Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Mandatory Keyloggers in Mumbai's Cyber Cafes

Posted by kdawson on Sun Sep 09, 2007 09:16 PM
from the just-don't-press-any-keys dept.
YIAAL writes "Indian journalist Amit Varma reports that Mumbai's police are requiring the city's 500 Internet cafes to install keystroke loggers, which will capture every keystroke by users and turn that information over to the government — nearly in realtime by the sound of it. Buy things online, and the underpaid Indian police will have your credit card number. 'Will these end up getting sold in a black market somewhere? Not unlikely.'"
+ -
story

Related Stories

[+] Mumbai Police To Enforce Wi-Fi Security 134 comments
caffeinemessiah writes "In the wake of the recent terrorist attacks in Mumbai, India, the local police are going to be sniffing out unsecured wi-fi access points and ordering the owners to secure them. The article notes that 'terror mails were sent through unsecured Wi-Fi connections' before bomb blasts in other Indian cities. No word on if they'll be walking around using Kismet, or if people who use pathetically weak WEP encryption will be ordered to switch to more advanced protocols. Unfortunately, a gesture like this does not take into account the insidious scenario of walking into a cafe, buying a coffee and then (legally) using the cafe's wi-fi. Or the fact that terrorists might actually be able to pay to use a cybercafe, and know what VPNs are." On the other hand, the Mumbai police may still be keeping track of the mandatory keyloggers that went into the area's cybercafes in 2007.
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by Veinor (871770) <veinor&gmail,com> on Sunday September 09 2007, @09:21PM (#20533711)
    Likely?
    • Fiddle the cursor (Score:5, Interesting)

      by EmbeddedJanitor (597831) on Sunday September 09 2007, @10:54PM (#20534443)
      This technology is very easily fooled anyway... so long as you know about it. Just move the cursor around a bit with your mouse as you type. For example, if your credit card is 12345678, type 18 then set the cursor between the 1 and the 8 and type 34567 then set the cursor before the 3 and type 2. It looks like you typed 18345672.

      And if you're being a political rabble rouser you can type "Bush is a wally" so that it looks like "wish us a Bally".

      • Re:Fiddle the cursor (Score:5, Interesting)

        by speaker of the truth (1112181) on Monday September 10 2007, @03:07AM (#20535827)
        Another trick is to type in the field as well as out of the field. So you type 12167423457831642741211141853900 and they'll know you've typed too many numbers, but won't have any idea which of those numbers is your credit card number.
      • Re: (Score:3, Insightful)

        Start->Programs->Accessories->Accessibility->On-Screen Keyboard

        Seriously, as an Indian - this is not Orwellian as it might appear. Just a case of some bureaucratic nut who just discovered key loggers coming up with these impractical ideas.

        "Never, never blame anything on a conspiracy that can be explained by incompetence."
  • by Anonymous Coward
    Am I the only one noticing how all the world's major nations are accelerating towards fascism? Perhaps we're headed towards some sort of violent global revolution, I know we here in the US are LONG overdue (what was it Jefferson said? A violent overthrow every decade is vital to the health of a nation?). I'm hoping for a world without borders and a benevolent, corruption-proof, completely transparent government. And abandoning coal and oil for nuclear power. And truly non-evil corporations. And free c
    • Surely Jefferson did not want the government violently overthrown every ten years? Does anyone have a link for this? BTW who should pay for the candy in a your utopia?
      • by TheLink (130905) on Sunday September 09 2007, @10:54PM (#20534445) Journal
        Usually when a government gets violently overthrown, what replaces it is a Dictatorship that's willing and capable of the most violence.

        Violent revolutions should only be reserved for "last resort" - there absolutely is no other choice[1]. Given that India is a democracy, they have a choice, and if you don't like the candidates, get others to stand for election then.

        That's why Karl Marx was either an idiot or an evil person because he recommended violence as normal standard procedure.

        [1] Even if you're already stuck in a dictatorship, sometimes it's just better to wait till the next generation takes over. See China - things actually got better and most steps after Mao's time, whereas if you had another violent revolution, you'd probably get another Mao in charge.

