Keylogger và cách phòng chống

HỌC VIỆN CÔNG NGHỆ BƯU CHÍNH VIỄN THÔNG
Khoa Quốc Tế và Đào Tạo Sau Đại Học

AN NINH MẠNG
Đ$ T%I : Keylogger và cách phòng chống


 !"
 #$%
& ''$()*
+,-./012')3)(')
Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-
M'C L'C

 !"
#$%$
%&'()
*+%,-.
/01234552/.
) 61234552/7
8,-9:;<=%,<>7
?@A?B234552/7
)CDE!FGDHC37
.CDFI?5J
*KL>8MN<=%,<>J
*O?5J
)/C?1234552/P
.?51234552/Q
M%;#R,S

Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-

LỜI NÓI ĐẦU
45672248@/A12;/?-6+B,C9D1EFBG-9+H07:/I:J12EKEF:L;EM18DC
1/-FNN51/-O1.9G-PQ2-RC>1212+5:+121/-FN9FP=6ST12;/U1BFB:V:/W:
1>12@45672248EST:CN126O1BX12.:J121/SPQ;/YH-M1:ZR1/[12C/-MCH\;/U1
:W12BG-/]C8T@^C/NLC@45672248.9_1:V1/-FN12S`-Pabc12B05CI1/C8dC/+1/
1X11/e1:ZR9-f:BDCC8,BC/A12C-1:01/e1.Eg:H-fC6+NP481RB49+;RPPh78b
i:EUN456726+W12bc12EST:CX78R9G-Bc:EI:/6+2-i;:0:HL:;/c
/N51/2-0BP0C:714BBj1/@/-Pabc12B05CI1/.C/47bk-/7XCE,121/e19-O1CX-
:C5.1/S129G-CI1/1>12:ZR1V:0:/R:@48EKPGBCL1bc129+ESR9+76+B;/U1
BFB2-01E-f;2-i;/R:@48E01/:l;BLC@/mN.C/A12C-1:01/e1
L5@456726+2jn*R1EUN45672.@456722486+:/So12C8j1/2/-6X-:0:C/R7
C0:C8O1H+1;/IB.:/N,C-f11R5:0:67X-@45672248:VC/p/-f1EX-/o18DC1/-FN
V6+6SN6X-/7XCE,12:ZR:?:71:/N,C.:/c;6X-?1/B+1/j1/+C-1/9-/o11[R6+
@45672248@/A12:/q6SN6X B+:<1CQE,122a-:0:C/A12C-1EK6SN6X-:/7:/Z1/e1
:ZRBj1/C/47C/`-2-R1/R5:/ME,EgCPr1stuvNR4BR-6/7g:N;67Rbw-64sxu
,-bN12:ZRH+-C-pN6NL1:ZR1/VB4BbSG-Ee5y-1EST:C8j1/H+59D1EF9F
@456722489+:0:/  ;/<12:/=12 /VB4B  y-1C8e1  C/+1/:?Bo1 PGS.TSKH
Hoàng Đăng Hải EK/SG12b_11/VB4BC/Q:/-f1EFC+-1+5z
)
Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-
I. PHÂN LOẠI
-f11R545672248EST::/-R6+B/R-67X B,C67X-@45672248;/U1:W12s/R8b
@45672248u9+B,C67X-6+;/U1BFBsP7wC@45672248u
1. Hard keylogger
R8b@456722486+1/[12C/-MCH\;/U1:W12EST::0:/K12P?1yNDC9+:N12
:D;C8O1C/\C8S`12/-MCH\@45672248:VC/pdbX12{)/R5*.9G-@I:/C/SG:
CSo12ESo129G-B,C*w6RP/:/|12/X1.C/-MCH\/i122}B:V/R-EUN1= C8712
EV.B,CEUNb~12Ep1=-C8Q:C-M;9+7B05CI1/.EUN:<16X-1=-9G-H+1;/IB
<1:V1/[12C/-MCH\C-1/9-/o1.EST:2l19+712R5HO1C8712H+1;/IB:ZR
B05CI1/EpH+1G-H+1;/IB:ZR:0:6R;C7;:J12:V@/?1>12H\2l1C/-MCH\

@45672248
27+-8R.h-8464PP@45672248:V6•6+67X-C/-MCH\EST:Pabc121/-FNVEV12
9R-C8<1/SC/-MCH\;/0CPV12@/A12be5/-EV.@€yeB1/L;P•@MC1=-9+7C/-MCH\
1+5C/A12vNRPV12@/A12be59G-:0:C/A12C-1:DN/j1/B+/•EK6L;

