Articles > Information Technology聽>聽What is keylogging?
Written by Michael Feder
Reviewed by聽Kathryn Uhles, MIS, MSP,聽Dean, College of Business and IT
A keylogger is a program that monitors device activity by recording every key that is pressed and then saves that data to a file. This type of program can be used as an effective security measure, as well as a malicious threat if it's in the wrong hands.聽Let鈥檚 discuss more about this cyberthreat, including different types, potential dangers and what to do to help protect devices.
Keylogging can be used for legitimate purposes. For example, high-security employers might use keystroke recording programs to monitor employee activity around sensitive files. In other cases, organizations might use a keylogger to decrease the risk of data theft.
When used illegally or without the user鈥檚 knowledge, a keylogger is a form of spyware. These covert programs聽maliciously monitor a user鈥檚 activity to steal personal information, including payment details, passwords and login credentials.
Some of these malware programs live online; others live directly in hardware and are installed and removed by a hacker. Despite the differences, all malicious keyloggers share a common element 鈥 they can observe, track and report on activity without the device user knowing about it.
API keyloggers work by monitoring keystrokes from application programming interfaces (APIs). It basically creates a communication link between two computers. The API allows the devices to 鈥渟peak鈥 with each other, which lets a hacker鈥檚 device receive all keystrokes recorded from the user鈥檚 device.
A form-grabbing keylogger is primarily used to record data entered into online web forms. Whenever users enter their personal information into a website鈥檚 form, the program records the data.
Form-grabbing spyware often doesn鈥檛 exist on a user鈥檚 device. Instead, it is typically hidden inside a website鈥檚 code. When a user visits the unsecured website, the form-grabbing program records keystrokes and delivers the information to the hacker who implemented the malicious code.
Kernel-based keylogging programs work in multiple stages. First, the program will achieve root access 鈥 the authority in a device to carry out any command or access any file on the device鈥檚 hard drive. With this, a kernel-based program will begin tracking a user鈥檚 keystrokes.
These programs remain hidden while extracting information. Even when running, they often don鈥檛 appear in the device鈥檚 task manager application. They鈥檙e also聽difficult to find and remove聽since they appear to have full, administrator-level permissions.
A hardware keylogger is a physical device capable of tracking a user鈥檚 keystrokes. Sometimes it looks like a camera that can visually register keystrokes. In other cases, it might be built into the keyboard or connected to the computer via USB.
This rigged hardware begins work聽. Tracked keystrokes are saved to a device, often without the user knowing. To retrieve the saved keystroke files, the hacker usually has to retrieve the hardware from the computer.聽Although this isn鈥檛 common, it is important to be aware of.
An acoustic keylogger program records the sound that each key makes when pressed. Since each key makes a slightly distinct sound, it can track which key is pressed based on the noise it makes.
After acquiring the sound files of the keys, hackers will then translate the sounds to identify which keys a user has pressed. Acoustic keylogging programs are used less often than other forms since the sounds recorded are sometimes muffled or inaccurate.
Keyloggers can be dangerous when used by cybercriminals. If the program is not identified and eliminated, a hacker can steal a lot of sensitive information. While keystroke logging spyware won鈥檛 negatively affect the state of a hard drive, it can easily steal and exploit data before a user knows what鈥檚 happening.
Cybercriminals with access to a user鈥檚 keystrokes also have access to sensitive information, including passwords and bank details. Armed with this information, they can steal a person鈥檚 identity,聽which can result in financial loss, compromised Social Security accounts and emotional stress.
Keylogger-based fraud can affect a person鈥檚 identity, finances and even friends and family members. Some hackers use a person鈥檚 keystrokes to send messages to the victim鈥檚 personal contacts, often as part of a聽phishing scam. Other hackers use saved social media passwords to聽. With the right bank information, some scammers might go straight for finances.
Cybercriminals can also mine information from keystrokes, which results in cyberstalking 鈥 when cybercriminals use the internet to harass, intimidate or bully others. An estimated have experienced some form of online harassment.
Cyberstalking can often begin through an email or a message that feels harmless. The conversation quickly becomes less friendly, though, as cybercriminals continually contact a person even after the individual has asked for interactions to stop. Some cybercriminals will contact the same person through multiple accounts.
It鈥檚 important to give聽 devices the best chance possible against these malicious programs. This means following the best preventive practices:
If a malicious program is identified on a device, remove the program as quickly as possible. This is critical to do before the it begins sending your information to one or more cybercriminals.
Start by checking for antivirus or anti-malware software when removing an malicious program. Run the device's protection program to determine if it is infected with any spyware. Only use trusted sources to download an anti-malware program since some聽spyware can hide within malicious programs posing as legitimate security programs.
Make sure to uninstall or delete any untrusted programs the security program finds. Hardware 鈥 including your affected hard drive 鈥 may also need to be removed to fully eradicate the infection.
Exercise caution while completing any of the above steps. These programs can easily hide within other programs and may still be present even if they seem to be fully removed. If necessary, consult an IT expert for advice while attempting to remove a keylogger.
Tracking and recording keystrokes isn鈥檛 always a bad thing. In some cases, it can be used to create transparency and healthy levels of accountability.
Here are some of the benefits of proper keylogging:
When used in a business environment, many employers choose to notify their employees of using keystroke tracking so they are aware of tracking programs in place.
Keylogging skills can be used in several ways in various careers. These include聽cybersecurity,听辞谤 information technology, particularly in a role that oversees employee security or productivity.
You鈥檒l likely need to聽obtain a degree in technology聽for either of these positions. Many aspiring cybersecurity and IT professionals聽pursue a degree in cybersecurity聽to improve skills in risk management, cloud security, systems administration and other fields.
Whether you鈥檙e seeking to gain a basic understanding of IT, or specialize in areas of cybersecurity like keyloggin, malvertising, and other cyberthreats, 七色视频 offers聽online courses,聽certificates聽and聽degrees that include.
Contact 七色视频 for more information.
A graduate of Johns Hopkins University and its Writing Seminars program and winner of the Stephen A. Dixon Literary Prize, Michael Feder brings an eye for detail and a passion for research to every article he writes. His academic and professional background includes experience in marketing, content development, script writing and SEO. Today, he works as a multimedia specialist at 七色视频 where he covers a variety of topics ranging from healthcare to IT.
Currently Dean of the College of Business and Information Technology,聽Kathryn Uhles has served 七色视频 in a variety of roles since 2006. Prior to joining 七色视频, Kathryn taught fifth grade to underprivileged youth in Phoenix.
This article has been vetted by 七色视频's editorial advisory committee.聽
Read more about our editorial process.