        Violent revolutions are like playing russian roulette with 5 out of 6 bullets loaded in your revolver. You're hoping you get a benevolent dictator who'd set things up properly then peacefully and orderly hand over power to the citizens. This does happen sometimes, but never bet on it.

        Would you give up 1 billion dollars if you found it in your bank account due to someone _else_ doing illegal stuff AND you know you can get away with it due to some loophole? There are a few people who'd say "sure, because it is just wrong to keep it". The Dictators you'd want are an even smaller _subset_ of those people (you need them to be competent dictators as well ;) ).
        • Re: (Score:3, Insightful)


          >Violent revolutions should only be reserved for "last resort" - there absolutely is no other choice.

          So the colonies should have bit the bullet and waited for the next king to come around?
          • by RexRhino (769423) on Sunday September 09 2007, @11:42PM (#20534759)

            So the colonies should have bit the bullet and waited for the next king to come around?
            The colonies had their own governments, which for the most part had very weak ties to the central government in England (and England was several months sea voyage away). The primary government of the colonies wasn't being overthrown, the primary government of the colonies were actively participating in the overthrow of what they realized was a foreign power.

            The American Revolution had some very unique circumstances that don't typically exist in most revolutions.

            That isn't to say that people facing an oppressive government shouldn't overthrow the government... but most revolutions won't have the very specific advantages that the United States had in its revolution. The United States got VERY VERY VERY lucky with the circumstances of its revolution.
            • Re: (Score:3, Insightful)

              by Anonymous Coward
              Treason doth never prosper; what's the reason?
              If it doth prosper, none dare call it treason.
            • by Sycraft-fu (314770) on Monday September 10 2007, @01:29AM (#20535291)
              That George Washington could have been king, had he wanted. He was loved enough and had enough clout that he essentially could have done as he pleased. Had he been a power hungry man, the US republic would not have taken off as it did. Might not have gone the way of absolute dictatorship, but it sure as hell wouldn't have existed as it does. Fortunately, he was a man that really cared about the ideals of freedom and set the standard of a chief executive with limited power and a good deal of accountability. However counting on that to happen isn't a good idea. Anyone care to wager if it were a man like George Bush who had lead the colonies to victory rather than Washington? You think it all would have gone the same?

              As was noted: History is full of revolutions that do not end in a nice, happy government. They usually promise that, and sometimes the revolutionaries themselves really are idealists with good intentions, but power corrupts. Have a look at Zimbabwe some time and tell me how well that revolution went.
        • Re: (Score:3, Insightful)

          The way I see it, and from what I've seen through history, violent revolution is inevitable. No government is perfectly stable, and eventually all will fall. I see revolutions as a natural part of a cycle - birth, rise, rule, and collapse of an empire/government/civilization, only to begin anew again. Some countries unfortunately are stuck in a perpetual loop of revolution, which is sad, but that being said I do not think revolutions in general are avoidable. This is not to say I *condone* violent revolutio

          • Re: (Score:3, Interesting)

            The way I see it, and from what I've seen through history, violent revolution is inevitable.

            Really? You the last time my country had a real violent revolution was in 1066 when we were invaded by the Normans (if that counts as a revolution), since then governments have come and gone, political parties have been founded and disbanded. Our system of government has changed from an absolute monarchy to a parliamentary democracy, we gained an empire and then lost it.

            We even tried to have a revolution, but it was more of a civil war, and despite the king getting his head cut off, we decided that a mo

          • Re: (Score:3, Informative)

            Assuming the translation is correct, Karl Marx wrote this:

            "The Communists disdain to conceal their views and aims. They openly declare that their ends can be attained only by
            the forcible overthrow of all existing social conditions. Let the ruling classes tremble at a Communistic revolution. The proletarians have nothing to lose but their chains. They have a world to win."

