How to detect a keylogger/monitoring

H

HouseCat

Guest
I know what keyloggers are and what they're capable of. Is there any way to detect if one is running on a personal profile or computer? LAN computer specifically. Some of them are made to run silent and not listed on the Task Manager. I googled all the tasks running to no avail.
Also, is there a way to find out what IP address is doing the monitoring?

Got a nosy a-hole in the office with admin rights and no one likes her, so she's gossiping to others about personal info in our email that we haven't shared. The only way she could've gotten this info is by monitoring our personal profiles via keylogger.
 

moon5leg

It's not easy being green
... The only way she could've gotten this info is by monitoring our personal profiles via keylogger.

Most anti-spyware programs, such as spybot, have keylogger detectors built in to them, although admin privileges may be required to actually remove the key logging software.

That being said, key logging is neither the only way, or the most common way for snooping in on office email. Most interoffice email systems are not very secure. The protocols used for sending login information are often not secure. A simple LAN sniffer can capture all of the traffic on the network. User names and passwords are unfortunately often sent in clear text and once captured can be used by the "bad guys", in this case, your admin.

The general rule of thumb, sadly, is unless you are sending an encrypted message, don't put anything in an email (no matter how private you think it should be) that you wouldn't want posted on the company bulletin board. But run that anti spyware software and see what it comes up with. Good luck.
 

jhns64

New Member
Got a nosy a-hole in the office with admin rights and no one likes her, so she's gossiping to others about personal info in our email that we haven't shared. The only way she could've gotten this info is by monitoring our personal profiles via keylogger.

Although I do not agree with the "gossiping" on her findings, I have to say that if you are at work and it is a work computer they can look wherever they want to. Its the COMPANY'S Computer not your personal one. If you don't want people knowing your personal business don't put it on a company computer.
 
W

Wenchy

Guest
H

HouseCat

Guest
Most anti-spyware programs, such as spybot, have keylogger detectors built in to them, although admin privileges may be required to actually remove the key logging software.

That being said, key logging is neither the only way, or the most common way for snooping in on office email. Most interoffice email systems are not very secure. The protocols used for sending login information are often not secure. A simple LAN sniffer can capture all of the traffic on the network. User names and passwords are unfortunately often sent in clear text and once captured can be used by the "bad guys", in this case, your admin.

The general rule of thumb, sadly, is unless you are sending an encrypted message, don't put anything in an email (no matter how private you think it should be) that you wouldn't want posted on the company bulletin board. But run that anti spyware software and see what it comes up with. Good luck.

I figured it was something more complicated than a keylogger, but I get this phone call from the offended gal I supervise swearing the Lan gal put some keylogger on her computer. The boss is out of town, so I'm a bit perturbed right now.

Thanks for the info.

Although I do not agree with the "gossiping" on her findings, I have to say that if you are at work and it is a work computer they can look wherever they want to. Its the COMPANY'S Computer not your personal one. If you don't want people knowing your personal business don't put it on a company computer.

That's a given in any LAN. The Admin does have the right to monitor our computer, you're right..but their job is to manage the LAN... and report abuse, not use it to gossip. I could careless if she reads my sappy emails to my hubby... or prints them out... some of them are funny. However, when it comes to privacy act information or demeaning another coworker, its just wrong and she needs to be stopped. Its no telling what else she's been reading and blabbing about. She's not allowed to do that.

We;re allowed to send personal emails, and surf the web for say the weather, pay bills, etc... as long as we're not downloading anything, surfing porn, or sucking up bandwidth, it's ok. I've worked with other Lans before, adn they didn't give a crap who looked at what, as long as they didn't set off any filter alerts. They usually have more important things to do.

I guess I'll send out a memo tomorrow telling everyone not to send any personal info via email due to a private info being disclosed to unauthorized recipients.
-------------------------------------

Wenchy...that is some crazy stuff isn't it. Ppl can't wait to get home to watch that crap. Obviously, not being challenged enough at work.

huh.. sounds like a good idea for the Lan gal. I need to find more crap for her to fix/do.
 
R

RadioPatrol

Guest
Key loggers can also be a "device" that sites between the keyboard and PS/2 Port and catches key strokes that way ...... requires a physical check for the device, but a system scan will not turn it up.

Also if this gal is Admin of your email system / server she has access to any and all email accounts and with OWA and user passwords even on the LAN she can check anyones email account and no one will ever know she was there ............

is this person trust worthy ? could she be stealing company secrets and or client lists as well .......... if she is willing to dig into "personal" emails who knows what she is into ......

and nothing is personal on a company LAN these days ......... pick up your Cell and call your SO that way ........
 

Dougstermd

ORGASM DONOR
.

I guess I'll send out a memo tomorrow telling everyone not to send any personal info via email due to a private info being disclosed to unauthorized recipients.
-------------------------------------

Wenchy...that is some crazy stuff isn't it. Ppl can't wait to get home to watch that crap. Obviously, not being challenged enough at work.

huh.. sounds like a good idea for the Lan gal. I need to find more crap for her to fix/do.

Be careful with the memeo thing it might backfire. Plus I bet the info that admin girl got did not come from where you think it did.
 
Be careful with the memeo thing it might backfire. Plus I bet the info that admin girl got did not come from where you think it did.

:yeahthat: Unless you are absolutely sure how she obtains the info, any accusations could be damaging to you. If she is an admin, she might be getting the info by directly reading emails, or.... someone might have forwarded emails to her. You just don't know.
 
K

Kain99

Guest
May I change the original question a little bit? Is there any way to detect these programs at home?
 
If you are using an Exchange Server - admin can open your e-mail store and read any/all your messages.

You can also do it with a sendmail server but it is a bit tougher...
 

schmide

New Member
An ethernet controller can be placed in promiscuous mode (packet sniffing) and read every bit of information on the subnet (network). You can easily watch most traffic with such a system.

It takes a bit to detect one. Some can be done by monitoring transmission times, while other packet sniffers can be tricked into replying to certain protocols. You can prevent some sniffing by using SSL (secure socket layer) in your email. If you're browsing you may look into using a SSL Proxy for browsing.

Much of this may be against the rules of your office network so tread lightly.
 
R

RadioPatrol

Guest
Schmide - Good Point;

this is a lot harder on todays "switched" networks, where packets are only sent to the computer initiating the communication - the are more sophisticated methods for flooding "cache" ..... blah blah blah .... that most basic admins don't know about ....

unless someone inserts an old "dumb" hub in between .........
 
Top