.
Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-
2. Soft keylogger
/U1BF145672248:VC/pEST:;/e167X-C/47BW:E,12N5/-pB1/NPRN
7X-P='@4567224867X-Hj1/C/S`12‚:/X5:A12@/R :VC/A12H07:/712S`-
H\C/47bk Ei129G-Bc:EI:/2-0BP0C
7X-P=)@4567224812N5/-pB‚:/X512UB./SG12EM1Bc:EI:/b7C/0B
1/-FN/o16+2-0BP0Cs12N5/X-EM1:0:C/A12C-1:01/e11/S6+C+-@/7?1:01/e1.
BLC@/mN.C/€CI1bc129j12S`-b~12@/A12H-MCu
7X-P=ƒ@4567224867X-8DC12N5/-pB‚m1bDN/7+1C7+1C/47bk-C8O1B,C
;/XB9-8,12.Bc:EI:/b7C/0B8k8+12
7X-P=„@4567224812N5/-pB12/-OBC8•12.C/S`12EST:BR12C/47Hd-:0:
C87…R139-8NP:Q:@†@/VC/072‡.6+67X-@4567224812N5/-pB1/DC/I1/9j9L5s9+
:J12b7E}12C/`-6+ˆE}12H•1‰:ZRC87…R139-8NPu1VC/S`12/R5H\:0::/So12C8j1/
:/=129-8NPCjBC/D59+C-ONb-fC
II. CÁCH HOẠT ĐỘNG CỦA KEYLOGGER
1. Thành phần của Keylogger
/A12C/S`12.B,C:/So12C8j1/@45672248P•2}B:VHR;/U1:/I1/
3 /So12C8j1/E-FN@/-p1s71C8768728RBub~12EpC/47E-FN;/=-/7XC
E,12.C-1/:/q1/:0:C/-MC6L;.y4B:0:CL;C-11/LC@Š:/745672248/U1
1+56+;/U1EST:2-DN@^1/DC:ZR@45672248.C/A12C/S`12:/q:VC/p2•-
8RH‹12B,CCY/T;;/IBClCEgCH-fC
3 L;C-1/77@./7g:6+B,C:/So12C8j1/B71-C78b~12Ep2/-1/L16X-:0:
C/R7C0:H+1;/IB.:R;CN84P:8441sEe56+;/U1vNR1C8•121/DCu
3 L;C-11/LC@Šs672u.1o-:/WREQ12{2/-6X-C7+1H,1/[122j/77@2/-1/L1

EST:
27+-8R.C~5C/4767X-:VC/p:VC/OB;/U1:/So12C8j1/H?79fs2NR8b.;87C4:Cu.
:/So12C8j1/C/A12H07s84;78Cut
2. Cách thức cài đặt vào máy
=-9G-67X-/R8b@45672248:/i12:U1;/?-EST:@MC1=-C8Q:C-M;9G-B05CI1/
H‹121/-FN/j1/C/W:@MC1=-C/A12vNR…R:@:lBH+1;/IB.@MC1=-12UBC8712H+1
7
Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-
;/IB.@MC1=-9G-B05CI1/C/A12vNR:Y12NPH1/S:0:C/-MCH\@/A12be5s:/N,CH+1
;/IB@/A12be5.NPHh-w-u
=-9G-:0:67X-P7wC@45672248
0:67X-@45672248CŒ'3ƒC/A12C/S`12@/-:+-EgC9+7B05:J122-=121/S
B•-:/So12C8j1/B05CI1/@/0:.EFN;/?-vNRHSG::+-EgCUNC-O11VP•:+-EgC:0:
CL;C-1b~12Ep/7XCE,129+7B,CC/SBc:Eg:H-fCs8DC;/W:CX;u.PRNEVE>12@Š
:0:/C/W:/7XCE,128}-ET-12S`-b~12C/-MC6L;C/OB:0:W12bc12RNEV1VHlCEUN
/7XCE,12
7X-@45672248P=„:VC/p9+7C/|12B05:ZR12S`-b~12H•vNRHSG::+-EgC.
b~12CI1/1>12RNC78N1Ep:~12:/X59G-/fC/=12,CP=67X-CQC/?sb87;uBj1/9+7
:0::/So12C8j1/@/0:.Ep@/-12S`-b~12Pabc12:0::/So12C8j1/1+5@45672248P•
CQE,12:/X5C/47
3. Cách hoạt động
8712B,C/fC/=12sŽ-1b7hP.-1Ny.R:tu.@/-HDB';/IBC8O1H+1;/IB.
H+1;/IBP•:/N5p11VC/+1/CI1//-fN:/N5p19+7P•:/N5p11VCG-/f
E-FN/+1/Ep/fE-FN/+1/b\:/C/+1/:/[/7g:P=:/7:/I1/1V/7g::0::/So12C8j1/
@/0:Pabc12/S12@/-C8712/fC/=12EV:V@45672248.@/A121/[12:/q:V/fE-FN
/+1/C/47bk-B+:?/77@w-64{B71-C78;8728RB:ZR@45672248C/47bk-1VP•2/-1/L1
9+b\:/6X-:0:CI1//-fN2/-9+7CL;C-11/LC@Š}12C/`-1V:<1:VC/pC/47bk-:?
B+1/j1/9+C/R7C0::/N,C
=-9G-B,CP=67X-/R8b@45672248.:/i12:VC/pEST:6SNC8Q:C-M;:0:C/A12
C-1EST:12/-1/L16X-C8O1:/I1/C/-MCH\EV./7g:EST:2a-C/A12vNRBX12@/A12

