Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Privacy

FBI Files Brief on Scarfo Keylogger 249

Posted by michael from the only-as-secure-as-the-weakest-link dept.
Firewort writes: "In an affidavit (warning, it's a PDF) filed with a federal court in New Jersey, the FBI has disclosed some of the details of a controversial "key logger system" used to obtain the encryption password of a criminal suspect. They go into great detail describing PGP and the different methods they might have used to keystroke-log Scarfo to get his encryption key." Interesting, and more technically sophisticated than the basic keyloggers which grab keystrokes indiscriminately.
This discussion has been archived. No new comments can be posted.

FBI Files Brief on Scarfo Keylogger More

FBI Files Brief on Scarfo Keylogger

Comments Filter:

  • keystroke blackbox (Score:2, Interesting)

    by simetra ( 155655 )
    I suspect it's only a matter of time before motherboards come equiped with a "blackbox" type of thing, similar to a flight data recorder. They could store, say, the last 10,000 keystrokes on any keyboard. Does such a thing exist?
    • In software, bash does that. So does doskey on windows systems. Wouldn't be hard to put a 512k ram module on the motherboard.
      • But the application can bypass this. A black box would need to be tamper resistant. Possibly with an additional law that makes tampering illegal.

        Damn! That means I have to establish a session key between me and my computer in the future to talk to it privately! Time to practice long number arithmetric using only my head...
      • Bash only records commands you have typed in, as a history
        file, it does not record passphrases you have entered. This is
        because the programmers of bash were smart, after all, you
        woulnd't wish your passphrases recorded in .bash-history now,
        would you? :)
    • There's a unit that connects between your computer and keyboard that records the last so many thousand keystrokes. It's about the size and shape of one of those keyboard adapters. The data can be accessed with a small utility. It only a matter of moving it from outside the case onto the motherboard and adding some kind of protection to prevent its removal.

    • Re:keystroke blackbox (Score:2, Informative)

      by Anonymous Coward
      They have it now http://www.keyghost.com it can be easily be put inside a keybaord.
    • Yes, they exist and they look just like normal keyboards. I suffer under NT here at work, so the company does not actually need more costly devices. If your company does not allow you to use your own keyboard, be suspicious.

  • More keyboard logging (Score:2, Interesting)

    by Spootnik ( 518145 )
    Speaking of "if you are important enough" and "all is takes is application of resources", I was recently reading through some of the briefs in the US v. Scarfo case. It sounded to me like the FBI got frustrated with his use of PGP and went with the keylogger approach. I was under the impression that the government had the resources to actually break some of the encryption schemes that are lawfully available in the US. It takes them time and a lot of computer horsepower, but I thought they could do it. It seems that the FBI didn't want to have to use all these resources in the Scarfo case and take the time to do it that way, so they used a logger. The material I was reading came from www.epic.org [epic.org]. It was interesting.

    • Re:More keyboard logging (Score:4, Informative)

      by gweihir ( 88907 ) on Wednesday October 10, 2001 @12:38PM (#2411181)
      Brute forcing depends on key length. If you are willing to spend, say, 1 billion on it, a PGP special purpose RSA breaker (or ElGamal breaker), that takes, say a day to break a 512bit key, could be feasible (the numbers are just a very rough guess, but I think not so unrealistic).

      I doubt very much that they can break 2048 bit at the moment and I think 4096 bit is secure until some serious mathematical breakthroughs (which cannot be predicted).

      The NSA could have such a device for emergency purposes.

      Cheaper would be an attack on the passphrase. Most people don't have so much entrophy in their passphrase. E.g. I have only about 65 bits. Of course for this you need the secret keyring, a ciphertext sample will not be enough.

    • Re:More keyboard logging (Score:5, Insightful)

      by gweihir ( 88907 ) on Wednesday October 10, 2001 @12:40PM (#2411197)
      P.S.: I think part of these "we (could) have broken" statements are also a smokescreen that is intended to make people not bother with encryption, because "they can break it anyway".

      Would not be the first diversion with that purpose: If you cannot defeat it, undermine its credibility.
      • Another possibility is that the government can break them, but does not want to publicly acknowledge that capability, lest people switch to alternate ciphers, and improved use of steganography.

        I'd still love to see an anonymous mail network that implements the methods Brenda Timmerman described in her paper on Secure dynamic adaptive traffic masking. Something like that, combined with a large number of users would make even traffic analysis impossible.

        Of course, I must be a terrorist to think such things are good.

