CP5603 Research Report: Comparing Hardware and Software Keyloggers

This research report provides a detailed comparison between hardware and software keyloggers, crucial tools for monitoring keystrokes and potentially compromising data security. The report begins with an introduction to keyloggers, explaining their functionality and the threats they pose, including the ability to capture sensitive information like passwords and financial data. It then delves into the two main types: hardware keyloggers, which are physical devices, and software keyloggers, which are applications. The report explores the features of keyloggers, such as keystroke logging, clipboard recording, and website tracking. It elaborates on various types of hardware keyloggers (regular, wireless sniffers, firmware, and keyboard overlays) and software keyloggers (hypervisor-based, kernel-based, API-based, form-grabbing, memory injection, and packet analyzer). The report also discusses the characteristics of hardware keyloggers, reported incidents, and the threats associated with both types. A significant portion of the report is dedicated to comparing hardware and software keyloggers across various aspects, including detectability, portability, security, and complexity. Finally, it concludes with a recommendation for data-oriented companies, advocating for the use of hardware keyloggers due to their advantages. The report is a valuable resource for understanding the nuances of keyloggers and making informed decisions about data security.

Research Report On
“Hardware Keylogger or Software
Keylogger?”
Submitted To:
Submitted By:
Abstract
1

Essentially, key loggers are the ability to record computer keystrokes. Key loggers are a
serious threat to users because they can track all sensitive data entered from the keyboard,
such as passwords, PINs, and account numbers. When a hacker accesses your personal or
sensitive information, the extracted data can be used to conduct online cash transactions with
your account. Key loggers may be used as spy tools that infringe on data in businesses and
state enterprises.
There are two types of key loggers: hardware and software key loggers. A hardware key
logger is a physical device that can be directly connected to a computer to record the keys
pressed on the computer's keyboard. Software key loggers, on the other hand, are applications
that are installed on computers or mobile devices.
After comparing both types of Keyloggers, Hardware keylogger is best suited for the data-
oriented company to use for the recording and monitoring purposes. I strongly recommend
using the hardware keylogger because of its pros over the software Keyloggers.
2

Contents
Introduction.........................................................................................................................................4
How Keylogger works?.......................................................................................................................6
Features of Keyloggers........................................................................................................................7
Types of Keyloggers............................................................................................................................9
Hardware Keyloggers..................................................................................................................9
Types of Hardware Keyloggers..................................................................................................9
1. Regular Hardware Keylogger.............................................................................................9
2. Wireless Keylogger Sniffers................................................................................................9
3. Firmware............................................................................................................................10
4. Keyboard overlays.............................................................................................................10
Software Keyloggers..................................................................................................................10
Types of Software Keyloggers...................................................................................................10
1. Hypervisor-based...............................................................................................................10
2. Kernel-based......................................................................................................................10
3. API-based...........................................................................................................................11
4. Form-grabbing based........................................................................................................11
5. Memory Injection based....................................................................................................11
6. Packet analyser..................................................................................................................11
Characteristics of Hardware Keyloggers.........................................................................................12
Reported Incidents of Keylogger......................................................................................................14
Threat of a Keylogger........................................................................................................................16
Difference between Hardware and Software Keyloggers...............................................................17
1. Detect ability......................................................................................................................17
2. Time Consumable..............................................................................................................17
3. Non-volatile memory.........................................................................................................17
4. Portability...........................................................................................................................18
5. Security...............................................................................................................................18
6. Complexity.........................................................................................................................18
Recommendations..............................................................................................................................19
References..........................................................................................................................................21
3

Introduction
Once installed on a system, a key logger is a type of monitoring software that can record all
keystrokes performed on that system. The first key logger was installed in the consulates of
the U.S. embassies in various countries in 1970, and Petersburg captured data used in harmful
ways. The user who installed the key logger can view all the keys entered on the computer.
The tool can be used to record target browsing activity and obtain personal information.
Then, they intimidate targets, withdraw funds from bank accounts, and sell information to
other cybercriminals, and on the dark web.
A key logger can be either hardware or a software key logger. However, keystroke logging
can also be used for criminal purposes. More commonly, keystroke logging is malicious
spyware that captures sensitive information such as passwords and financial information and
then sends it to third parties for misuse.
Fig: Keylogger types in system hierarchy
A study from 2005 found that more than 15% of corporate computers were running a few
sorts of keystroke logging software. Results showed that 80% of the business owners in US
4
External
Keyboard
Hardware
Keylogger
Software
Keylogger
Operating
System
User
Applications

have been found using Keyloggers to check their employees’ movement but nowadays use of
Keyloggers have been sky rocketed by much more than before (Adhikary et al., 2012).
5

