1
00:00:00,090 --> 00:00:01,050
In this lesson,

2
00:00:01,050 --> 00:00:03,030
we're going to explore a malicious type of software

3
00:00:03,030 --> 00:00:04,800
known as a keylogger.

4
00:00:04,800 --> 00:00:06,480
Now, in the world of cybersecurity,

5
00:00:06,480 --> 00:00:07,860
keyloggers hold a special place

6
00:00:07,860 --> 00:00:09,090
because of their sheer stealth,

7
00:00:09,090 --> 00:00:11,520
and potential to cause large-scale damage.

8
00:00:11,520 --> 00:00:12,780
Keyloggers were originally developed

9
00:00:12,780 --> 00:00:14,310
by system administrators to help them

10
00:00:14,310 --> 00:00:15,870
troubleshoot technical problems.

11
00:00:15,870 --> 00:00:17,220
But over the past few decades,

12
00:00:17,220 --> 00:00:19,680
these tools have become weaponized by cyber criminals

13
00:00:19,680 --> 00:00:21,570
who want to steal your sensitive information,

14
00:00:21,570 --> 00:00:23,070
like usernames and passwords,

15
00:00:23,070 --> 00:00:26,220
directly from the keystrokes of their unsuspecting victims.

16
00:00:26,220 --> 00:00:28,590
So, what exactly is a keylogger?

17
00:00:28,590 --> 00:00:30,510
Well, a keylogger, at its core,

18
00:00:30,510 --> 00:00:32,340
is a piece of software or hardware

19
00:00:32,340 --> 00:00:34,410
that records every single keystroke that is made

20
00:00:34,410 --> 00:00:36,420
on a computer or mobile device.

21
00:00:36,420 --> 00:00:38,340
This means that every letter that is typed in,

22
00:00:38,340 --> 00:00:39,900
every password that is entered,

23
00:00:39,900 --> 00:00:41,700
and every web search that's being conducted

24
00:00:41,700 --> 00:00:44,280
will be captured and sent back to that threat actor

25
00:00:44,280 --> 00:00:46,170
without your knowledge or consent.

26
00:00:46,170 --> 00:00:47,880
Keyloggers are considered to be a simple,

27
00:00:47,880 --> 00:00:50,370
yet effective mechanism that cyber criminals can use

28
00:00:50,370 --> 00:00:53,520
to get direct access to your personal and financial data.

29
00:00:53,520 --> 00:00:56,460
This can lead to potential identity theft, financial fraud,

30
00:00:56,460 --> 00:00:59,280
and even corporate espionage in some cases.

31
00:00:59,280 --> 00:01:01,290
Now, keyloggers can either be software-based

32
00:01:01,290 --> 00:01:02,670
or hardware-based.

33
00:01:02,670 --> 00:01:04,560
When you're dealing with a software-based keylogger,

34
00:01:04,560 --> 00:01:06,480
these are malicious programs that get installed

35
00:01:06,480 --> 00:01:07,740
on a victim's computer,

36
00:01:07,740 --> 00:01:09,480
and they're often bundled with other software

37
00:01:09,480 --> 00:01:11,400
or delivered through social engineering attacks,

38
00:01:11,400 --> 00:01:13,770
like phishing and pretexting attacks.

39
00:01:13,770 --> 00:01:16,830
These keyloggers can also evade antivirus detection,

40
00:01:16,830 --> 00:01:18,150
especially if the attacker uses

41
00:01:18,150 --> 00:01:20,250
sophisticated evasion techniques.

42
00:01:20,250 --> 00:01:21,540
Now, once activated,

43
00:01:21,540 --> 00:01:23,820
the keylogger can operate silently in the background

44
00:01:23,820 --> 00:01:26,370
and capture every keystroke, and then transmit it back

45
00:01:26,370 --> 00:01:29,400
to the remote server that's controlled by a threat actor.

46
00:01:29,400 --> 00:01:31,290
Now, a hardware keylogger, on the other hand,

47
00:01:31,290 --> 00:01:32,310
is a physical device

48
00:01:32,310 --> 00:01:34,290
that needs to be plugged into a computer.

49
00:01:34,290 --> 00:01:36,870
Usually these will resemble a USB thumb drive,

50
00:01:36,870 --> 00:01:40,020
or they can be embedded within the keyboard cable itself.