    • It's possible the NSA can break PGP encryption if they really want to, but that a) doesn't necessarily mean the part of the FBI that investigates mobsters knows that they can, and b) even if they did, would be prepared to let that fact be revealed in court.

      Why not? Simple. If word got out that the US government could break PGP, everyone who cared about securing their communications from the US government would switch to something else. Governments take extraordinary measures to protect outside knowledge of their cypher-breaking capabilities. Go read some books about Enigma (or, if you want the story with a bowlful of Claire Danes, wait for the upcoming movie :) ).

  • Bypassing the keylogger (Score:4, Funny)

    by loosenut ( 116184 ) on Wednesday October 10, 2001 @12:16PM (#2411045) Homepage Journal
    The key to fooling the keylogger is to use a blank password, of course.

    FBI recruiters who are reading this: you know where you can contact me about that job offer.
    • actually, from the looks of the brief, there are a few ways to circumvent their device. To me, it appears the key (no pun intended) to thwarting this lies in that the logger is only active while the modem is active, meaning you have to be online in order to be have your keys logged.

      Option #1
      Some have suggested saving that phrase in a text file and then copy/paste from there would work, except that your passphrase is now in clear text on your hard disk. Any search warrant against your machine would find that file, and your private key becomes compromised.

      Solution there is to open a text editor before going online, entering the passphrase there. go online. Get the mail and then copy/paste the passphrase, close text editor w/o saving.

      Option #2
      download the email off the mail server (ie, POP it off the server). Go offline. Enter passphrase and read message.

      Likewise, dont write emails while online. Write and encrpyt first, then go online to send. The keylogger appears to be able to pick up your typing of the message if you're online as you write it. (this also saves you $$$ if your ISP is cheap enough to still be charging per hour rates!)
      • Use cleartext that is part of the system such as text from the man page for the "ls" command. This is an example, but you'd want to pick a lengthy man page. Start and end in the middle of a word. Also, do two or three cut and pastes. One cut would be simple to break. Two or three, and now they are in trouble. becuase there is all kinds of variations on multiple cuts. Or to be really vicious, open a common image file in a text editor and cut and paste from that. There's some entropy!

  • A simple keystroke logger can be elegant, too (Score:5, Insightful)

    by adx200 ( 263718 ) on Wednesday October 10, 2001 @12:18PM (#2411055) Homepage

    It's important to note the fact that it doesn't log all keystrokes for 2 reasons:

    1) It's impressive. Less keystrokes logged that could be potential passwords, the less manpower required to examine the logs.

    2) It leaves potential exploits open for crypto software writers and users in order to trick keystroke loggers into passing them over without recording the activity.

    On another note, Bruce Schneier has always reminded people that a secure system always includes at least 2 out of three things: Something you know (password), something you have (ATM card), or something you are (biometrics, fingerprint).

    My point is that ...
    Keystroke loggers could be rendered ineffectual if the crypto software used was also hooked to a fingerprint scanner or a swipe card reader in addition to a password. Or, the person could just always keep the password key on a CD-ROM that they physically take with them and can destroy at a moment's notice.

    • Re:A simple keystroke logger can be elegant, too (Score:4, Informative)

      by billnapier ( 33763 ) <{moc.xobop} {ta} {reipan}> on Wednesday October 10, 2001 @12:23PM (#2411090) Homepage
      I was under the impression that part of the reason that it didn't log everything was to keep from possibly recording communications (Which would need a different kind of court order, along the lines of a phone tap).
    • <nitpick>It'd be a pain in the ass to destroy a CD-ROM "at a moment's notice"</nitpick>

    • Keystroke loggers could be rendered ineffectual if the crypto software used was also hooked to a fingerprint scanner or a swipe card reader in addition to a password.

      This wouldn't stop the FBI. They could obviously take his fingerprint and probably make some kind of cast based on that to replicate it. A swipe card could be subpoenaed in court too.

    • My point is that ...
      Keystroke loggers could be rendered ineffectual if the crypto software used was also hooked to a fingerprint scanner or a swipe card reader in addition to a password.

      That does not work, if the fingerprint reader/card reader is in the keyboard (or the logger logs it also). Same with biometrics.

      But what about giving visual feedback in a very complicated, hard for software to analyze way that adds some blinding layer to the key, e.g. by XOR? Like giving the user a number to add to the current password position in a video? Then the password would never go unprotected through the input chain, and only the combination of input and output would yield the password. No complete protection, but a $200 Keylogger would not have a chance against this.