            While I am indeed an idiot, I can still read and understand what "forcible overthrow" means and implies (especially given the context).
            "ge
  • by Mrs. Grundy (680212) on Sunday September 09 2007, @09:26PM (#20533751) Homepage
    Of course this is ridiculous because the only people that will be effected by it are innocent people. Criminals and (gasp) terrorists will simply find other ways of communicating. The cafe owners will lose business, and innocent folks will suffer a completely useless invasion of privacy so the government can say they are doing something without actually doing something that makes any difference.
    • by Bonobo_Unknown (925651) on Sunday September 09 2007, @09:28PM (#20533775)
      I predict the sudden rise of on-screen keypads, operated via the mouse.
      • by CheeseTroll (696413) on Sunday September 09 2007, @09:39PM (#20533863)
        That may not help, depending on the sophistication of the keylogging software. Here's an interesting article I found on the subject... http://www.pcmag.com/print_article2/0,1217,a=18129 0,00.asp [pcmag.com]

        Using something like Password Safe (http://passwordsafe.sourceforge.net) on a USB key would be helpful, as it gives you the option to copy individual usernames & passwords without even viewing them.
          • Not really that hard just more complicated/specialized, just take a screen shot around each mouse click location (or of the whole screen during a mouse click). Trivial if they do this only for specific websites (ie: only do this type of logging when you are on such a website).
    • Re: (Score:3, Insightful)

      Of course this is ridiculous because the only people that will be effected by it are innocent people. Criminals and (gasp) terrorists will simply find other ways of communicating. The cafe owners will lose business, and innocent folks will suffer a completely useless invasion of privacy so the government can say they are doing something without actually doing something that makes any difference.

      At least in India, the authorities have the courtesy to tell you they're logging your keys.

      • At least in India, the authorities have the courtesy to tell you they're logging your keys.

        As the first thing that pops into my mind is
        "I'm in Ur computer loggin Ur keys"
        • As the first thing that pops into my mind is
          "I'm in Ur computer loggin Ur keys"


                This is what happens when you visit "that other place" too often.
  • This is a good thing for people outside of India. I always worry about key loggers, but no systems I use remotely allow me to use any other means of authentication besides passwords. This will make other better systems more common, and more available. But in the mean time, this sucks for them...
  • Damn...they're getting almost as bad as the FBI...
  • Will it work on Linux?
  • by ChatHuant (801522) on Sunday September 09 2007, @09:34PM (#20533819)
    Depending on the key logger's capabilities, an easy way to improve your security is to open another edit window (for example notepad) next to the password input window. Enter a character of your secret password, credit card number, etc), then, using the mouse, switch focus to the second window, type in a bunch of random characters, switch back, rinse and repeat. The logger ends with a bunch of gibberish, some of which is your key. If you do it right, extracting your secret from the resulting log will be really difficult (especially since the mouse allows you to add new characters in the middle of the already typed string, which means the characters in your secret won't even be in order).
    • by callinyouin (1138469) on Sunday September 09 2007, @09:45PM (#20533919)
      A couple years back I messed around with a few key loggers on my computer because I wanted to see exactly how stokes were logged. What I mean is that I wanted to see if the logger just dumped the input from the keyboard character for character or if there was any formatting. Turns out all of the key loggers I tried used some kind of formatting and dumped information into the log such as which program had focus, what time it had focus, etc. So, in this case, it seems likely that one could still get personal info, credit card numbers, etc. by piecing it all together.
      • by Anonymous Coward on Sunday September 09 2007, @10:04PM (#20534091)
        You are correct. A sample log (was acquired in real time):

