undefined | Better HN

0 pointscodedokode3y ago0 comments

That's why keyloggers also log the title of an active window.

0 comments

So the malware is running in the user's context, and has the browser's window handle and instead of using that to hook the child input elements directly, they're going to store an unintelligible stream of keystrokes then use the window handle to bundle that with the window's title? Is that a reasonable way to implement malware? Will it result in high quality data for resale?

One of those "Things programmers believe about malware" articles needs to be written. There's a lot of "Schrödinger's cat"-level thinking going on, wherein malware is both running with full rights of the user while ALSO somehow needs to rely on raw keystrokes to record anything.

imranhou3y ago

I think a simple keylogger that also reads window titles is much easier to build, than to read and control content inside a browser. This kind of technique would work really well if they are targeting a small group of users. One can argue that reading browser content through a browser extension would be equally easy to implement, but that's harder to hide and limits your scope to only browser activity.

Someone12343y ago

It makes far more sense to assume threat actors are commercial malware authors rather than toy projects, since that's the reality in the world.

brewdad3y ago

Even if a naive keylogger is only capturing keystrokes and sending that file somewhere. It's a simple script to search for email addresses and then assume the next 8-64 characters are the password. How many of us type in a web address, then go type something else. Then return to the web site and type the user name, go back to work on an email, then come back and type the password?

I would guess approximately no one does this as standard behavior.

j / k navigate · click thread line to collapse

0 comments

Someone12343y ago

imranhou3y ago

Someone12343y ago

It makes far more sense to assume threat actors are commercial malware authors rather than toy projects, since that's the reality in the world.

brewdad3y ago

I would guess approximately no one does this as standard behavior.

j / k navigate · click thread line to collapse