|
|
|
|
|
KEYKatcher 32K Keyboard Logger |
|
Join the community - in the OCAU Forums!
|
Usage Continued, Conclusions
You can search for specific strings, view the entire contents of memory, or use the NETPatrol function. This is simply a preprogrammed search for "http", ".com", ".net" or "www.". NETPatrol or normal search results are returned with a strip of text on either side to give you some context, but it is a little cumbersome to navigate if you have stored huge amounts of text. The 32KB model I received for review can apparently fit 16 typed pages into its memory. Of course, if you dump the entire contents into a wordprocessor, you can search using the search function of that wordprocessor and see the terms you're looking for in their full context.
Here's an example log of me chatting in IRC, then browsing the web, searching in google, then opening wordpad to access the menu. The "rwordpad" line is me hitting ctrl-esc (which isn't logged), r (for run) then typing "wordpad" in the run box.
The <BS> markers show where I hit the BackSpace key - note that the text I was backspacing over remains in the log. Note that the KEYKatcher menu would normally appear before and after the log dump, but I've removed it for clarity.
It does takes a little while to get your head around the fact that this menu, any results from searching the memory and so on, are coming from the keyboard port. You can't kick off a search and go do things in other windows, returning to view the results in notepad at your leisure. The results aren't coming from notepad, they're coming from the keyboard port as if you typed them. If this happens while you're working in another application, the effect can be quite bewildering, as seemingly-random selections are made, programs are opened etc, in response to the flurry of keystrokes coming, as far as the PC can tell, from the keyboard. It's a good idea to make sure you have logged out of the KeyKatch's menu before you change to another window. Because, again, anything you type will be interpreted by the KeyKatch as a menu selection, even if you're no longer in notepad. It seems to default to either redrawing the menu or logging out if you select an invalid menu option, which again can be confusing if you're not in a harmless text editor. Oddly enough, pressing Ctrl-PrtScr while you're in the KEYKatcher menu results in the page being cleared, before the screenshot is taken. Logging out before taking the screenshot lets it proceed normally.
Note that you can't use the KEYKatcher as a macro recorder, to play back a sequence of actions you have performed on the PC. The menu system would make this cumbersome and interfere with playback. There are better software-based solutions for that task.
Limitations:
There are some weaknesses in this kind of device, of course. Remember, it is only monitoring the keyboard port. If little Timmy is browsing porn sites purely via bookmarks in his browser, KeyKatch won't notice. But bookmarks are easy enough to find on a PC if you're looking, and we assume new sites will be accessed by typing their URL in the browser address bar or typing search terms into a search engine. The KEYKatcher will of course quietly log those keystrokes. If little Betty is arranging to meet up with an internet stranger, you will only see her side of the conversation - which may not contain words you search for. Also bear in mind that a particularly determined person could use another keyboard - either temporarily replacing the KEYKatcher-heatshrinked PS/2 one or plugging in a USB one at the same time. You could even use the Windows Keyboard program to "type" out dodgy URLs with the mouse.
Finally, the KEYKatcher doesn't seem to compress the text it stores in any way, so you could presumably "erase" it by holding down a key until 32,000 or so keystrokes have been logged, filling the memory and pushing the sensitive data off the "top" of the buffer. The only way to avoid this is to stop recording when the buffer is full, and not record over stored information - but then the workaround is to hold the key down and flood the buffer before you type things you want to not be logged. I'm not sure which way the KEYKatcher behaves - and even if I knew I wouldn't tell you. Of course, a logfile that has been flooded in this manner is a pretty clear indicator that something is afoot, even if it doesn't give you the specifics.
Realistically though, if it gets to the point where you are actively conducting a "battle" to monitor someone who goes to such lengths to conceal their behaviour, then you need to take it to the next level. Password-protecting the entire PC, blocking content at the network level or more extreme measures may be required.
Other Notes:
One thing the KEYKatcher doesn't do is take the functionality a step further and actually censor the words being typed instead of just logging them. If you typed a word commonly found in porn-site names it could be replaced with a string of asterisks, for example, preventing the browser from accessing it. However, in reality this would be unworkable because common, useful words like, "hot", "teen" and "action" would have to be blocked. So I don't think this is a feature that will be missed from the KEYKatcher.
Nefarious uses for this kind of device could include snooping credit-card details, passwords or other sensitive information. Like any technology, it can be abused. It's my understanding that there are well-established laws governing this kind of behaviour.
One final and unexpected use for this device is as a backup. Everything you type on the PC is stored in the KEYKatcher, so if you lost an important email or document halfway through writing it, perhaps due to a system hang or power failure, you could very probably retrieve your work from the KEYKatcher's memory.
Conclusions:
This is quite a neat little gadget. In some ways I find it disconcerting that devices such as this exist. But then, I don't have kids or employees. If you do, and if you're concerned about what they might be getting up to on your PC, the KEYKatcher is a simple and effective way to keep an eye on things.
The KEYKatcher 32K as reviewed here is available from KEYKatcher.com.au for AUD $149. There are also 64KB and 128KB versions available.
|
|
Advertisement:
All original content copyright James Rolfe.
All rights reserved. No reproduction allowed without written permission.
Interested in advertising on OCAU? Contact us for info.
|
|
