KeyScrambler won't run in IE

KeyScrambler won't run in IE
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
KeyScrambler won't run in IE gv 10-31-2007
Posted by Ertugrul Soeylemez on November 1, 2007, 10:53 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> > No need to speculate - the Chernobyl virus would indeed trash some
> > BIOSes.
>
> I rather thought about constructively hosing the BIOS by adding a
> rootkit, f.e. as presented on DevCon '06. This is really to miracle,
> since a typical Award or AMI BIOS consists primarly of a little
> bootstrap code, a decompressor and a list of LHARC or ZIP compressed
> BLOBs of position-independent code. Just write your own code, compress
> it, add it to the list and write back the result. The typically free
> space ranges from 6K to 48K, that's more than enough to complete hook
> the entire boot process of Windows. On AMD CPUs, you can even
> introduce your very own microcode update pretty easily.

This is very error-prone. If something goes wrong, then you've got a
denial of service case, which the user would notice certainly, and from
which it's difficult to recover. However, maybe the virtualization
extensions of newer x86 processors can be abused for such purposes.


Regards,
Ertugrul S=C3=B6ylemez.


--=20
Security is the one concept, which makes things in your life stay as
they are. Otto is a man, who is afraid of changes in his life; so
naturally he does not employ security.

Posted by gv on October 31, 2007, 9:01 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
>
> > gv wrote:
>
> >> I installed KeyScrambler 1.3.1 via FireFox extensions, and checked
> >> the box to add the Internet Explorer (IE) plugin too. It works in
> >> Firefox, but there's not indication it's running in IE.
>
> > This is comp.security.misc.
>
> "This" is a crossposted message. :-(
>
> > At the name implies, we're discussing
> > computer security. Neither this KeyScrambler snakeoil nor the
> > often-abused-as-webbrowser IE have anything to do with security.
>
> Indeed. From the website:
>
> [quote]
> KeyScrambler Personal encrypts your keystrokes at the kernel driver level
> to protect your login information from keyloggers.
>
> When you type on your keyboard, the keys travel along a path within the
> operating system before it arrives at your browser. Keyloggers plant
> themselves along this path and observe and record your keystrokes. The
> collected information is then sent to the criminals who will use it to
> steal from you.
> [/quote]
>
> Any computer that has a keylogger on it is hosed. The user would need to
> wipe the disk and reinstall their OS.

Then 95% of all computers manufactured are "hosed" - and wiping/
reinstalling an OS won't help that. The original keylogger, which used
that exact term, was developed by the NSA, and was developed long
before the advent of the internet. It finally became publicly known
about around 1992, when a federal court ruled on admissablily of
evidence obtained by the FBI while using it. The ruling said the
government did not have to reveal how it worked, and that remains
classified. Using that technology the government can record keystokes
with instruments nearby 95% of all computers, without having to
install any software on the computer. However it works, it's built
into the computer. One type of keylogger used by the FBI was found to
work by queuing keystrokes in a rolling buffer, and the buffer was
transmitted (radio waves) if it received a query (also radio waves).
This was built into the laptop when it was manufactured. It was
speculated that this was intentionally exposed to cover for the main
keylogger technology, which is supposed to be more subtle. - I
don't know if Keyscrambler would help with that - I doubt it - but it
keeps the non-government types from stealing your passwords.



Posted by bealoid on November 1, 2007, 8:09 am
If you were  Registered and logged in, you could reply and use other advanced thread options

> I
> don't know if Keyscrambler would help with that - I doubt it - but it
> keeps the non-government types from stealing your passwords.

Keyscrambler does not stop non-government types from stealing passwords.
If the bad guys have installed malware on your machine there is *nothing*
that you can do -and certainly not with a browser plugin- that can help.

I've snipped the rest because TEMPEST technique discussions are stupid and
pointless - anyone who needs to worry about agencies using TEMPEST should
be skilled enough to not need to worry whether they've got keylogging softs
installed.