51
00:01:40,020 --> 00:01:41,700
These are considered physical devices,

52
00:01:41,700 --> 00:01:44,130
and that means they're harder to deploy on a large scale.

53
00:01:44,130 --> 00:01:46,020
But they can be very effective for use

54
00:01:46,020 --> 00:01:47,520
in a more targeted attack,

55
00:01:47,520 --> 00:01:49,770
especially since these hardware devices are immune

56
00:01:49,770 --> 00:01:51,510
to software-based detection methods,

57
00:01:51,510 --> 00:01:53,430
like anti-malware scans.

58
00:01:53,430 --> 00:01:55,620
When a hardware keylogger is installed on a system,

59
00:01:55,620 --> 00:01:57,960
the computer actually believes it's a regular keyboard,

60
00:01:57,960 --> 00:02:00,300
and the system has no idea that it's being victimized

61
00:02:00,300 --> 00:02:02,220
by the hardware keylogger.

62
00:02:02,220 --> 00:02:03,990
Now, keyloggers present a lot of risk

63
00:02:03,990 --> 00:02:05,850
to our systems and our privacy.

64
00:02:05,850 --> 00:02:07,290
From a personal standpoint,

65
00:02:07,290 --> 00:02:09,419
victims can have their usernames, passwords,

66
00:02:09,419 --> 00:02:11,580
credit card numbers, and other sensitive information

67
00:02:11,580 --> 00:02:13,080
stolen by these keyloggers,

68
00:02:13,080 --> 00:02:15,360
which can then lead to unauthorized bank transactions,

69
00:02:15,360 --> 00:02:18,810
unauthorized purchases, or full-scale identity theft.

70
00:02:18,810 --> 00:02:20,820
Now, from a business or corporate perspective,

71
00:02:20,820 --> 00:02:23,010
the stakes can be even higher though.

72
00:02:23,010 --> 00:02:25,740
Employees who have unknowingly been infected with keyloggers

73
00:02:25,740 --> 00:02:27,450
could give away their logging credentials,

74
00:02:27,450 --> 00:02:29,340
the contents of their confidential emails,

75
00:02:29,340 --> 00:02:30,870
the company's proprietary data,

76
00:02:30,870 --> 00:02:32,400
or even the company's strategic plans

77
00:02:32,400 --> 00:02:34,290
without even realizing it.

78
00:02:34,290 --> 00:02:37,230
These security breaches could result in financial losses,

79
00:02:37,230 --> 00:02:39,180
damage to the organization's reputation,

80
00:02:39,180 --> 00:02:40,320
legal repercussions,

81
00:02:40,320 --> 00:02:42,030
and a loss of their competitive advantage

82
00:02:42,030 --> 00:02:43,590
in the marketplace.

83
00:02:43,590 --> 00:02:45,960
Now, to protect your organization from keyloggers,

84
00:02:45,960 --> 00:02:47,790
you should ensure you perform regular updates

85
00:02:47,790 --> 00:02:49,380
and patches on your systems.

86
00:02:49,380 --> 00:02:51,120
You should rely on quality antivirus

87
00:02:51,120 --> 00:02:52,530
and anti-malware solutions.

88
00:02:52,530 --> 00:02:54,150
You should conduct phishing awareness training

89
00:02:54,150 --> 00:02:55,380
for all your end-users.

90
00:02:55,380 --> 00:02:57,900
You should implement multifactor authentication systems.

91
00:02:57,900 --> 00:03:00,330
You should encrypt keystrokes being sent to your systems,

92
00:03:00,330 --> 00:03:02,790
and you should perform physical checks of your desktops,

93
00:03:02,790 --> 00:03:05,550
laptops, or servers to see if a hardware-based keylogger

94
00:03:05,550 --> 00:03:06,840
is being used.

95
00:03:06,840 --> 00:03:08,790
First, you should always regularly update

96
00:03:08,790 --> 00:03:10,050
and patch your systems.

97
00:03:10,050 --> 00:03:12,480
By keeping your operating systems and software updated,

98
00:03:12,480 --> 00:03:13,650
Your organization can ensure

99
00:03:13,650 --> 00:03:15,750
that known vulnerabilities are not being excluded

100
00:03:15,750 --> 00:03:16,980
by a keylogger.

101
00:03:16,980 --> 00:03:18,510
Second, you should invest

102
00:03:18,510 --> 00:03:21,390
in a quality antivirus or anti-malware solution.

