Does Unix/Linux have any security features against key loggers?

Question

I believe every Unix/Linux user wants his/her own computer free from key loggers. And I believe this cannot be done without some kind of OS-level support. The idea is that keypresses are only sent to the process who is actively accepting user input, and users should be aware of the process identity. Does Unix/Linux already have such (or other kinds of) security features against key loggers?

Answer 1

This question is based on two false premises.

One false premise is that keyloggers are a particularly common or egregious type of malware. They aren't: snooping keyboard input is neither easier than snooping other things (private files, passwords and cookies stored by browsers, browsing history, etc.) nor particularly useful (why read what the user is typing and puzzle out how it's dispatched to applications, instead of reading all the neatly stored files with explicit names?). The only point of using a keylogger is if it's an actual physical device that sits between the keys and the computer. Some malware gets called “keylogger” because of tradition, but in fact it's just malware that snoops and reports. The upshot is that there's no reason to focus on keyloggers over other malware — it would be like looking up while crossing in case a plane falls on you: better watch left and right for cars instead.

The other false premise is that “keypresses are only sent to the process who is actively accepting user input”. This assumes a very simplistic view of system design. Several processes are involved in getting input to an application. You might classify them as “system” processes: there's typically the X server, and the window manager, and the terminal emulator if the application is a text mode one. But that list is extensible: you can run any application that reacts to a hot key, you can run your own keyboard macro application such as Autokey or Xbindkeys, you can run a session-recording application, etc. Wayland, a proposed replacement for the traditional X11 window interface, aims to create a path from input to applications, but this isn't quite mature yet as the Wayland design doesn't accommodate for applications that require permanent access to input.

If you want to protect against malware, ensuring that it doesn't read keyboard input is the least of your worries. Ensuring that it doesn't read your files is a bigger concern. The only real solution is do not run malware on your account. And the primary way to do that is to only install software you trust. In particular, stick to software that comes from a well-known distribution. That doesn't guarantee that it's free of malware, but it does mean that the software is more likely to have had at least some scrutiny, and at least if malware is discovered you're likely to find out.

If you need to run untrusted software, run it in a virtual machine. The inconvenience that it's then isolated from your main environment (e.g., you should disable clipboard integration) matches the additional security that you're getting.

Answer 2

security-tools for Linux is rkhunter. It investigate your present data with MD5hashes. Search for hidden folder and files invested by known rootkits and malware. It checks also if commands are modified. It also tests network interfaces for listening applications. Here is the Manpage from the command. Another scanner is chrootkit

It is a good Idea to run this tools from a Live-Session (DVD/USB). So you can be sure that the tools are not infected itself.

The best way to keep your system clear, is to install programms from official sources, and system-encryption I think.