Keylogger for cybersecurity and optimisation

Ruslan Rakhmetov, Security Vision

Keylogger is a tool for obtaining information about keyboard keystrokes that can be used inside various IT, IS products, devices and even malware. In the current article we will look at the capabilities of the service and its application for different tasks.

The use of the service was primarily developed by spies and attackers to capture user actions. When a user searches for something on the Internet, works with files and enters passwords, he uses various input means: joystick, mouse, keyboard, touch screen. The system detects the keys pressed and performs the corresponding actions: moving the avatar in the video game and meta-universe, displaying text on the screen, opening menus and launching programmes. Attackers can use this data to gain access to password-protected services, so it's important to protect yourself with antivirus and EDR systems that can detect and stop suspicious activity.

However, by itself, a keylogger as a tool is not harmful and can help parents in controlling children, companies in investigating IS incidents or managing contractors' access to sensitive services to improve security. Below we will break down classic tasks and solutions that apply keylogging.

Keylogger actions can be compared to the work of secretaries at court hearings, who meticulously record everything said and happened in the room, for storage and publication in accordance with the law. From an audit and IT point of view, keylogger is used in PAM (Privileged Access Management) class systems, which are used for secure access to databases and important company services. The system allows capturing commands entered by IT specialists that manage data in services, as well as auditing if something went wrong as a result of the work.

IS systems of UAM (User Activity Monitoring) class, which we have already discussed earlier, also apply keylogger for cybersecurity tasks: machine learning allows capturing the ‘keyboard handwriting’ of an employee, determining who uses a corporate PC or laptop without launching a webcam or video surveillance and ACS in the office. By typing speed, typos and frequent words/phrases, a keylogger can determine quite accurately if an intruder has authorised the computer instead of the right user.

Sensitive data protection systems such as DLP (Data Loss Prevention) also often collect data transmitted on the Internet and sometimes messengers (it should be noted that legitimate use of such tools is possible only on corporate devices and with the consent of the user, as interference in privacy can lead to fines). Since some channels of information transmission are technically impossible to protect (encrypted messengers, proprietary protocols in browsers), a keylogger allows assessing the presence of confidential information in text even before encryption and can therefore be used for incident investigations. For the safety of the users themselves, such systems usually do not save all the information and can generate incidents by deleting the text itself, but allowing to react in time to a possible leak of the customer database or transfer of personal data outside the company.

Typos and other typing errors are a natural occurrence that, on the one hand, can identify an employee and protect their device, but can also be disruptive and disengaging. Each of us has likely typed text on a different layout (Ghbdtn! Rfr ltkf&) or simply made typos. Keyboard hooking allows you to automatically detect such inconveniences and even automatically correct the error. Keylogger in programs such as Punto Switcher allows you to simplify the life of ordinary people, but can be used by attackers, so for your own safety it is worth thinking about the balance between convenience and possible consequences. In addition to the keyboard, modern tools allow you to interact with the clipboard when copying and pasting text, as well as to perform auto-replacement, substituting whole words and phrases instead of short combinations and characters. This approach can be compared to stencils and moulds used in engineering graphics and descriptive geometry or graffiti artists who use repetitive elements in their art.

Various services can use artificial intelligence to prompt the user: in modern mobile devices, keyboards usually collect statistics and suggest clever options to continue the text, matching emoji to formulate thoughts faster. Advanced prompts appeared in business-favourite blackberry devices, which have always been famous for their keyboards. And after that they started to be used in other products: depending on the writing style and personal dictionaries of users, the interception of the currently typed text allows to anticipate words that may be useful to continue the text. The more the user types, the better the keyboard suggests new words, so a keylogger can speed up communication. It is used not only in mobile devices, but also, for example, in browsers and internet search engines. Modern electronic dictionaries and translators also use a keylogger for quick output: even before a word or phrase is typed in its entirety. The result is services that are something like navigators in maps: by determining your current GPS location, the direction of your gaze and the final point of your route, the systems can help you find yourself faster in the urban jungle and reach your destination. Only instead of coordinates in GLONASS or Starlink satellite systems, keyloggers use statistics of keys pressed on the keyboard.