Hardware Keyloggers plug in between a computer keyboard and a computer and log all keyboard activity on an internal memory.They are designed to work with PS/2 keyboards, and more recentlywith USB keyboards.Hardware keyloggers have an advantage over software keyloggersas they begin logging from the moment a computer is turned on (and are therefore able to collect a BIOS password for instance), and do not require software installation (unlike software solutions).
Step 1: How Do They Work?
All hardware keyloggers have to have the following: * A microcontroller - this interprets the datastream between the keyboardand computer, processes it, and passes it to the non-volatile memory * A non-volatile memory device, such as Flash - this stores the recorded data, even when power is lost
The recorded data is retrieved by typing a special password into a computer text editor and then hitting "Enter". As the hardware keylogger is plugged in-between the keyboard and computer, it detects the password has been typed and then starts presenting the computer with "typed" data to produce a menu. Beyond text menu some keyloggers offer a high-speed download to speed up retrieval of stored data, this can be via USB mass-storage enumeration or with a USB or serial download adapter.
Hardware keyloggers are usually black in colour and measure about 5cm in length. They are slightly thicker than the average cigarette. They commonly have storage capacity ranging from 64K to 4MB. A 256K model can record about 128 pages of text. Hardware keyloggers also come in USB models, although these are considerably more expensive.
Step 2: Hardware Keylogger (Keyshark) in Action
1. Make sure the Keylogger has been set up correctly, i.e. you have set the password and have put it in "Recording Mode".
2. Unplug the victim keyboard
3. Plug the keyboard into the keylogger
4. Plug the combined keylogger and keyboard into the PC PS/2 slot
5. Pray no one sees it
Once the keylogger is plugged in, it will begin recording all keystrokes, even ones entered before the PC is in windows or whatever OS you use.
Step 3: Accessing the Data
From the menu, you can change your default password, access the recorded data, erase the memory, enable or disable recording and adjust the menu speed.
You can access the stored data by pressing 1. The menu continues, and asks which sector of the keylogger you wish to access. Pressing w will make the keylogger 'type out' all the recorded data into the notepad file. Watch the video to get a better idea of how this works.