How Keylogger works?
Software Keylogger
Once the keylogger is installed, it starts operating in the background (in a stealth mode) and
captures every keystroke of the target device.
Let’s take up a small example:
If you are the target and you opens the http://facebook.com and types “username” and
“password” for the log in. The keylogger records your username and password silently. The
person who installed the keylogger in your computer can misuse the data and can make
trouble for you in the future.
Hardware Keyloggers
The hardware Keyloggers must be plugged in the computer system either in the
keyboard or in the operating system. They record every stroke of the user and send
it to the person who plugged the keylogger.
6

Features of Keyloggers
Here is a list of features of Keyloggers.
1. Keystrokes Logging
After the installation of keylogger, it records all the key strokes in the log and sent to
the person who has installed the keylogger.
2. Clipboard Record
Another feature is that keylogger records all the words or texts that are copied and
pasted on the clipboard. This helps to know about who selected and copied which text
and information.
3. Application Tracking
Keylogger tracks all the applications which are visited and run by the user. The
purpose is to easily understand what time which user is running what applications in
the computer.
4. Websites Visited
All the activities done in the websites like site titles, clicking links, URLs can be
monitored by the Keyloggers. Its main purpose is to record at what time user is using
which websites and number of times s/he visited the websites.
5. Screen Capture
Beside the keystrokes, it can capture the screen to understand what’s going on with
the computer.
6. Web-Camera Recording
Unlike the Screen Capture, web-camera clicks and records the pictures of the
activities of the user.
7

7. Email log delivery
Keylogger also records the email delivery times in the logs (Creutzburg, 2017).
8

Types of Keyloggers
Basically, there are 2 types of Keyloggers i.e. Hardware Keyloggers and Software
Keyloggers.
Hardware Keyloggers
Hardware Keyloggers are any physical device that can plug directly into a computer in order
to record the keys that are pressed on that computer's keyboard. A common hardware key
logger takes the form of a flash drive that plugs directly into the USB port of a computer.
This flash drive contains special software that records the keystrokes of the user in a text file.
Types of Hardware Keyloggers
1. Regular Hardware Keylogger
Ordinary equipment key lumberjacks are utilized to log keystrokes by equipment
circuits that are associated between the PC's console and the PC. Record all console
movement in inward memory that can be gotten to by entering a lot of predefined
characters.
2. Wireless Keylogger Sniffers
The remote key lumberjack sniffer gathers bundles of information moved from the
remote console and its beneficiary and endeavours to unscramble the encryption key
used to secure remote correspondence between the two gadgets.
3. Firmware
Profiles on PCs that typically handle console occasions can be reconstructed to record
when preparing keystrokes.
9

4. Keyboard overlays
Since a bogus keypad is set over the genuine keypad, every one of the keys that are
squeezed is enlisted by both the listening in gadget and the real gadget that the client
is utilizing.
Software Keyloggers
Software Keyloggers, on the other hand, are applications that are installed on a computer or
mobile device. In a similar fashion to hardware Keyloggers, software Keyloggers records the
keys that are pressed on the device's keyboard and stores that information so that the hacker
can access it later. Software Keyloggers are the most common Keyloggers used for recording
the keystrokes on virtual keyboards (Damopoulos, Kambourakis & Gritzalis, 2013).
Types of Software Keyloggers
1. Hypervisor-based
Key loggers can reside on malware hypervisors that run theoretically under the
operating system, so they remain intact. It's virtual. Blue pill is a conceptual example.
2. Kernel-based
Kernel-based key loggers prohibit the core of the computer's operating system,
making it very difficult to identify and remove them. Since both of these methods are
difficult to write, these key loggers are less common than other software key loggers.
These key loggers exist at the kernel level, making them difficult to detect, especially
for user-mode applications that do not have root access.
10

3. API-based
API-based Keyloggers are by distant the foremost common type of keylogger. These
pieces of key logging software utilize the keyboard API (brief for Application
Programming Interface) to record the keystrokes typed by the user. Every time, you
press a key, a notification is sent to the application that you are typing that’s the typed
character would show up on the screen.
4. Form-grabbing based
Rather than logging each keystroke separately, form grabbing-based Keyloggers
log web form submissions by recording the web browsing on submit events. This can
include your full name, address, email phone number, login credentials or credit card
info. This happens when the user completes a form and submits it; usually by clicking
a button or hitting enter.
5. Memory Injection based
Memory Injection (MitB)-based Keyloggers perform their logging function by
altering the memory tables associated with the browser and other system functions.
By patching the memory tables or injecting directly into memory, this technique can
be used by malware authors to bypass Windows UAC (User Account Control).
6. Packet analyser
This involves capturing network traffic associated with HTTP POST events to
retrieve unencrypted passwords. This is made more difficult when connecting via
HTTPS, which is one of the reasons HTTPS was invented (Esbel & Christian, 2016).
11

