Editing Keystroke logging (section)

== Cracking ==
Writing simple software applications for keylogging can be trivial, and like any nefarious computer program, can be distributed as a [[Trojan horse (computing)|trojan horse]] or as part of a [[Computer virus|virus]]. What is not trivial for an attacker, however, is installing a covert keystroke logger without getting caught and downloading data that has been logged without being traced. An attacker that manually connects to a host machine to download logged keystrokes risks being traced. A trojan that sends keylogged data to a fixed e-mail address or [[IP address]] risks exposing the attacker.

=== Trojans ===
Researchers Adam Young and Moti Yung discussed several methods of sending keystroke logging. They presented a deniable password snatching attack in which the keystroke logging trojan is installed using a virus or [[Computer worm|worm]]. An attacker who is caught with the virus or worm can claim to be a victim. The [[cryptotrojan]] asymmetrically encrypts the pilfered login/password pairs using the [[public key]] of the trojan author and covertly broadcasts the resulting [[ciphertext]]. They mentioned that the ciphertext can be [[steganography|steganographically]] encoded and posted to a public bulletin board such as [[Usenet]].<ref name="auto">{{cite book |last1=Young |first1=Adam |last2=Yung |first2=Moti |title=Proceedings. 1997 IEEE Symposium on Security and Privacy (Cat. No.97CB36097) |chapter=Deniable password snatching: On the possibility of evasive electronic espionage |year=1997 |pages=224–235 |doi=10.1109/SECPRI.1997.601339 |isbn=978-0-8186-7828-8 |s2cid=14768587 }}</ref><ref>{{cite book |last1=Young |first1=Adam |last2=Yung |first2=Moti |title=Proceedings 1996 IEEE Symposium on Security and Privacy |chapter=Cryptovirology: Extortion-based security threats and countermeasures |year=1996 |pages=129–140 |doi=10.1109/SECPRI.1996.502676 |isbn=978-0-8186-7417-4 |citeseerx=10.1.1.44.9122 |s2cid=12179472 }}</ref>

=== Use by police ===
In 2000, the [[Federal Bureau of Investigation|FBI]] used FlashCrest iSpy to obtain the [[Pretty Good Privacy|PGP]] [[passphrase]] of [[Nicodemo Scarfo, Jr.]], son of mob boss [[Nicodemo Scarfo]].<ref>{{cite web|url=https://www.theregister.co.uk/2000/12/06/mafia_trial_to_test_fbi/|title=Mafia trial to test FBI spying tactics: Keystroke logging used to spy on mob suspect using PGP|date=2000-12-06|access-date=2009-04-19|website=The Register|author=John Leyden}}</ref>
Also in 2000, the FBI lured two suspected Russian [[cybercriminal]]s to the US in an elaborate ruse, and captured their usernames and passwords with a keylogger that was covertly installed on a machine that they used to access their computers in [[Russia]]. The FBI then used these credentials to gain access to the suspects' computers in Russia to obtain evidence to prosecute them.<ref>{{cite web|url=https://www.theregister.co.uk/2002/08/16/russians_accuse_fbi_agent/|title=Russians accuse FBI Agent of Hacking|website=The Register|date=2002-08-16|author=John Leyden}}</ref>