be5.:Vbe5CG-:0:E\R:/qEKEST::DN/j1/Pr1C8O1:0:C/-MCH\EV
T@UVVWWW3DX2HVWDYZ2D/2[@432/\2HX20020][^_%1`QH=<
T@UVVWWW3DX2HVWDYZ2D/2[@432/\2HX20020][abQ!c#b<
III. PHÒNG, TRÁNH V% CHỐNG KEYLOGGER
1. Phòng
45672248C/S`12H\9+7B05vNR/R-:71ES`12:/I1/EST::+-EgC/7g:H\
:+-EgC
J
Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-
a. Phòng ngừa “được cài đặt”
0:/C=C1/DC6+@/A12:/7R-Pabc12:/N12B05CI1/*?7BLCB05H‹12
:0:/@/VR6X-H‹12:0::/So12C8j1/H?79f./7g:BLC@/mN@/-E-EeNEVMN;/?-
b~12:/N121O1C/-MC6L;vN5F1:ZR12S`-b~12:/N12EVC/LCC/D;s2N4PCE=-9G-
Ž-1b7hP•.NP48E=-9G--1NyuEp@-pBP70C9-f::+-EgC:/So12C8j1/:ZR/•
b. Phòng ngừa “bị cài đặt”
*\:+-EgC6+:0:/Ep1V-EM1:0:C8S`12/T;@456722489+7B05@/A12b7:/I1/
H?1C/e1:+ 6l;/7g:ESR9+7C8O1B05EVB+b7C87…R1.9-8NP.P;5hR84:+-EgC9+7
B051X11/e1B+1X11/e1@/A12/F/R5H-MC0:H-f1;/0;;/<1212ŒR
3 /S`12yN5O1@-pBC8R:0:C/-MCH\;/U1:W12EST::lB9+7B05CI1/B,C:0:/
HDCC/S`12
3 /A12C~5C-f1Bd:0:CL;C-16X.@/A128k12N}12=:sEg:H-fC:/iŠ:0:CL;
C-1:VENA-•4y4.•:7B.•HRC.•P:8.•Phw.•‘-;.•8R8.•…P.•2-wtu=C1/DC
6+1O1yVRE /7g:@-pBC8RsP:R1uH‹12B,C:/So12C8j1/R1C-9-8NP9+B,C
:/So12C8j1/R1C-P;5hR84.9j1/-FN:/So12C8j1/R1C-9-8NP:/q:VC/pCjBC/D5
9-8NP.@/A12C/p1/L1H-MCP;5hR84
3 /A129+7:0:C8R12h4H6X.Eg:H-fC6+h4HE419j:VC/p:0:C8R12h4H1+5m1
:/WRB,C67X-h78B.9-8NP./7g:6+BKE,:1+7EV:VC/peBC/UB:+-EgC
3 /A12:6-:@9+7:0:ES`126-1@6Xb7R-EV:/7HX1
3 /A12:+-EgC:0::/So12C8j1/6Xs9j1V:VC/p:/WR9-8NP.C87…R1u
3 /A12b7h167Rb:/So12C8j1/CŒ:0:12N}1@/A12C-1:L5MNHX1:VC/p.

