Intercepting Passwords from Virtual Keyboards

Overview of techniques used to intercept passwords from secure flash drive authentication software using physical or virtual keyboards in comparison to the LOK-IT Secure Flash Drive hardware authentication.

Category:

Science & Technology

Tags:

• USB Flash Drives
• Nerve Net
• hack
• password theft
• security
• Kingston DataTraveler 5000
• Ironkey Basic S200
• Kanguru Defender Elite
• Lexar SAFE S3000
• virtual keyboard
• LOK-IT
• Systematic Development Group

[MultiTripman]

This video is very troubling to me because it seems to be attempting to dupe it's viewers. A demo of a common keylogger does NOT demonstrate a vulnerability of any of these products.

[wkstube101]

@MultiTripman What specific point do you find deceptive? I find that few people are aware that specialized keyloggers avoid detection by antivirus software, or that virtual keyboards can be similarly spied-upon. There is considerable history of password interception by viruses using such means of theft. In what way are these devices not vulnerable to such attacks?

[wkstube101]

If you mean that their vulnerability to such attacks is no greater than any other service that relies on software for authentication, that might be essentially valid. However, makers of these devices seem to imply that if their deny/allow logic is on the device they are not at all vulnerable to software-based attacks - and this is clearly not the case.

[kotorch]

Author seems to understand not the basics of security. Lear it -- 10 Immutable Laws of Security (search in Google). The very first is: "Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore". Get it -- not your data, nor the programs you run, from flash or whatever other device -- simply not yours anymore.

So, the security incident actually happened when author ran his program. It is naive to say AV doesn't detect it -- it's not their goal.

[codelyokoblue]

can the IronKey's virtual keyboard with ramdom scrambling of the keyboard be vulnerable to any sort of keyloggers?

[rydmerlin]

The Knox-IT products have a keypad on the actual drive and the OS never sees the actual pin being punched in. That's the point of having a keypad on the flash drive itself. Only the hardware of the flash drive sees the pin. not the USB port.

[technoheadgmailcom]

@MultiTripman

On the contrary. This is a very simple (for any competent Windows developer) to implement and shows a real vulnerability in these products. To be sure, these drives are better security-wise than your unsecured drives, but people need to be aware that vulnerabilities still exist with these products, especially with software based ones.