        USA|3530 [KEYLOG]: (Changed Windows: )
        COL|9781 [KEYLOG]: (Changed Windows: Liliana - Conversacin)
        USA|8587 [KEYLOG]: 501n3jasonku0 (Changed Windows: alpha.vms.psc.edu - default - SSH Secure Shell)
        USA|4484 [KEYLOG]: (Changed Windows: J:\ceedo\Ceedo)
        DEU|9494 [KEYLOG]: (Changed Windows: A ROM Installationspfad)
        USA|9804 [KEYLOG]: (Changed Windows: LimeWire: Enabling Open Information Sharing)
        USA|4837 [KEYLOG]: (Changed Windows: )
        USA|7417 [KEYLOG]: (Changed Windows: )
        USA|4837 [KEYLOG]: (Changed Windows: Start Menu)
        CAN|8745 [KEYLOG]: (Changed Windows: )
        GBR|5633 [KEYLOG]: [DOWN][DOWN][DOWN][DOWN][DOWN][DOWN][DOWN] (Changed Windows: )
        GBR|9120 [KEYLOG]: (Changed Windows: )
        DEU|9494 [KEYLOG]: (Changed Windows: RodentMouseWnd2)
        USA|8587 [KEYLOG]: (Changed Windows: 2:alpha.vms.psc.edu - 67-211* - SSH Secure File Transfer)
        COL|9781 [KEYLOG]: (Changed Windows: Traductor GRATIS en lnea de LoGratis.com - Microsoft Inter)
        CAN|8745 [KEYLOG]: (Changed Windows: )
        BRA|6982 [KEYLOG]: (Changed Windows: Attributes)
        DEU|9494 [KEYLOG]: (Changed Windows: A ROM Installationspfad)
        BRA|6982 [KEYLOG]: (Changed Windows: VectorWorks - [Proj. Simone.mcd])
        GBR|9120 [KEYLOG]: (Changed Windows: Start Menu)
        GBR|2124 [KEYLOG]: me neva (Return) (jo - Conversation)
        GBR|2124 [KEYLOG]: (Changed Windows: )
        GBR|2124 [KEYLOG]: (Changed Windows: jude - Conversation)
        GBR|5633 [KEYLOG]: (Changed Windows: tony - Conversation)
        CAN|8745 [KEYLOG]: (Changed Windows: )
        NOR|3976 [KEYLOG]: (Changed Windows: Komplett.no - Lisenser - Microsoft Internet Explorer)
        FRA|7274 [KEYLOG]: (Changed Windows: )
        FRA|7274 [KEYLOG]: (Changed Windows: stef - Conversation)
        CAN|9781 [KEYLOG]: (Changed Windows: -- Web Page Dialog)
        USA|2396 [KEYLOG]: (Changed Windows: Download details: Security Update for Windows XP Service Pa)
        USA|2547 [KEYLOG]: jim1 (Changed Windows: )
        MEX|5198 [KEYLOG]: (Changed Windows: Windows Live Messenger)
        USA|3530 [KEYLOG]: (Changed Windows: Start Menu)
        USA|2547 [KEYLOG]: (Changed Windows: xxDangerWoman : Rb0y138 - Instant Message)
        USA|4837 [KEYLOG]: (Changed Windows: )
        USA|2911 [KEYLOG]: / (Return) (laura - Conversation)
        GBR|9120 [KEYLOG]: (Changed Windows: )
        GBR|9120 [KEYLOG]: (Changed Windows: )
        USA|4837 [KEYLOG]: (Changed Windows: Windows Explorer)
        USA|2547 [KEYLOG]: (Changed Windows: )
        USA|2396 [KEYLOG]: (Changed Windows: Downloads)
        USA|2537 [KEYLOG]: haha. (Return) (jeff, Josh...Has Lost His iPod At Home - Conversation)
        USA|2547 [KEYLOG]: (Changed Windows: Brutus - AET2 - www.hoobie.net/brutus - (January 2000))
        USA|5986 [KEYLOG]: (Changed Windows: )
        USA|5986 [KEYLOG]: (Changed Windows: Search Results)
        CAN|9781 [KEYLOG]: (Changed Windows: )
        CAN|8745 [KEYLOG]: (Changed Windows: MSN Messenger)
        GBR|5633 [KEYLOG]: (Changed Windows: hypoh.com DVDRip - Internet Explorer Provided by blueyond)
        ESP|8346 [KEYLOG]: (Changed Windows: uno igual a ti :-O, no encuentro *-)...ni cagando!!! :S....)
        ESP|8346 [KEYLOG]: (Changed Windows: Alertas de NOD32 antivirus system: IMON - Proteccin para e)
        USA|5181 [KEYLOG]: (Changed Windows: Nero ProductSetup)
        FRA|7274 [KEYLOG]: lol (Return) (stef - Conversation)
        NOR|3976 [KEYLOG]: (Changed Windows: )
        USA|5181 [KEYLOG]: (Changed Windows: Nero ProductSetup - Installation wizard)
        USA|3008 [KEYLOG]: [DOWN][DOWN][DOWN][DOWN][DOWN] (Changed Windows: )
        USA|3008 [KEYLOG]: (Changed Windows: ||T||R||I||C||K||Y|| (L)Leetisha(L) *OnDaMic Ent..*..It)
        USA|0852 [KEYLOG]: [CTRL][ESC] (Changed Windows: Importing to Your Buddy List)
        NOR|3976 [KEYLOG]: (Changed Windows: Kathrine - Samtale)
        ESP|2373 [KEYLOG]: si ya lo mande a la mierda (Return) (buta la huea las vakaciones kulia aora me sak la xuxa y e)
        USA|2483 [KEYLOG]: recreecipe (Return) (Search results for rcipe - Mininova - Windows Internet Expl)
        USA|300