y4By’C:/[@ŠE-f1Ca.Ep:/l::/l1:/So12C8j1/@/A12H\PaREY-
3 X1:/Mb7h167Rb9+Pabc12:8R:@4b3;8728RB
3 NA16NA1CQH?79fBj1/H‹12:0::/So12C8j1/:/N5O1b~12:/=129-8NP.
:/=12P;5hR84sR1C-9-8NP.R1C-P;5hR84u9+bQ12CS`126aRsw-84hR66u@/-dC8712
1C4814C
3 /S`12yN5O1:L;1/LCEU5EZ:0:H?1:L;1/LCH?7BLC:ZR/fE-FN/+1/
3 7g::/i12CR:VC/pb7h167RbB,CP=;/U1BFB:/=12@456729FEpH?79f
2. Tránh keylogger
/-12/-12`1V:V@45672248B+@/A12:VE-FN@-f1@-pBC8R
a. Diệt tập tin hook, chương trình theo dõi
abc12B,C :/So12 C8j1/CRP@BR1R248s:V C/p 2•- 8R H‹12 CY /T;  ;/IB
ClCCtrl+Alt+DelC8O1 Ž-1b7hPu y4B  :0:  :/So12  C8j1/ ER12 :/X5 MN HX1 C/D5
;87:4PP1+76XsEg:H-fCE=-9G-Ž-1b7hP•6+:0:CL;C-1EST::/X5bSG-P481RB4
@/A12;/?-6+5PC4Bu:/SRC/D5HR72-`/K5ClCs41b.@-66u1VE-SNŠ.:0:/1+5:V
P
Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-
C/p6+BC847/fC/=121MNEV6+B,CCL;C-1:U1:/71V‚9j9L512S`-b~12:U1:V@-1/
12/-fB
b. Che mắt keylogger
45672248  /7XC  E,12  C8O1  12N5O1  Cl:theo dõi bàn phímsB71-C78-12
@45H7R8bu:/q:V8DCIC:V@/?1>12C/47bk-:/N,Csb~:VC/47bk-EST::J12@/A12
:/I1/y0:6lBu9+:V@/?1>12:R;CN84:6-;H7R8bj9L5b~/fC/=12:V@45672248sC8Œ
:0:@45672248:V@/?1>12vNR5;/-Bu:VC/pEST:9STCvNRH‹12:0:/
3 abc12On-Screen KeyboardsH+1;/IBC8O1B+1/j1/usC8712h-1b7hP2•-
8RH‹12CR8C{N1{7P@uEp1/L;:0:/b[6-fN1/X5:?BsBLC@/mN.C/€CI1bc12u
H‹12:0:/:6-:@:/N,CjEe56+:0:/1/L;6-fN1‹B127+-9~12C/47bk-:ZR
:0:CL;C-1/77@s9j@/A12vNRH+1;/IBu1O1@45672248P•@/A122/-1/L1
EST:C/A12C-12j0:/1+5b“b~121/S1212S`-@/0::VC/pC8A12C/D5C/A12
C-1EST:1/L;9+7sC-M126V12C/S`12b~126+E0;RPPuCŒEVHX1BDC;RPPh78b
3 abc12Copy and Pastes:/’;9+b01uCjBB,CE7X19>1H?11+7EV:V:0:CŒ

1‹BC8712E7X1C/A12C-1BN=12-DNs9IbcBLC@/mN6+;RPPh78bHX1/K5CjB
B,CE7X19>1:V:0:CŒ;.R.P.h.7.8.bs9IbcC7bR5PR/7CbR5.;4C48w446
HRb/4hR1CR:776b8-1@78R-:43:84RBu:7;5CŒ12:/[B,C9+b011VC/+1/
:/[;RPPh78b8}-2a-E-0:/1+5:VSNE-pB6+b“b~121/S12@/08l:8=-9+
@’B/-fNvN?1/DCHd-9j1/-FN@45672248:V:/W:1>12C/47bk-:6-;H7R8b
3 abc12type and ClicksHDB9+ 1/D1u9jH?1C/e1B,C@45672248C/A12
C/S`12@/A12C/pC/47bk-:0:HDB:/N,CIbcBN=1E01/B,CE7X1C/A12C-1
6+;RPPh78b.EUNC-O1/K5E01/B,CP=CŒ:VC87121V;P88}-Pabc12:/N,C
s@/A12b~12H+1;/IBu:/4112R129+7;9+PE01/:/[R2-[RP9+8E01/:/[
Ph7PRN86+:/[b<12C/A12C-11/L;9+7;RPPh78b1/S12C8712CL;C-11/LC
@Š672@456722482/-6X-EST:6+;P8RPh7b0:/1+5@/0/R51/S12@/A12;/~
/T;9G-:0:C/A12C-1b+-9jb“2e5vNO1
3. Chống keylogger
=-9G-:0:C/-MCH\/R8b@45672248.:/q:U1C/078`-:/i128R@/•-B05CI1/
:/i12CR:VEK:VC/p9A/-fN/VREST:1V.1/S129G-:0:P7wC@456722489-f::/=12
6X-1VP•@/0;/W:CX;E=-9G-:0:67X-@4567224867X-ƒ.„
a. Cách phát hiện
G-B,CP=67X-P7wC@45672248C/A12C/S`12P•Pabc12B,CCL;C-1•b66Eg:
C/~8-O12Ep:R;CN84:0:C/R7C0:9G-B05CI1/p;/0C/-f1B05:VH\:+-@45672248
/R5@/A12:/i12CR:/q:U1@-pBC8Ry4B:0:CL;C-1•b66:VyNDC/-f1C8712B05
@/A12IbcE=-9G-48w4:C456722481+5C/jPabc12CL;C-1H;@/@b66.”RP5Pa
bc12”@45b66
Q
Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-
b. Phương pháp đơn giản
/R1//-fNvN?1/DC6+b-fCC8ŒC7+1H,:0::/So12C8j1/ER12C/47bk-H+1
;/IBE-,CP=:/So12C8j1/1/S6+45672248-6648:ZR7CC7vN’C:0:;87:4PPCjB
:0::/So12C8j1/C/47bk-:~126i:vN01/-FNW12bc12sCjB:0:CL;C-1•b66:ZR
@45672248u8}-EF12/\HX1ClC1VE-/M1/S12B,CP=:/So12C8j1/C=Cs1/S:0:
:/So12C8j1/2-i;2kH+1;/IB1-@45.-4C@45u:J12b~12:0:/1+51O1:VC/p2e5

