seb/keylogger-detector
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' of github.com:sebaschi/keylogger-detector

Browse Source
This commit is contained in:
Sebastian Lenzlinger 2023-05-14 15:22:12 +02:00
commit b60a2bfa7e
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
doc/dev_journal.md
View File

@ -69,4 +69,13 @@ It seems after restart kernel modules must be reinserted (even though spy was in
1. Test some more user space keyloggers and see if it is truly basicallly always very easy to detect them.
2. Figrue out how to detect kernel module kerlogger w/o just scanning for suspiciously named logfiles.
## Sunday, 14.05.23
### Sebastian
Talked to Dr. Eleliemy. Now have the following plan for the project:
Two parts: One User Space detector that can more or less aggressivly kill uknown processes reading from I/O files. Should be configurable how aggressive it treats found loggers. From Just informing the user to auto SIGINT KILL, for instance. The Second part of thew Software checks kernel modules and probably just notifies user. There should be some db where we have Kernel Modules known to use I/O, so kind of a list of "Trusted I/O Drivers/Modules".
#### Next Step:
1. Learn how kernel modules read I/O and how it is detectable.
2. Start coding the user space detector part of the software.