Characteristics of Hardware Keyloggers
Equipment key lumberjacks can be introduced by anybody with access to space and the nerve
to do it.
A key lumberjack records everything entered on a console or other info gadget. Programming
key lumberjacks are progressively normal and surely understood. They are malware that will
be introduced on the injured individual's PC.
Equipment key lumberjacks are physical gadgets, for example, USB sticks, PS2 links, or
divider chargers that record keystrokes and other information. These were generally wired
however there were likewise remote sniffing types.
You can introduce the keylogger programming through phishing mail. Equipment key
lumberjacks expect somebody to have physical access to the area. This is on the grounds that
the majority of the equipment key lumberjack cases are out in the open places, for example,
libraries, or in generally less secure places, for example, schools, or in at any rate one case in
the newsroom.
Equipment key lumberjacks sidestep numerous encryption and other standard security
hindrances to recognize and store real keystrokes entered from the console.
Equipment key lumberjacks can't be identified by an antivirus or other programming
research.
They are physically perceptible, yet by and large nobody needs to check them. Key
lumberjacks can speak to individuals who need to discover something explicit, for example, a
secret key, yet don't have the information to get malware on the objective PC. Equipment key
lumberjacks can be introduced by anybody with access to space and the nerve to do it.
While equipment key lumberjacks have since quite a while ago cantered around standard PS2
consoles, gadgets, for example, Key Sweeper might be in danger for remote consoles. The
12

Key Sweeper is covered up inside a USB charger (really goes about as a USB charger), yet
you can shroud it in any capacity. Incorporates an Adriano microcontroller that associates
with a remote console to distinguish and record keystrokes.
Encryption was not a major worry for remote consoles. As of late, numerous remote
consoles, including 2.4GHz Microsoft consoles made after 2011, have begun utilizing
encryption. In any case, in May 2017, the FBI gave alerts about gadgets like Key Sweeper.
In 2015, somebody from the German left paper found a USB stick equipment key lumberjack
on a newsroom PC. The correspondent was obviously assembling information about the
activity of different representatives or papers.
Schools are a typical area for equipment key logging. The case incorporates a Russian
understudy from Birmingham who retroactively took the staff's secret word from the
recorded test score, and a Russian understudy from Singapore University of Management
who really got to the trial of different understudies during the test (if that doesn't work, you'd
prefer to re-test it), and in the wake of utilizing the key lumberjack login to change their
evaluations, 11 understudies were ousted from a tuition based school in California.
Equipment key lumberjacks used to make programmers especially powerless at two focuses:
when gadgets are sent and recouped to get to put away keystroke information. Despite the
fact that regardless you need it first, key lumberjacks can associate with your cell arrange and
send their log documents utilizing the cell phone supplier's SIM chip and some other help
equipment.
Numerous programmers were gotten when they came to recuperate their equipment. A large
portion of the dangers of increasingly evil sounds are evidence of idea by cutting edge
security specialists to reveal potential vulnerabilities, not genuine gadgets discovered during
13

security clears. The greater part of the genuine instances of key logging is truly low, as the
model shows.
Accordingly, most organizations are hesitant to cost their workers with USB enrolment,
physical disconnection, or other equipment impediments (Hung et al., 2013).
Nonetheless, as the key logging innovation turns out to be further developed and the culprit is
increasingly hard to identify or follow, there might be more prominent and progressively
recognizable ruptures, including equipment key lumberjacks or expert sharpshooters. I'm
simply accepting that every other person will happen first. What's more, obviously nearly
everybody is correct.
14

Reported Incidents of Keylogger
Some of the most notable examples of key logger attacks are:
1. In 2016, a huge scale review directed by a U.S.- based digital security organization
uncovered organizations from 18 nations were focused as a feature of a shared
crusade to utilize Olympic Vision Loggers to get classified business-related data. This
product based key lumberjack was conveyed by means of a phony email sent by a
business partner and recorded keystrokes as well as clipboard pictures, content, spared
logins, and texting visit history.
2. In 2007, a Romanian programmer bunch propelled a worldwide phishing effort that
incorporates sending malevolent email to a great many email addresses. On the off
chance that a potential injured individual snaps a connection in these messages, a
product put together key lumberjack is introduced with respect to the PC. The culprits
of the digital assault were at last distinguished in October 2018, and it was uncovered
that in excess of 4,000,000 dollars were taken from the beginning of the assault.
3. In 2015, a British understudy was captured and condemned to four months in jail after
it was found that he had made passing marks in his tests utilizing keystroke logging
programming. He introduced the product on his college PC and utilized it to take the
staff's login data. He at that point utilized his login data to get to the college records
and accomplished five tests.
4. In 2009, Ukrainian criminals used key loggers to steal national treasure login
credentials. The fake has initialized a list of wire transfers with a limit of less than
$10,000 that would have led to closer scrutiny by local authorities. The loss was about
$ 415,000 (Hussain et al., 2016).
15