Posted by Sebastian G. on November 1, 2007, 3:12 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
gv wrote:

> The ruling said the
> government did not have to reveal how it worked, and that remains
> classified. Using that technology the government can record keystokes
> with instruments nearby 95% of all computers, without having to
> install any software on the computer. However it works, it's built
> into the computer. One type of keylogger used by the FBI was found to
> work by queuing keystrokes in a rolling buffer, and the buffer was
> transmitted (radio waves) if it received a query (also radio waves).


Stop your conspirancy theory and talk about the facts. Today you can easily
buy a keylogger fro $50 which consists of about half a centimeter of casing
with one side being a USB plug female, the other side USB plug male. Put it
in between the computer's USB port and the USB keyboard, and no user would
ever notice it. Records all keystrokes for basically eternity.

As for laptops: The internal keyboards connect through a little cable to an
internal port with the PS/2 communication protocol. Easy to add a little
chip in between.

Posted by MyTwoCents on November 2, 2007, 4:34 am
If you were  Registered and logged in, you could reply and use other advanced thread options
>>
>> > gv wrote:
>>
>> >> I installed KeyScrambler 1.3.1 via FireFox extensions, and checked
>> >> the box to add the Internet Explorer (IE) plugin too. It works in
>> >> Firefox, but there's not indication it's running in IE.
>>
>> > This is comp.security.misc.
>>
>> "This" is a crossposted message. :-(
>>
>> > At the name implies, we're discussing
>> > computer security. Neither this KeyScrambler snakeoil nor the
>> > often-abused-as-webbrowser IE have anything to do with security.
>>
>> Indeed. From the website:
>>
>> [quote]
>> KeyScrambler Personal encrypts your keystrokes at the kernel driver level
>> to protect your login information from keyloggers.
>>
>> When you type on your keyboard, the keys travel along a path within the
>> operating system before it arrives at your browser. Keyloggers plant
>> themselves along this path and observe and record your keystrokes. The
>> collected information is then sent to the criminals who will use it to
>> steal from you.
>> [/quote]
>>
>> Any computer that has a keylogger on it is hosed. The user would need to
>> wipe the disk and reinstall their OS.
>
>Then 95% of all computers manufactured are "hosed" - and wiping/
>reinstalling an OS won't help that. The original keylogger, which used
>that exact term, was developed by the NSA, and was developed long
>before the advent of the internet. It finally became publicly known
>about around 1992, when a federal court ruled on admissablily of
>evidence obtained by the FBI while using it. The ruling said the
>government did not have to reveal how it worked, and that remains
>classified. Using that technology the government can record keystokes
>with instruments nearby 95% of all computers, without having to
>install any software on the computer. However it works, it's built
>into the computer. One type of keylogger used by the FBI was found to
>work by queuing keystrokes in a rolling buffer, and the buffer was
>transmitted (radio waves) if it received a query (also radio waves).
>This was built into the laptop when it was manufactured. It was
>speculated that this was intentionally exposed to cover for the main
>keylogger technology, which is supposed to be more subtle. - I
>don't know if Keyscrambler would help with that - I doubt it - but it
>keeps the non-government types from stealing your passwords.


isnt it wonderful being able to make wild statements like that without a
shred of anything to prove them?



--
My public keys can be found on my freenet site:
SSK@TEx6TiaPeszpV4AFw3ToutDb49EPAgM/mytwocents/51//m2ckey.html
(*NOTE* you must be running freenet for this link to be usefull)
and on public keyservers. Key-Id: 0x92769D7E
Fingerprint: 2F07D586C8D4EEA732711338CFEF46E592769D7E
I can be reached either by the NiM form on the freesite or by
Email: m2c AT nym.panta-rhei.eu.org
Frost: MyTwoCents@Z+59LNK9NhMvxewYggENU4Ww50s On the Freenet board

~~~~~~~~~~~~~~~~~~~~~
This message was posted via one or more anonymous remailing services.
The original sender is unknown. Any address shown in the From header
is unverified. You need a valid hashcash token to post to groups other
than alt.test and alt.anonymous.messages. Visit www.panta-rhei.eu.org
for abuse and hashcash info.





The site map in XML format XML site map

Contact Us | Privacy Policy