>
>
>

Check these links :

http://www.phrack.org/phrack/59/p59-0x0e.txt

http://www.infosecwriters.com/hhworld/hh2.php#ART2

Keith Workman wrote:

> Are you familiar with how to detect a keylogger ?

No, but I'm not interested in detecting them. I want to test them.
Detecting them just means a never-ending game of cat-and-mouse as
new loggers appear. My technique doesn't care if an unknown logger
exists, as it won't be able to log anything anyway.