    • Keystroke loggers could be rendered ineffectual if the crypto software used was also hooked to a fingerprint scanner or a swipe card reader in addition to a password.

      Attack: Insert a logger in between the computer and the device that reads cards/fingerprint etc.

      Interface between computer and something thought to be personally secure (the person, or a smart key he carries, etc) must be resistant to MITM and logging attacks.

      • It's impossible. Every concievable identification device must interface with the computer at some point, and be exposed to the user at another. Any method of input is vulnerable to a sufficiently motivated and wealthy advisary (eg the US/Russian/Chinese government, Microsoft, the Catholic church, or whoever). The point to remember is physical access to the hardware trumps any computer security measures.

        If you want to be really paranoid, check your computer every few days. Look for dongles or adapters you don't remember putting on. Use keyboard cables without ferrites, they could be replaced with a keylogger. Epoxy over the heads of your keyboard screws. Look inside the computer case, see if anything has been added or moved. Then, if you find a key logger, fill up it's entire memory with "h4h4! j00 5ux0r!!" ^_^
        • If you want to be REAL paranoid...

          Build a large steel cabinet, using .25 inch steel plate. Add ventilation holes. Put the computer inside, maybe with a UPS as well. Run cables out of it via romex sheathing to power and monitor, and weld the romex to the box. DO NOT hook up any printer or modem - or if you do, place it in the box with the computer.

          Create a wireless IR keyboard interface, with one of those mini keyboards - plus possibly custom software drivers and/or hardware interfaces for it. Provide a hole so that the IR x/r unit can "see" out of the box to the keyboard.

          Lock the box up in some manner - tack welding might be preferable. Add a power switch to the outside of the box, maybe a few status LEDs.

          Take the keyboard with you whenever you are not with the machine. Perhaps sleep with it under your pillow, or put it in a safe under your bed or something. Follow the rule about using epoxy on the screws. Maybe put seals over the welds, or take pictures of the welds to compare with every now and then (say once a week). You might even want to place the monitor in a copper wire mesh bag or Faraday cage, propely sealed and grounded for stray RF emmisions. Maybe not even provide a modem, only a floppy drive of some sort - and do all decryption of that secured machine. Won't stop "them" from tracking who/when you comm with other parties (ie, traffic analysis), but will keep them from logging you.

          If you are truely needing this, you will see that what I suggest is actually worthwhile...
  • ROOTKIT - Remote Objet Oriented Telecommunications Knowledge Intelligence Technology

  • Doesn't it seem strange (Score:3, Informative)

    by Lawmeister ( 201552 ) on Wednesday October 10, 2001 @12:23PM (#2411087) Homepage
    that the FBI was so concerned about not capturing anything but the passphrase for the PGP key? Call me a sceptic but I'd say that the affidavit merely states this to either make it seem like they really know what they are doing, or to appease whatever restrictions the warrant for their entry to the premises and 'bugging' of the computer allowed.

    I would seriously doubt that if this 'device' was capable to record every keystroke as they claim, that if they had the opportunity to sift through Scarfo's (outgoing) email/online banking/Adult-Check/etc. they wouldn't.

    • Re:Doesn't it seem strange (Score:5, Insightful)

      by Ravensfire ( 209905 ) on Wednesday October 10, 2001 @12:32PM (#2411149) Homepage
      Why would this be strange? Most agents know pretty well what they can, and cannot get away with. The FBI, given some of the problems of the past, is doing what they can to NOT lose a case over a technicality. So creating a tool that allows them to capture only the information they have a court order for is an excellent idea from the FBI. If they got everything, found some new evidence from that illegally acquired information, it would probably get tossed out of court, along with the case (fruit of a poisoned tree).

      A law enforcement agency, creating a tool that is designed to operate within a limited court order - shouldn't we be at least somewhat positive of this?
      • Most agents know pretty well what they can, and cannot get away with.

        True, but that does not mean that they are not going to break the rules. The knowledge that they couldn't use the evidence would in no way deter them from collecting it. It just means that if they find evidence of a crime that is outside of their current scope, they will have to go the extra step of using the illegally obtained evidence to find further evidence legally. Then, it is just a matter of presenting only the untainted evidence in court.

        • True, but that does not mean that they are not going to break the rules. The knowledge that they couldn't use the evidence would in no way deter them from collecting it.

