How Safe Are Your Passwords?Actually, virtually no method mentioned can insure that stored passwords are completely protected if the computer you're using is compromised by hardware/software data capture, such as a keylogger Trojan. What makes the situation worse is that many anti-virus/anti-malware software packages are ineffective in detecting the presence of a keylogger in real-time. Though can be more effective in doing so when utilizing an on-demand scan. Yet, often requires the use of specialized security apps such as Malwarebytes.
I did some brief testing of password security methods using two popular keylogging utilities readily available on the NET. One of which could capture contents from the clipboard(copy/paste). In each case, I used the normal procedure for inputting the stored account user name/password for the application or method to log into RV.NET. Here are some observations for common password storage methods mentioned.
Method 1: Using Paper to Store Passwords.
Password Database Access -
NO?User Name/Password Revealed -
YES
The keylogger was easily able to record the website name, and the user name/password when utilizing the hardware keyboard.
Inputting using a virtual keyboard, such as Windows On-Screen Keyboard, made no difference. The keylogger was still able to record the user name/password.
This was by far, among the least secure methods.
Method 2: Using Firefox Browser's built-in Password Manager.
Password Database Access -
YES if using Master Password.
User Name/Password Revealed -
NO
The keylogger was "not" able to record the user name/password using Firefox's built-in password manager. However, it was able to record the Master Password, if enable for access, which could be used to reveal passwords if one had local access to Firefox.
Not using a Master Password leaves Firefox's passwords unsecured, unless the database is separately encrypted. Such as securing Firefox's profile folder in a encrypted virtual container.
Method 3: Password Manager Utility - KeePass
Password Database Access -
NO if using Secured Desktop option for Master Password, or a Key File.
User Name/Password Revealed -
YES
Using KeePass, the keylogger could not record the Master Password to unlock the database file if Secure Desktop is enabled under options. Nor could it record the Key file if used. However, the second keylogger utility was able to capture both the User Name/Password from the clipboard if using copy/paste from within KeePass. So not a secure method to use on a compromised system.
Method 4: Cloud Password Manager - LastPass.
Password Database Access -
YESUser Name/Password Revealed -
NO
Using LastPass in Firefox, the keylogger was able to record both the account email address/password from the Master Log-in form for account access. If "Remember Email" was enabled, the LastPass account password was still recorded though the associated account email address was not. No user names/passwords were revealed with auto log-in, but still the possibility exists to hijack the account itself containing the passwords online.
Though just a very limited test, it does demonstrate the dangers of keyloggers. A popular method used by cyber criminals to gain unauthorized access into personal/business accounts. Which was reportedly used to ultimately breach Target's database, by using captured credentials from a contractor through an infected email attachment. Resulting in the theft of 110 million customer accounts.
Notwithstanding, it was interesting that Firefox browser based password managers appear to offer the best protection, so long as the database can be adequately secured locally. None of the keyloggers were able to capture any data using auto login functions.
Another useful option would be to utilize a keystroke encryption app as part of a multilayered security approach, which could render keylogging Trojans ineffective in capturing data. However, they would not be effective against hardware based keyloggers.
There are a couple free anti-keylogging apps available. I personally use
Zemana AntiLogger Free. In fact, with AntiLogger Free activated, the keyloggers tested could not effectively record useable data, nor capture any user names/passwords.
Zemana AntiLogger was also tested against 14 known keyloggers by another website, and passed in all instances.
UPDATED: To include results from a second keylogger to test clipboard data capture(copy/paste).