    • If you do it right, extracting your secret from the resulting log will be really difficult
      I'm not an expert on keyloggers, but I'm pretty sure any keylogger worth using notes mouse clicks and/or focus changes.
  • by joshv (13017) on Sunday September 09 2007, @09:35PM (#20533829)
    After they hire all the people required to sift and parse this data, there will be no Indian programmers left for outsourcing. Bravo, keep up the good work - bureaucracy know no bounds.
  • They're [courttv.com] the [rferl.org] good [pitt.edu] guys! [nytimes.com]
  • Adds a whole new meaning to sniffing for keystrokes...

    Actually you could use some kind of olfactory sensor and at least be able to tell which keys were hit with the left and right hands...

  • by Skapare (16644) on Sunday September 09 2007, @09:47PM (#20533941) Homepage

    ... keyboards drawn on the screen under each input field, with Javascript to tie clicks by the mouse pointer on the keys in that keyboard image so the characters are inserted into the appropriate field.

    Another option where Javascript can't be used is to create a printed character array that has all the characters. Use the mouse to copy and paste characters one at a time between there and the input field.

    All this will be done through HTTPS, of course. Next come the mandatory rootkits. Then patrons bringing in their own Ubuntu or Knoppix disks.

  • FTA - "As long as personal computers are not being monitored. If monitoring is restricted to public computers, it is in the interest of security"

    1) Are cafe computers considered public computers, because they are physically in public, or because the government owns them?
    2) Does my laptop become a public computer, if I carry it to Starbucks, thus transfering ownership to Big Brother?
    3) Who in Inida wishes they had a 4th Amendment [wikipedia.org] in writing?

  • 1) create SSL proxy gateway that uses passwordless client certs for authentication
    2) market to users of cybercafes
    3) PROFIT!

    Oh crap, they'd probably prohibit the use of USB drives, CDs, etc. Oh well.
    • (following up to my own post after more thought)

      Of course, that proxy would then need a way to 'paste' passwords into other sites as well.
    • 3) PROFIT!

            Hey hang on, exactly how much do you expect to make when your market consists of "that portion of India that can't afford their own personal computer"?
  • What a wonderful government we have and how much I'm glad that they're looking out for us Mumbaian citizens. This will surely stamp out terrorism in my country, where the evil-doing bomb-plotters have been sipping lattes in conspiratorial net-enabled secrecy for far too long. Our glorious (and handsome!) leaders have finally realized that only when all of our thoughts have been properly parsed and vetted by a central governing board of censors can we truly be free. This is a wonderful day, truly.
  • by Jessta (666101) on Monday September 10 2007, @12:28AM (#20535015) Homepage
    If you're entering any information in to a computer at a cyber cafe that you don't want public then you are an idiot.
    You can't trust any random computer you sit down at.

  • One word solution! (Score:5, Interesting)

    by John Jamieson (890438) on Monday September 10 2007, @12:43AM (#20535105)
    Knoppix

    Insert Knoppix in the drive and reboot the PC before you do anything. I bet it would work at most Cafe's.

  • by schauhan (1070004) on Monday September 10 2007, @01:21AM (#20535249)
    About 10 years ago in Bangalore a software company got a piracy operation raided by the police with a bunch of floppies being the major evidence collected. When evidence was presented in court the police had punched the floppies and filed them like paper. The pirates literally laughed their way out of court.