5. In 2006, The Offenders delivered Trojan horses to some users of the online private
bank (Nordea) via e-mail. The client was betrayed to download and run the "anti-
spam" application following the key logger installation.
6. In 2006, a group of 55 boys were arrested when key loggers were installed on a
computer owned by a Brazilian stranger in the Campana Grande zone. This key
logger was used to leak all necessary information, including bank credentials, to this
gang.
16

Threat of a Keylogger
Key loggers are often referred to as keystroke loggers and are a type of hardware or software
that you can use to record keystrokes on your keyboard. It is primarily used to monitor other
people's activities and personal details. Key loggers are often used as spyware tools to help
cyber criminals steal personal identity (PII), login credentials, PIN code, and sensitive data.
Key loggers are also used by employers to monitor the computer activity of their employees,
and for parents to monitor their children's Internet usage
Key loggers are a serious threat not only to your data, but also to your users. It keeps track of
keystrokes and intercepts other sensitive information entered from passwords and keyboards.
When a cybercriminal obtains sensitive data, he can easily send money from his or her
account, intimidate the user, and access his or her online gaming and social media account.
A manager of Brazil's computer emergency response team, Cristine Hoepers, who works with
the support of Brazil's Internet Management Committee, says key loggers have pushed
phishing out of first place as the most common way to use sensitive information theft. In
addition, key loggers are more sophisticated, track websites that users visit, and record only
keystrokes that are entered on websites that cyber criminals are interested in (Zhu & Pham,
2019).
17

Difference between Hardware and Software Keyloggers
Some of the common differences between the hardware and software Keyloggers are
described below.
1. Detect ability
Hardware Keyloggers are virtually undetectable unlike the software keylogger, which
is the biggest advantage of using hardware ones. Software Keyloggers can be detected
using the anti-spy software to remove it or to deactivate it. This anti-spy software
cannot detect and remove the hardware Keyloggers ("5 Ways To Check For
Keylogger On Windows Computer", 2019).
2. Time Consumable
Another advantage of using hardware keylogger is that software keylogger needs
more time to check the software is functioning well or not, and it hasn’t been
deactivated or compromised. Hardware Keyloggers don’t need to be checked
frequently until they are removed physically. Software needs to be checked and
updated time to time (Creutzburg, 2017).
3. Non-volatile memory
Another advantage of using hardware instead of software is that if there is a power
outage or if the installed device is unplugged for some reason, it keeps track of all
activity that is causing non-volatile memory. When using software, there are no non-
volatile components, so if the device is unplugged or powered, the software will not
be able to monitor activity until power is restored or reconnected.
18

4. Portability
Because the hardware keylogger is portable it can be used on multiple computers at
one time. When software is utilized, it is specifically downloaded to one computer
and therefore only the activities of that computer can be monitored. Having the
hardware version allows the owner to move their portable device from one computer
to another at any time, which means the functions are not as limiting as with the
software (Creutzburg, 2017).
5. Security
Another disadvantage of using software keylogger is that it should be downloaded and
may have malware which brings risk in the computer. Unlike, software Keyloggers,
hardware Keyloggers don’t need anything to download and has no risk of malware
which can interfere in the monitoring of the keystrokes.
6. Complexity
Software Keyloggers are more advanced and might need a higher level of
preparedness and installing them isn’t sometimes as easy as you’d wish. Hardware
Keyloggers are mostly “plug and play” enabling a quick and easy setup (Pillai &
Siddavatam, 2018).
19

