Best Way To Avoid Keyloggers On Public Terminals? 701
goombah99 writes "While on vacation, I occasionally need to check my e-mail on a public terminal. What are some good techniques for avoiding keyloggers? Most of my ideas seem to have major drawbacks. Linux LiveCD can probably avoid software keyloggers, but it requires an invasive takeover of the public terminal, and is generally not possible. Kyps.net offers a free reverse proxy that will decode your password from a one-time pad you carry around, then enter it remotely. But, of course, you are giving them your passwords when you do this. You can run Firefox off a USB stick with various plugins (e.g. RoboForm) that will automatically fill the page in some manner they claim to be invulnerable to keyloggers. If that's true, (and I can't evaluate its security) it's getting close to a solution. Unfortunately, keeping the password file up-to-date is a mild nuisance. Moreover, since it will need to be a Windows executable, it's not possible for people without a Windows machine available to fill in their passwords ahead of time. For my business, I have SecureID, which makes one-time passwords. It's a good solution for businesses, but not for personal accounts on things like Gmail, etc. So, what solutions do you use, or how do you mitigate the defects of the above processes? In particular, how do people with Mac or Linux home computers deal with this?"
I don't type (Score:5, Interesting)
Context menu is your friend (Score:2, Interesting)
Simple idea (Score:4, Interesting)
S/KEY (Score:5, Interesting)
Not much else to be said. Maybe you could also use a crypto token and asymetric crypto, but considering that you need drivers, I'd say it's not practical. You might still use some sort of somewhat disposable private/public key. That should defeat keyloggers, but you risk getting your key compromised (that's why it's disposable).
Re:Anonymous Coward (Score:5, Interesting)
Not all keyloggers are software.
Re:Anonymous Coward (Score:5, Interesting)
Re:Phone? (Score:4, Interesting)
Frankly, you ARE better off with some form of wireless PDA or PDA Phone... but if you want to be cheap, it will still cost you time.
How about this... (Score:4, Interesting)
So a clever IT department could make passwords dependant on the time and date. Print out a code sheet, different for each employee, with words substituted for the date and time, a short word for the date and a short word for the ten minute time period you're in, something like that.
This way the password would be useless to a logger, you'd need a code sheet to log in, but it doesn't seem like it would be THAT much trouble (if your info is so important you're this paranoid...)...
I call the patent!
Photographic Authentication (Score:1, Interesting)
KeyScrambler (Score:4, Interesting)
Synchronized Random Code List (Score:5, Interesting)
This sort of set-up could be very useful for people who frequently use public terminals. Your code can still be compromised but the crooks would only have a few minutes to retrieve and use it. Maybe you could even have it so that when you use a code once, the central code verification server invalidates it, so no-one else can log in, even if they do get the code quickly.
I don't believe anything like this exists for the average person wanting to use normal email accounts though. Anyway, none of this changes the possibility that there are screenshots being taken every few seconds so that all of your private emails will be viewed later anyway.
Re:Phone? (Score:5, Interesting)
Cheap and quick option (Score:1, Interesting)
Texting 1 time password (Score:5, Interesting)
AFAIK it's still in use and have never been cracked.
Re:I don't type (Score:5, Interesting)
Nero Safekey (Score:1, Interesting)
I found that nero's safekeys work the best at public terminals. Granted, i don't do anything sensitive at them in the first place (i try to get my email on my phone when i'm on vacation). But i like nero, it prevents (or so it says) keylogger from reading what i type and i can keep it on a flashdrive for use on any machine. This won't stop a hardware keylogger, but people should look before they use them anyway.
-BMJ out
Auto Password Send? (Score:5, Interesting)
Now the system requires something you know (your password) and something you have (your phone).
Re:Don't use public terminals (Score:4, Interesting)
I'll usually do some "click obfuscation" as I type in the password as well but I have a feeling that's mostly a placebo feature.
Re:S/KEY (Score:3, Interesting)
What I'd really like to skip the PDA. Instead just take a page of say 100 one-time passwords. But how might one set this up? I'm handy with perl but I'd prefer a robust worked out solution.
Re:I don't type (Score:5, Interesting)
Every bit of security helps, but I don't think we should be under the illusion that keylog-writers haven't caught on to these kind of tactics.
*This is based upon a talk I was recently at where a Symantec security analyst was asked about keyloggers.
Re:I don't type (Score:5, Interesting)
Re:I don't type (Score:3, Interesting)
Re:I don't type (Score:5, Interesting)
Many methods can be imagined to add to the difficulty, including moving the window around, selecting other objects intermittently and entering keystrokes while they are active, and so on and so forth.
Remember, no single method is perfect, assuming there is a keylogger. Hopefully the keylogger owner is after the low-hanging fruit, which you won't be if you do any of these things. If he's actually targeting you specifically, you have bigger things to worry about.