b-fC6UB
c. Phương pháp nâng cao
abc12B,C:/So12C8j1/:/=12P;5hR84:/N5O1b~120::/So12C8j1/1+5
P•CQE,12vN’C.;/e1CI:/:0::/So12C8j1/ER12:/X5:J121/SC8O1B05EpCŒEV
1/L1H-MC:0::/So12C8j1/@456722489+CQE,12b-fC,CP=:/So12C8j1/:<1:V:/M
E,  H?7  9f  C/`-  2-R1  C/Q:  s4R63-B4  87C4:C-71u  2-i;  H?7  9f  HX1  :/=12  12R5
@/-P;5hR84:/Nm1H\:+-9+7B05
8712B,CP=C8S`12/T;.12S`-b~12:/•1:0:/:/=1245672248C/47:0:/
•P=12:/N129G-6J•D59Ibc9F45P:8RBH6486+B,CC8712P=1/[12;/U1BFBH?7
9fB05CI1/C/47;/So12;/0;1+5•-b[6-fN9F;/IBHDBEST:C8N5F1EM1fE-FN
/+1/9+EST:45P:8RBH648BK/VRC8SG:sb7@45P:8RBH648C0:E,12C8Q:C-M;CŒ;/U1
6k-41146u.PRNEVBG-EM1:0:;/U1BFB@/0:sHR72}B:?@45672248u9+:N=-:~12
EST:2-?-BK6X-:/7Ei129G-:0:;/IBEST:2k/So12;/0;1+5:VC/p9A/-fN/VR
ERP=:0:67X-@45672248/-f1CX @/A125ON:UN12S`-b~12:L;1/LC:0:C8j1/R1C-3
@45672248C/S`12yN5O1N51/-O1.1V:J12:V1/[12E-pB5MN8-O12MN@45672248
EST:9-MCEp2/-6X-:0:;/IBPRN@/-:/i12EST:2-?-BKs9Ibc:+-@456722481/S6+
B,CRbb71:ZRC8j1/bN5fCuC/jy4B1/SEK9A/-fN/VREST:@45P:8RBH648.9+1V
:J12:/q/]C8TB,CP=;/U1BFB1/DCE\1//-b~12:/N129G-:0:;/U1BFB2k
C-M12-fC.12S`-b~12P•;/?-ClC45:8RBH64E Ee56+B,CPQ;/-F1;/W:6G1b~1V
B-1/:/W12:/7@/?1>12H?7BLC:ZR;/U1BFB1+5
a
Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-
IV. T%I LIỆU THAM KHẢO
8712@/-C/Q:/-f1EFC+-1/VB4B:VPabc12B,CP=C+-6-fNC/RB@/?76+
' *+-9-MCC8O1b-“1E+1C-1/•:hhhbbC/:7B{ .
) *+-9-MCC8O1b-“1b+1forum.cuasotinhoc.vn/
ƒ *+-9-MCC8O1C8R12/CC;{{hhhC/712C-1:71212/4:7B
„ *+-9-MCC841C8R12/CC;{{P7/7R914y;84PP14C
S
Đề tài: 456722489+:0:/;/<12:/=12 Giáo viên : 7+12>21?-

c