Keylogging Hack – The hacker sees all
| KEY TAKEAWAYS: |
| — Keyloggers, much like malware, can be easily installed onto a computer or smartphone by using links or banners as well as disguising itself as a proper installation file. — Once installed, an attacker can view everything that you type into your computer or smartphone, such as your login details for e-mails, online banking or cryptocurrency wallet. — Hardware wallets keep access to your crypto fully offline and can equally be used as a secure form of 2FA to restrict access to other accounts. |
Being your own bank means being your own security guard too – you can never know too much about these classic crypto hacks.
Keylogging consists of installing malicious surveillance software onto the victim’s computer that records all of the keystrokes typed. Using technology to translate the pressed keys into humanly understandable phrases and patterns at various logins (i.e., bank account, crypto wallet, etc.), hackers can steal your identity, money, and other assets remotely.
The odd aspect of Keyloggers is that there are legitimate products available designed to help people in some rather mundane instances. For example, tracking what children search on the computer and whether or not someone has been accessing your computer while you are away are two of the most prevalent cases.
If you’re not careful to check the URL (and that it is HTTPS) to verify you are on the official website of the product, you may be installing malicious software instead of a real product. Especially if the download is free and you know it should cost something, you should be wary.
Keyloggers can be disguised in similar fashions as malware – from using phishing techniques to inserting malicious code into an application.
Some malicious keylogger software might be disguising itself as an installation file for a proper program. Upon finalizing its installation, it’d provide an error message and would indicate that the installation failed. In reality, however, malicious software is now running on your system. Some keylogger software is also available for mobile systems.
Once installed, the malware goes to work, recording each and every keystroke you make. To the hacker, the surveillance software can even tell them what you are doing in real time, such as accessing certain applications. Users will be completely unaware that surveillance is working in the background.
Keylogger software is often easy to write or embed with a snippet of code into a legitimate program. They can be distributed via viruses like trojan horses, and are popular for stealing online payment information via payment gateways.
Keyloggers still comprise a clear and present danger to your crypto funds, though, and should not be overlooked.
A hacker can observe users log into their web wallets, write down passwords in notes apps, or gain access to sensitive email suites (e.g., Gmail) that enable them to reset 2-FA settings and other passwords — locking users out of their accounts. Keystroke logging attacks are often targeted at serendipitous encounters with individuals that come across embedded malware links masquerading as real products, but they can also be fused with phishing attacks.
The frequent targets of hybrid phishing and keylogging attacks are exchange users, who stand the most to lose from the invasion of their stored data that enables access to potentially hundreds of millions of dollars worth of crypto assets.
Keyloggers target smartphones or computers in order to steal account credentials (email, bank, exchange accounts). There are no credentials to steal on a hardware wallet (except the PIN, which is entered through buttons on the device itself), thus the threat doesn’t exist.
Hardware wallets protect your crypto assets against the threat posed by keyloggers.
Hardware wallets to counter keylogging
Hardware wallets are not connected to the Internet when they plug into a smartphone or computer, meaning that they do not share or communicate any critical information to the machine out of an abundance of caution. The same goes for hardware wallets that connect to smartphones. Hardware wallet devices are physically secured from both the public internet and unsecured local area networks.
There are no credentials to steal on a hardware wallet, so the keylogging threat is entirely absent.
Keylogging software cannot observe what is happening on a hardware wallet’s interface because it does not have access to it. It’s equally blocked from transferring malicious data to the device.
As an extra precautionary step in general, keylogging software is fraught with malware. If you’re looking for a keylogger for personal use, select from published, verified developers in marketplaces like Apple’s App Store — not sketchy websites.
As a crypto investor using a Ledger hardware wallet, always remember that physical confirmation is necessary for each transaction directly on the device. The combination of isolation, genuine checking, and physical verification of transactions impedes a hacker from manipulating the interface of your hardware device.
Knowledge is power – so keep on learning! If you enjoy getting to grips with crypto and blockchain, check out our School of Block video How to Keep Your Crypto Safe.