Forward your emails to a throwaway account (Score:1, Interesting)
This way, the danger is limited to a few current emails and your main account cannot be misused or compromised.
You could also prevent emails from particularly sensitive sources from being forwarded with filter rules, if you know you wouldn't need them over the holidays.
Re:Obfuscate password entering process (Score:3, Interesting)
This does not necessarily work. Complacency that once upon a time it fooled keyloggers does not make it a sound tactic for evading them.
The strategy is well-known, and you can expect an advanced keylogger to detect it.
The keylogger can pick up on the keystroke and identify the active window handle. The text boxes that have password masking turned on stick out like a sore thumb.
Identifying the cursor position is not hard.
The mouse coordinates you click on will be within the text box and will tip off any eavesdropping program that cares about the change of cursor position
Automatically determining the final value of the password field when you press 'enter' or now click a 'button' instead of the text field is a clear possibility.
Re:Anonymous Coward (Score:1, Interesting)
Does cloicking on the onscreen keyboard get logged (Score:2, Interesting)
Use VNC with temporary passwords (Score:5, Interesting)
Every time you stop by at a cybercafe, connect to your VNC, do your business with all your passwords pre-saved safely on your home desktop. Once done, execute a script which will change the password to the next password on the list, log out, and move on.
I haven't done this myself, but last time I went to Italy and had to use some really shady cybercafes, I really wished I had a system like this in place...
- shazow
Freshly rebooted OS from read-only network image (Score:2, Interesting)
Stick to these types of internet cafes and there's less risk, as users aren't able to fiddle with the OS.
They are usually run by larger companies or are part of a franchise as well, and often coin operated, therefore don't have a flow of short-term staff coming through.
Also if the computer has a regular keyboard on a cable (not bolted into the desk) check the cable for hardware key logging devices...
http://images.google.com/images?hl=en&q=ps2+keylogger&btnG=Search+Images&gbv=2 [google.com]
Sometimes the smaller internet cafes and youth hostels simply just have unsecured windows boxes, pretty dodgy. I remember a couple of years back I was in a hostel in Madrid and was using the computer to book my next hostel in the next city I was traveling too. I put the first digit of my visa card in (they all start with 4) and the form auto-complete feature displayed every visa card that had been entered in the past. As Garth would say "that's not good, i'm not happy". I didn't book obviously.
Re:I don't type (Score:3, Interesting)
Re:Phone? (Score:3, Interesting)
Re:I don't type (Score:1, Interesting)
Re:I don't type (Score:5, Interesting)
tm
Not just keylogging: cookie-stealing (Score:2, Interesting)
HSBC Direct (Score:1, Interesting)
Re:I don't type (Score:5, Interesting)
You take that horrible security abomination of a webpage that gives you your passwords to cut'n'paste and you sprinkle it with freshly randomized obfuscation characters every reload (or once an hour so someone who DID find your secret webpage wouldn't be able to constantly refresh to ascertain your passwords). Then you can copy the whole line and then just select-delete the bits that don't belong. Since the garbage parts are different each time (or nearly each time) even a mouse grabber won't be able to reproduce the password string by reproducing the technique.
None of this solves the problem of a logger grabbing the POST data.
My best guess at a platform-independent solution is to VPN using secure authentication to a network you trust and proxy-browse from there. Get your keys all set up nicely at the trusted computer, and you shouldn't even have to type in any passwords, right?
Re:S/KEY (Score:1, Interesting)
Re:Simple solution (Score:5, Interesting)
Very true and *must* be remembered when at a govt installation - especially ones that had ever done nuke stuff at some point. There are MANY reasons for a "secure" rating and it may be more to protect you than the what is inside the compound.
There was an incident shortly after 9/11 where some reporter showed how "insecure" a sight at LANL was by scaling a fence, cutting a lock off a building, and taking many photos. It also included a rant about why spend security on those empty buildings. After some posting across the internet he finally found out why (and anyone who has worked in such installations immediately knew the answer) - the building was contaminated with highly radioactive dust that is nearly impossible to clean up so just lock it off. Yep, that guy sure showed them by breathing in some gamma emitting particles.
I have been in facilities where real weapons research was going on and it had fully manned machine gun turrets and was (maybe) mined outside of the official walkway (the mines were according to lore at the area - hard to know if true though the machine guns were quite visible and would have been sufficient. I know much of the lore about the area I worked in wasn't true and the machines guns should have been sufficient). Never knew what they did there more than "weapons research" - I ate lunch a time or two with one of the principle designers of our Neutron Bomb and that was where his office was and that is far as I knew anything (and wanted to know - you don't ask about those areas).
"FOUO/Unclassified-Pretty much the catch-all for government owned IT-equipment."
I would add that much of what you post is on machines that the IT guys managed. I worked in the research division and because our research was on scalable system administration we did pretty much what we wanted with them. I know a number of other researchers mostly administered their own system as they sometimes required some software that IT wouldn't support.