          Unlike your local PD, the FBI risks a lot more harm than possible benefit from such a strategy. All it would take is one whistleblower to make the whole thing blow up in their faces. I suspect that if the FBI says they are using those communication restraints it is because they are. Even the political damage, much less the criminal liability of lying to the courts, would be overwhelmingly more costly than losing this relatively unimportant case.

      • found some new evidence from that illegally acquired information, it would probably get tossed out of court, along with the case (fruit of a poisoned tree).

        Absolutely. If not, you can see the court proceedings...

        Prosecutor:"Your honor, if it pleases the bench, we would like to show the jury Exhibit A, to wit, the computer keystroke log of the defendent, "Scarfo".

        (aside)"Please start the on-screen display."

        "As you can see here, he is entering a secret pass phrase for a highly sophisticated encryption algorithm called P-G-P."

        "You can make out the individual letters of this secret key..."
        C-o-p-s- -a-r-e- -s-u-c-h- -l-o-o-z-e-r-s-.


        "And now you can see Scarfo entering the accounts information for his highly illicit operation."

        "I think any reasonable person would have to conclude that Scarfo was running an illegal operation and was taking great pains to hide this fact through his use of sophisticated high technology."

        (aside)"Please halt the projector."
        (Projector continues as Scarfo keystrokes exit from his business operations and he enters a chat room.)

        (with urgent pleading)"Halt the projector, please!"

        (The jury and much of the courtroom are breaking into barely concealed sniggering as they view Scarfo's conversation in the chat room.)

        Defense Attny: (suddenly jumping to his feet)"Objection, your honor!"

        "As you can plainly see from this chat room conversation, the investigators were clearly out to embarrass my client in front of his wife by presenting evidence that he was involved in impressing high school age girls with his youthful machismo while, as you can plainly see, he is actually an overweight, balding middle-aged man."

        "This evidence was not pertinent to the case, could unduly sway the jury's opinion of my client, and was used to blackmail my client into fabricating incriminating evidence of some supposed crime. I request the case be dismissed."

        Judge:"Objection sustained. Case dismissed.

  • Scarfo's Password (Score:3, Interesting)

    by billnapier ( 33763 ) <{moc.xobop} {ta} {reipan}> on Wednesday October 10, 2001 @12:26PM (#2411107) Homepage
    Anybody out there know what it was? The affidavit implies that it was put into court records at some point in time (at least the output of the KLS was). Just curious, thinking its something like NickyS or BaddaBing.

  • Ctrl-V ? (Score:3, Interesting)

    by simetra ( 155655 ) on Wednesday October 10, 2001 @12:29PM (#2411128) Homepage Journal
    Even if a keystroke logger recorded every single keystroke... if you were to copy and paste a password, say you put it in a text file on a floppy on a different computer.... wouldn't this render the keystroke logger useless? It would have to also record the contents of the "clipboard", no?

    • Re:Ctrl-V ? (Score:5, Funny)

      by The Dodger ( 10689 ) on Wednesday October 10, 2001 @12:43PM (#2411219) Homepage

      Yeah, but think about it.

      Do you really want to leave your PGP passphrase lying around in a text file on your computer? :)

      D.

      ...is for DOH!

      • Since the device(s) "wasn't supposed to" capture non-passphrase (probably through identifying the unique PGP pop up window) keys, if you for instance typed in the passphrase into an email's To: field then copied and pasted into the PGP window you wouldn't need to have it in plaintext somewhere on your computer or floppy (eck!)

      • Re:Ctrl-V ? (Score:2, Interesting)

        by jedwards ( 135260 )
        You can cut and paste the characters from a innocent copy of 'Alice's Adventures in Wonderland'.

      • Solution: Chargen (Score:5, Insightful)

        by Ted V ( 67691 ) on Wednesday October 10, 2001 @01:01PM (#2411328) Homepage
        Just use the windows character generator. When you need to enter a password, click it into the windows character generator and copy the resulting string and paste it later. No keyboard interface is ever required.

        Of course, then you're vulnerable to those things which remotely view monitors (Van-eckman scanners?). But I suppose if you're really paranoid about something like this, you would actually search for a keyboard logger first and put 3 other monitors nearby to create interference. So I guess it's all academic.

        -Ted

        • Just use the windows character generator. When you need to enter a password, click it into the windows character generator and copy the resulting string and paste it later. No keyboard interface is ever required.

          Well if the FBI figured out that's what he was doing, they could then just log his mouse movements and button clicks, since the layout of keys on the screen in that program would always be the same.