Recommendations
In conclusion, Keylogger is a technology or tool or software which records the keystrokes
made on the keyboard. It operates in the background of the operating system so that victim is
unaware about his activities are being monitored. The use of keylogger depends on the
intention of the user. It is mostly used for malicious and criminal activities, but it can be used
for good reasons too. I.e. parents monitoring their children’s activities, employers recording
the employee’s history. Every coin has two sides; we can’t ignore the advantages brought by
the Keyloggers, while we need to use it legally.
Keyloggers are of two types i.e. hardware and software Keyloggers. Both the hardware and
software Keyloggers has its own pros and cons. It depends on the user which one to use and
for what purpose.
In my opinion, Hardware keylogger is the best to use for the data-oriented company. Talking
about its pros, hardware Keyloggers are very tiny and small which makes it virtually
undetectable but software Keyloggers can be detected using anti-spy software. In this case,
hardware is best to use if you are looking for stealth mode operation (Definitions & Hope,
2019).
Another advantage of using hardware keylogger over software is that they are very easy to
use. Hardware Keyloggers comes into play when you plug in the computer and starts its
functions. But, it’s not same with the software Keyloggers, you need to have high level
knowledge about the software to use and install it in the system.
Software Keyloggers need to be downloaded or installed in the computer is another con over
the hardware Keyloggers. When you install the software keylogger in the computer, software
20

uses the hard disk space and computer user can know the presence of software. Similarly,
software Keyloggers can be infected by the malware present in the computer system. But, in
case of hardware, it’s completely opposite. They don’t need to be installed and have no risk
of malwares ("LAG Hamm: Rechtswidrige Arbeitnehmerüberwachung mittels Keyloggers",
2017).
Similarly, hardware Keyloggers are portable to use and can be used for many computers
simultaneously. But, coming to the software, you need different versions of software and
software that suit the operating system. You need to have software for windows PC, different
for IOS and different for LINUX.
After comparing both types of Keyloggers, Hardware keylogger is best suited for the data-
oriented company to use for the recording and monitoring purposes. I strongly recommend
using the hardware keylogger because of its pros over the software Keyloggers (Ortolani,
Giuffrida & Crispo, 2013).
21

References
Adhikary, N., Shrivastava, R., Kumar, A., Verma, S., Bag, M., & Singh, V. (2012). Battering
Keyloggers and Screen Recording Software by Fabricating Passwords. International
Journal Of Computer Network And Information Security, 4(5), 13-21. doi:
10.5815/ijcnis.2012.05.02
Creutzburg, R. (2017). The strange world of keyloggers - an overview, Part I. Electronic
Imaging, 2017(6), 139-148. doi: 10.2352/issn.2470-1173.2017.6.mobmu-313
Damopoulos, D., Kambourakis, G., & Gritzalis, S. (2013). From keyloggers to touchloggers:
Take the rough with the smooth. Computers & Security, 32, 102-114. doi:
10.1016/j.cose.2012.10.002
Esbel, O., & Christian, N. (2016). Hardware/Software Verification Process through Cloud
Computing. Lecture Notes On Software Engineering, 4(2), 123-128. doi:
10.7763/lnse.2016.v4.236
Hung, C., Hsu, F., Chen, S., Hwang, Y., Tso, C., & Hsu, L. (2013). Defend a System against
Keyloggers with a Privilege-Limited Account. Applied Mechanics And
Materials, 284-287, 3385-3389. doi: 10.4028/www.scientific.net/amm.284-287.3385
Hussain, M., Al-Haiqi, A., Zaidan, A., Zaidan, B., Mat Kiah, M., Anuar, N., & Abdulnabi,
M. (2016). The rise of keyloggers on smartphones: A survey and insight into motion-
based tap inference attacks. Pervasive And Mobile Computing, 25, 1-25. doi:
10.1016/j.pmcj.2015.12.001
LAG Hamm: Rechtswidrige Arbeitnehmerüberwachung mittels Keyloggers.
(2017). Computer Und Recht, 33(2). doi: 10.9785/cr-2017-0211
Ortolani, S., Giuffrida, C., & Crispo, B. (2013). Unprivileged Black-Box Detection of User-
Space Keyloggers. IEEE Transactions On Dependable And Secure Computing, 10(1),
40-52. doi: 10.1109/tdsc.2012.76
Pillai, D., & Siddavatam, I. (2018). A modified framework to detect keyloggers using
machine learning algorithm. International Journal Of Information Technology, 11(4),
707-712. doi: 10.1007/s41870-018-0237-6
Zhu, M., & Pham, H. (2019). A Novel System Reliability Modeling of Hardware, Software,
and Interactions of Hardware and Software. Mathematics, 7(11), 1049. doi:
10.3390/math7111049
5 Ways To Check For Keylogger On Windows Computer. (2019). Retrieved 31 December
2019, from https://getalltech.com/5-ways-to-check-for-keylogger-on-windows-computer/
Definitions, K., & Hope, C. (2019). What is a Keylogger?. Retrieved 31 December 2019,
from https://www.computerhope.com/jargon/k/keylogger.htm
22

23