The security of those systems ranges from good to horrid, shortly before my contract ran out we had an incident where well over 50 systems were compromised due to those peoples computers using a symmetric SSH key system from their office in a university (in this case the person didn't log out of a public terminal telnetted - yes telnetted - to their university desktop) to *all* the machines they had access too. Amusingly enough the hacker had access to the Big Iron machine (an IBM sp2) and didn't know what it was so he went for more desktops. It was an amusing meeting - after two hours of listening to a guy drone on about ssh keys, telnet, encrypted and unencrypted connections, keyloggers on public terminals, etc he asked any questions. First one: "What's SSH?" (note this included the chemists, physicists, biologist, and a few more "..ists" that had no real reason to know, we were all were giggling at this point).
Unfortunately some of the researchers were not very good at watching what systems they ran on. I know of at least once where someone was having trouble running on our stuff and I (being root) logged into their account and debugged their software. Found out later the reason they freaked when I told them what was wrong was that they were in the "sensitive unclassified" category. They had no idea root could do that and figured we normally ran a tighter ship security wise than the official systems did (which in some ways was true, in others not and they found out the latter the hard way).
*note - anonymous because even though it has been a number of years still not sure what I am allowed to talk about. So feel free to write me off
Re:Phone? (Score:3, Interesting)
However, given that they SELL most of this info (I'm fairly sure they do, judging some rumors that I've seen propagate to other databases.) By the same token, they're a lovely way to spread misinformation about yourself and find out who sells what to whom by watching how the lies propagate
Re:I don't type (Score:2, Interesting)
Changing password list. (Score:3, Interesting)
Keep a copy of the list with you, SSH in (or whatever), and run the script immediately.
Assuming no-one tries to log in from the time you enter your password in the Internet cafe to when you run the script, and change it, it's a perfectly safe method.
Re:I don't type (Score:3, Interesting)
Anybody tried a Blackdog? (Score:3, Interesting)
Re:I don't type (Score:3, Interesting)
My bank in NZ has a different policy. You are not permitted to use a public terminal with giving up liability protection.
But secure IM... please
Don't use an open source browser! (Score:3, Interesting)
Comment removed (Score:3, Interesting)
Re:I don't type (Score:3, Interesting)
https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/cps/securitycenter/general/PPSecurityKey-outside [paypal.com]
is an ideal solution to keyloggers.
~Dan
Easy (secure) solution (Score:1, Interesting)
Someone with a keylogger will grab the password to my USB key, but they won't get the key itself. This is true two-factor authentication, and easy to do.
Re:Phone? (Score:3, Interesting)
For the most die-hard paranoid, one-time passwords are the only real security you can offer against capture (such that even if they're captured, they're useless), presuming you have a way to look up the one-time password without exposing subsequent passwords (ie, you can't just have them written all on the same sheet of paper, or the pinhole camera could capture the next ones).
Even RSA SecureID is vulnerable if its information is captured by a system able to exploit it in real time, unless the RSA system only permits one successful login per account per minute (the interval it takes the SecureID to refresh its numbers). If the information is precaptured (such as by a camera before you've typed the digits), they could beat you to the authentication. The public terminal could be written to capture your authentication credentials, changed your entered credentials to false ones (to make you think you'd typed it wrong), and perform the real authentication in the background to gain access.
So it comes down to: there's theoretically no way to completely secure yourself when using a public terminal or when using even a trusted terminal in a public space if you are hyper paranoid.
Re:I don't type (Score:3, Interesting)
http://www.mydomain.com/robots.txt [mydomain.com]
More info here:
http://en.wikipedia.org/wiki/Robots_Exclusion_Standard [wikipedia.org]
Re:Phone? (Score:2, Interesting)
I know I my keys [Mouse1] [Firefox, Hotmail.com] somewhere [mouse1] [Word, Document1] in the house
So there is no benefit from that method of defense. FWIW, it was an off the shelf program, nothing elaborate or difficult to find.
Re:Phone? (Score:3, Interesting)
You have to assume you're going to be keylogged and design a system that is resilient to it.
I hide SSH keys (encrypted with passwords) around the internet on various web servers. Then i only need to download (and run) portaPUTTY and vnc viewer before i can see a desktop with a web browser with all my passwords set up and all the sites i want to go to as bookmarks tunnelled through a secure SSH connection. With VNC set on low colour the latency isn't too bad and accessing and writing email doesn't need high graphics anyway. Then before logging off i simply delete that key's reference from the
With this method there is no way an attacker at any single internet cafe could access anything i dont want them to. Its not totally fool proof but its paranoid enough for me.
Re:Phone? (Score:3, Interesting)
The risk to my company of losing it's List-X status (and hence 40% of our work) if there's a breach is too high to be flexible in this regard.