      • Use counterpane's password safe (blowfish based). Yes, a logger will get that db's password, but you could keep the db on removable (and maybe flashable) media. Future versions of password safe could also use some kind of keyboard obfuscation technique, displaying some kind of translation table on the display, e.g.

      • Re:Ctrl-V ? (Score:3, Interesting)

        by 4mn0t1337 ( 446316 )
        passphrase lying around in a text file

        Yeah, but how many millions of phrases are on your computer? The one that is your passphrase doesn't have to be obvious. (ie, brute force attack with the entire contents of the drive should slow someone down.)

        But, even better, you don't even have to leave the phrase laying about for longer than a few seconds. Just open up a web page, select the a few char of the password, and paste it to a temp file. Open up another page and copy another block of char and paste that to the file. Keep doing this until you have a complete password, copy it and close the file w/o saving.

        Anything that is recording your input stream from the keyboard is just going to see you just web surfing a doing a lot of copy and paste.

        • Re:Ctrl-V ? (Score:2, Interesting)

          by linuxrunner ( 225041 )
          Yeah, just keep a copy of the GNU-GPL lying around.. (I do) and copy and paste a line (long line) out of that!

          Linuxrunner
          • you've changed your behavior now, after telling the world about it, right?! your key is now vulnerable to a trivial dictionary attack :-)
      • Do you really want to leave your PGP passphrase lying around in a text file on your computer?

        Wouldn't it be fairly easy to obscure? You could hide it within a much larger string of random characters, compile it in an executable, etc.
        • A security system is only as secure as it's weakest link. Even if you have a 100-GB hard drive filled to capacity, it would still be fairly easy for the FBI to use it as the basis for a dictionary attack on your password. Plus, an attacker could use more sophisticated techniques to see what files you are accessing while your crypto program is running. This would narrow their search space down dramatically. If they've compromised your hardware, basically you are fucked. If you can't trust the hardware, you'll never have security.


          Security is inversely proportionate to convienience. The most secure method of key management is to have your crypto key on removable media (preferably somthing that is tamper-resistant and can be easily destroyed if needed). Of course it's a lot more convienient to keep your key on the same media that contains the encrypted data, but you pay for that convienience at the cost of security. Putting the passphrase there as well costs you even more security, regardless of how obfuscated it is.


          As others have already pointed out, good security comes from combining 2 of 3 essential elements: somthing you know, somthing you have, and somthing you are. In this case, "somthing you know" is the passphrase, and "somthing you have" is the crypto key -- if one is compromised, the other is still secure. Even rubber hose cryptanalysis will fail if you've destroyed the media which contains the only copy of the key.

      • Sure, especially since it blends in with all the other haikus in the file.

        For example.
    • Well, ummm, how would you get it in there to begin with? Face it, if someone has your keystrokes they are root and have all your hardware and your silly clipboard. All of this is so much easier to do with M$, as everything is root.

      What, me worry? Nahhh!

    • Exactly. Or a randomly ordered display of the alphabeth on the screen and you pick out the password with the cursor keys or the mouse. A keylogger would get no information about the password in this case!

  • Scarfo Used Windows (Score:5, Informative)

    by macsforever2001 ( 32278 ) on Wednesday October 10, 2001 @12:33PM (#2411154) Homepage

    The affidavit says that Scarfo used a Windows OS.

    Coupled with the DOJ ruling [usdoj.gov], it just goes to prove that M$ Windows is an operating system written for criminals by criminals.

    • In further released papers, the FBI has siezed all Microsoft assets. The FBI was able to do this by citing the laws regarding "primary use by criminals" since most copies of windows are pirated, used by viruses, or used by people who are criminals (including unpaid parking tickets).

      The new company, tentatively called GovernSoft, will be sold to the lowest bidder to pay for the costs of prosecuting the case, which could reach into untold billions of dollars.
  • Wonder what they'd use as their carefully-crafted excuse to get around the ECPA if he'd had broadband?

  • scarfo keylogger (Score:5, Funny)

    by trb ( 8509 ) on Wednesday October 10, 2001 @12:43PM (#2411214)
    When I read this headline, I thought, Scarfo is a pretty sensible name for a keystroke logger.

  • Fake "real" keyboard, then USB??? bwahahahar! (Score:3, Funny)

    by NeoTron ( 6020 ) <kevin.scarygliders@net> on Wednesday October 10, 2001 @12:44PM (#2411225) Homepage
    Couldn't you have your serial keyboard plugged in, then
    when you go to use your pc, go to another room, take out your
    nice USB keyboard, then plug that in and use that instead?