103
00:03:21,390 --> 00:03:23,400
By using comprehensive security software,

104
00:03:23,400 --> 00:03:25,080
you'll be able to detect and quarantine

105
00:03:25,080 --> 00:03:26,460
any keylogging software

106
00:03:26,460 --> 00:03:28,440
that may be installed on your system.

107
00:03:28,440 --> 00:03:30,660
It's always important to conduct regular antivirus

108
00:03:30,660 --> 00:03:33,090
and anti-malware scans to detect any keyloggers

109
00:03:33,090 --> 00:03:34,590
that may have accidentally been installed

110
00:03:34,590 --> 00:03:36,150
since your last scan.

111
00:03:36,150 --> 00:03:38,430
Third, you should conduct phishing awareness training

112
00:03:38,430 --> 00:03:39,780
for your end-users.

113
00:03:39,780 --> 00:03:42,270
Keyloggers are often distributed through phishing emails,

114
00:03:42,270 --> 00:03:43,440
so it's really important that you train

115
00:03:43,440 --> 00:03:44,970
all of your organization's users

116
00:03:44,970 --> 00:03:47,160
on how to be cautious when they're downloading attachments,

117
00:03:47,160 --> 00:03:50,430
or clicking links from unknown or untrusted senders.

118
00:03:50,430 --> 00:03:53,220
Fourth, you should implement multifactor authentication,

119
00:03:53,220 --> 00:03:55,110
also known as MFA.

120
00:03:55,110 --> 00:03:57,240
Now, if multifactor authentication has been implemented

121
00:03:57,240 --> 00:03:58,710
across your enterprise network,

122
00:03:58,710 --> 00:04:00,570
this means that even if a keylogger was used

123
00:04:00,570 --> 00:04:01,890
to capture your password,

124
00:04:01,890 --> 00:04:04,590
the threat actor will still be unable to access the system

125
00:04:04,590 --> 00:04:06,960
because they require an additional verification step,

126
00:04:06,960 --> 00:04:09,840
such as an authenticator app code, a one-time text message,

127
00:04:09,840 --> 00:04:13,230
or your fingerprint or facial scan to recognize you.

128
00:04:13,230 --> 00:04:14,940
Fifth, you should encrypt keystrokes

129
00:04:14,940 --> 00:04:16,410
being sent to your systems.

130
00:04:16,410 --> 00:04:18,720
Some security software can protect your system

131
00:04:18,720 --> 00:04:20,370
by implementing keystroke encryption

132
00:04:20,370 --> 00:04:21,899
to scramble your typed information

133
00:04:21,899 --> 00:04:23,970
before sending it over to the system.

134
00:04:23,970 --> 00:04:26,460
This means that if the data was captured by a keylogger,

135
00:04:26,460 --> 00:04:28,410
it's going to be scrambled up in ciphertext,

136
00:04:28,410 --> 00:04:30,720
and it'll become unusable to a threat actor.

137
00:04:30,720 --> 00:04:33,060
Sixth, and finally, you should conduct physical checks

138
00:04:33,060 --> 00:04:35,310
to see if a hardware keylogger is being used.

139
00:04:35,310 --> 00:04:36,510
This is especially important

140
00:04:36,510 --> 00:04:38,580
when you're operating in a sensitive environment.

141
00:04:38,580 --> 00:04:40,770
You should always regularly inspect your system's hardware

142
00:04:40,770 --> 00:04:42,630
for unfamiliar devices that could contain

143
00:04:42,630 --> 00:04:44,250
a hardware keylogger too.

144
00:04:44,250 --> 00:04:47,190
So remember, a key logger is a malicious type of software

145
00:04:47,190 --> 00:04:49,380
or hardware tool that can covertly record

146
00:04:49,380 --> 00:04:52,530
the keystrokes being made on a computer or mobile device.

147
00:04:52,530 --> 00:04:53,520
By understanding the risks

148
00:04:53,520 --> 00:04:55,620
and adopting comprehensive protection measures,

149
00:04:55,620 --> 00:04:58,380
both individuals and organizations can significantly reduce

150
00:04:58,380 --> 00:05:00,240
their vulnerability to these malicious tools

151
00:05:00,240 --> 00:05:02,550
that attempt to destroy the confidentiality of the data

152
00:05:02,550 --> 00:05:04,383
that we're typing into our systems.