Introduction

Data theft is one of the biggest security problems many enterprises face today. Companies have lost millions of dollars due to internal employees leaking valuable corporate information to various 3rd parties or competitors. Companies are fighting back to combat these situations with a multitude of surveillance techniques to keep track of what employees are up to. This is where KeyGhost comes into the picture. KeyGhost is a manufacture of hardware keyloggers designed to covertly monitor each and every keystroke made on the target machine.

Keyloggers in general can be a security nightmare for companies and physical hardware keyloggers top this list since unlike software keyloggers they won’t be detected by monitoring software and very hard to identify unless you’re very observant. Hardware keyloggers will capture pretty much anything that is typed on your keyboard, so it has the potential of capturing your PC login details, Bank account logins if you login to your bank account through the PC, emails typed, and confidential documents. Basically you type it, the keylogger will capture it. In the wrong hands a keylogger can be quite detrimental to an organization/person.

However from an organization’s perspective these devices can be used for security investigations if you suspect an employee of any wrong doing. (Please note we’re not going to get into a whole legal debate on the use of this device and you will need to seek legal advice before deploying such a device to monitor any person.) These hardware keyloggers can be used as evidence gatherers and probably could be used in a court.

Having said that, today we look at KeyGhost’s newest introduction; the TimeDate KeyGhost USB/HUB Keylogger with 2MB of memory. Looking at the KeyGhost USB/HUB Keylogger the main concern anyone will have is its size. One would call it slightly on the bulky side for a device that’s supposed to portray stealth and be discreet. Nevertheless it’s still not a problem for the untrained eye and once it’s installed on the back of the PC its doubtful people would suspect check the back of their desks for a device like this.

Specifications:

     *  The TimeDate KeyGhost USB/HUB Keylogger 2MB is available in a 30cm (pic above) form factor and is compatible with Mac and PC systems.

    * The TimeDate KeyGhost USB/HUB Keyloggers have a different operating-mode to the KeyGhost USB Keyloggers. As far as the operating system is concerned, plugging in a USB/HUB KeyGhost is similar to plugging in a Generic USB 1.1 HUB.

    * KeyGhost USB/HUB Keyloggers have a built-in HUB which allows for the unit to be installed both upstream and downstream from internal and external USB HUBS to record all keystrokes typed on any number of keyboards that are connected.

    * KeyGhost USB/HUB Keyloggers allow passthough of all USB traffic from all attached USB devices, including digital cameras, thumbdrives, printers, scanners making it a better choice in situations where the keylogger needs to be attached to a keyboard that has an internal USB hub, or where the keyboard uses proprietary device drivers (e.g. some wireless keyboard/mouse combos).

    * TimeDate KeyGhost USB/HUB Keylogger features patent pending dual-mode time and date stamping on all keystrokes, essential for evidence collection.

    * KeyGhost USB/HUB Keyloggers are compatible with all PC and Mac operating systems that run on a PC or Mac. I.E. They are compatible with Windows 98SE, ME, NT, XP, 2000, Vista, Linux, DOS, OS/2, Mac OS X Tiger, etc.

    * The KeyGhost USB Keylogger uses the generic USB HUB device drivers built into all operating systems that support Generic USB HUBs.

    * The KeyGhost USB/HUB keylogger devices will record keystrokes typed on 1.0 / 1.1 / 2.0 USB keyboards running at both low speed (1.1Mbps) and (higher-speed) full speed (12Mbps).

    * KeyGhost USB/HUB Keylogger will also work with Wireless keyboards when attached between the receiver and the PC or HUB.

    * All KeyGhost devices are firmware upgradable.

The actual installation of the KeyGhost USB/HUB Keylogger is extremely straight forward. It’s simply a matter of connecting the male side of the USB connector on the Keylogger to the target PC and connect either a USB HUB or keyboard to the other end of it. The device is recongnised fast and if you have already setup the device on another machine before installing on the target PC you'll be done in no more than 30 seconds.

Now lets see how you setup the Keylogger before final deployment.

Once the installation is complete a default password typed on any word processor or windows notebook will bring up the following menu.

The first thing we did was to change the speed at which the KeyGhost USB/HUB Keylogger types in the characters on screen. Option 7 in the menu allows you to do this. The speed setting goes from 1-10 with 1 being the slowest. If you’re using the KeyGhost USB/HUB Keylogger on an old PC then you’ll have to keep it in a low setting for stability. However newer machines can handle higher speeds and we set ours to 7.

When using the KeyGhost USB/HUB Keylogger menu you need to make sure you do not change the window you’re on until the menu is exited. Otherwise it’ll try to write the information onto whatever window that’s open resulting in undesired operation.

Changing the default password is a matter of selecting option 6 and following the prompts. You will need to select a unique password that you’re unlikely to type when using a word processor and also avoid using passwords you commonly use elsewhere. If you do, it’ll result in KeyGhost Keylogger trying to write the menu data into a username or password box you’re on. If by any chance you forget the password you change to, the unit will have to return the unit to KeyGhost for reprogramming. This is a free service offered by the company; however it’s your responsibility to post the unit to them.

Going onto option 8 – stealth settings; you’re offered with 3 options namely Low, Medium and High. By default the KeyGhost Keylogger is on the low stealth setting (Faster Menu Access). You can use the Keylogger at this setting to get accustomed with the menus of the KeyGhost USB/HUB but its hardware profile will be detectable.

Under the Medium –USB HUB only setting (Ghost keyboard only enumerates when required) the real keyboard and the USB HUB for the KeyGhost are shown in the device manager.

Selecting High – Auto Sensing setting (USB Hub and Ghost keyboard only enumerate when required) makes the KeyGhost USB/Hub is invisible and will not be detected by any software scanner.

Option 9 on the main menu allows you to select the date/time as well as changing the time stamping internal, and session timeout internal as well. These settings can be changed by you depending on the requirement.