    These days the police in India are technology savvy and most serious crime cases are solved quickly within days. This is possible because criminals use technology like mobile phones and internet to plan and coordinate. For the most part people are thankful for all this - a few years ago it was looking like criminals were smarter than most people.

    India had a law named Prevention of Terrorism Act (POTA) that had draconian provisions and was repealed by the current government. Right now there isn't any law in India to arrest people on the basis of suspicion alone. The police need solid evidence to book people under regular laws.

  • Hoax? (Score:5, Interesting)

    by XchristX (839963) on Monday September 10 2007, @03:51AM (#20536015)
    A preliminary google search of two sets of keywords

    http://www.google.com/search?as_q=Mumbai+Police+ke yloggers&num=10&btnG=Google+Search&as_epq=&as_oq=& as_eq=&lr=&as_ft=i&as_filetype=&as_qdr=all&as_occt =any&as_dt=i&as_sitesearch=&safe=active&ie=UTF-8&o e=UTF-8 [google.com]

    http://www.google.com/search?q=Mumbai+Police+keyst roke+loggers&hl=en&lr=&safe=active&as_qdr=all&star t=10&sa=N [google.com]

    reveals no reliable mainstream media source for this allegation. The only one I could find was this article from mid-day:

    http://www.mid-day.com/news/city/2007/august/16316 5.htm [mid-day.com]

    For those who don't know, "Mid-Day" is basically Mumbai's version of the National Enquirer, rants on about conspiracy theories and local celebrity gossip, hardly a reliable source. All the blog entries about this are based on this one mid-day article.

    Of course, it could mean that I'm not searching correctly. I'd appreciate it if somebody posted any (and I mean any) information from any mainstream media outlet (and not dubious blogs). Until then, I remain skeptical and maintain that this is probably a hoax circulated by some sub-par journalist as a means to get fame, and the "Outsource victims" moaning on slashdot lapped it up swiftly, of course...

    Keep in mind that the Indian media is dangerously moonbatty and very anti-establishment (borderline third-world paranoid anarchist actually). Therefore if this actually happened then the media would pounce upon it like a pack of hungry wolves. They haven't ... yet.

    Has slashdot been trolled, again?
  • hmm... (Score:3, Funny)

    by mapkinase (958129) on Monday September 10 2007, @04:13AM (#20536103) Homepage Journal
    I wish they did that in Nigeria.
    • Many people in what we call "developing nations" do not have personal computers, and use computers in cyber cafes instead. This includes even computer-savvy people. Still a bad idea to buy online, in my opinion, but it transfers the onus of privacy from a cafe owner who you look in the face to some guy in an office somewhere. And as CounterStrike has taught us, it's a lot easier to be a fuckwad to people you can't see or hear.

    • by Anonymous Coward on Sunday September 09 2007, @11:05PM (#20534533)
      You damn liberals just don't get it: we are fighing a War on Terra, and need EVERY tool available to us. You don't need privacy if you have nothing to hide.

      It's the duty of every good conservative to have blind faith in government. Government derives it's power from the wealthy, and as every good conservative knows, God tells us the wealthy are better people (that's why they have money). So if you are against the government... ANY government (especially a good conservative dictatorship), you are just a terrorist.
    • I keep meaning to respond without RTFA-ing (R-ingTFA?) so I can lower my blood pressure at least a couple of hundred diastolic points, but I just can't make myself do it.

            I'm sorry sir, you're just not slashdot material. Not reading the articles is somewhat more than formality. It's REQUIRED. Please leave and come back when you forget how to read.
    • Re: (Score:3, Insightful)

      Blooming nonsense. The naturally naive outpourings of a self-hating Indian as usual:

      The Indian Constitution protects the Fundamental rights of people far more zealously than the US does. Freedom of Speech is certainly important. However, in a developing country with large volume of poor and exploitable people, the fundamental rights that the Constitution of India does guarantee ie:

      1.Right to equality
      2.Right to freedom
      3.Right against exploitation
      4.Right to freedom of religion
      5.Cultural and educational rights