    Wouldn't it be funny seeing the feds puzzled faces - you've been
    sending all sorts of PGP'd email in the last month, and all thier logger has registered is "haha MOFO's!!!!" - LOL!!!!

  • Interesting. (Score:3, Insightful)

    by jd ( 1658 ) <imipak@yahoGINSBERGo.com minus poet> on Wednesday October 10, 2001 @12:53PM (#2411263) Homepage Journal
    "They go into a lot of detail on the methods they could be using".


    THIS is an interesting little statement. It says nothing about what they DID use, merely what they COULD have used. And since it's probably not an exhaustive list, the actual method(s) used may or may not be contained within it.


    It's important to not assume that the FBI are being malicious in what they've put in this brief, but it's equally important to verify what is being said. The FBI are not the most open organization in the world, and it would be erronious to assume that a court filing will be any more open than anything else they publish.

    • Re:Interesting. (Score:2, Insightful)

      by NeoTron ( 6020 )
      Indeed - if any agency openly published their methods, then eheh, well, isn't that like giving criminals a "how NOT to get caught" manual? :)

    • ...it would be erronious to assume that a court filing will be any more open than anything else they publish.

      IIRC, the judge did get an accurate description, so that he could rule on whether it stayed within the bounds of the warrant. This doc is what opposing counsel got.

  • A peril of open source (Score:3, Insightful)

    by eldurbarn ( 111734 ) on Wednesday October 10, 2001 @01:23PM (#2411436)
    Assuming that the version of PGP that was in use was one of the "source available" versions, why didn't the FBI simply alter the passphrase dialog code to store a plaintext version of the passphrase someplace on disk? All they'd need to do is re-install that portion of the application, and hope that the "bad guy" didn't do regular PGP sig/checksum comparisons against his installed programs (and how many of us do that?)
    • From the document it sounded like they were concerned about multiple layers or methods of encryption. Replacing PGP with a trojan version would have only provided them with one step of the process.
  • I don't know the American law very much. But as far as I know it's illegal to circumvent encription after the DMCA, isn't it? Would it be possible to fight against this keylogger citing the DMCA?

    • No.

      DMCA doesn't prohibit circumventing encryption, in general. It prohibits it under very specific cases. Short things like passwords are not copyrightable, so decrypting them isn't covered by DMCA.

      Furthermore, even if the conditions of DMCA applied to this act of circumvention (which they don't), it doesn't matter anyway. Because DMCA specifically exempts Law Enforcement.

  • okay let me get this straight (Score:3, Interesting)

    by Dr. Awktagon ( 233360 ) on Wednesday October 10, 2001 @01:55PM (#2411673) Homepage

    Did anyone read that whole thing? It seems that the FBI had a keystroke logger that only came on when the modem was off, with the belief, I assume, that the computer isn't a communication device unless the modem is on.

    So then the wiretap laws wouldn't apply when the modem is off? Is my interpretation correct?

    Strange loophole..

  • All your keystroke are belong to J. Edgar Hoover!



    OK,

    - B

  • Obviously, this would have to have at least some software, even though if it's a hardware keylogger, because the document implies that it's context-sensitive (doesn't capture keystrokes that get sent out over the modem.)

    Also, the obivous question: how did they install the keylogger in the firsrt place?

    Any conspiracy theorists wanna bet that Microsoft has had such backdoors (eg, blank areas in KERNEL32.EXE or the like where the FBI, etc could covertly upload arbitrary code, if triggered by say, inserting a floppy with the right code in the bootsector, etc?

  • modem??? NETWORK!!! (Score:2, Insightful)

    by Fuzzums ( 250400 )
    My computer is permanently commected to the internet or 'communicating' by the means of a netword-card. i think the difference in function between a modem and a network card is tuite small. so sollowing the line of thought: is my network card is functioning, it's not allowed to grab keys :)

    sim-ple.
  • If you're using Windows, you can hold down [Alt] and type in the ASCII code on the numeric keypad, and get characters that way. I don't think this works in Linux. Another tactic for GUI users would be to pop up a virtual keyboard that sends the appropriate message to the active window when the buttons are clicked with the mouse. I suppose this could be made to work with console apps as well, esp. if it is in a console window. Or, just click away from the window and enter some gibberish in a text editor, click back and enter the next character of your password, click away, rinse, repeat.

Slashdot Top Deals

Scientists will study your brain to learn more about your distant cousin, Man.

Close