SECURWARE 2012 - The Sixth International Conference on Emerging Security Information, Systems and Technologies - A QTE-based Solution to Keylogger Attacks

Sep 4, 2026

Upload by Mia

Keystroke logging enables password theft and remains a widespread threat. This paper proposes a QTE (Quick Time Events) method to protect the password a user enters for web-login services, without relying on existing malware detection or trusted kernel tunnels. QTE uses a canvas-based cue to inform users when inputs will be recorded or ignored, allowing meaningless characters to be inserted to obscure keyloggers. The approach works across websites without modification and supports deployment with limited privileges.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages6

Reading Time15 min

AccessFree to download

Introduction

Keylogger threat and limitations of existing defenses

QTE method overview and contributions

Related Work and System Design

Principles for valid and invalid time intervals

Canvas cues and obfuscation mechanism

Implementation and Evaluation

Implementation details

Experiments against multiple keyloggers

Performance and attacker time estimation

SECURWARE 2012 : The Sixth International Conference on Emerging Security Information, Systems and Technologies A QTE-based Solution to Keylogger Attacks Chien-Wei Hung􀀃 , Fu-hau Hsu􀀃 , Shih-Jen Cheny , Chang-Kuo Tso􀀃 , Yan-Ling Hwangz , Po-Ching Linx and Li-Pin Hsu{ 􀀃 Dept. of Comput. Sci. & Inform. Eng., National Central University, Zhongli City, Taiwan (R.O.C.) [Email: winestwinest@gmail.com](Email: winestwinest@gmail.com); [hsufh@csie.ncu.edu.tw](hsufh@csie.ncu.edu.tw); [cktso@csie.ncu.edu.tw](cktso@csie.ncu.edu.tw)[ ](cktso@csie.ncu.edu.tw)y Institute for Information Industry, Taipei City, Taiwan (R.O.C.) [Email: jchen@iii.org.tw](Email: jchen@iii.org.tw) z Dept. of Applied Foreign Languages, Chung Shan Medical University, Taichung City, Taiwan (R.O.C.) Email: [yanling@csmu.edu.tw](yanling@csmu.edu.tw) x Dept. of Comput. and Inform. Sci., National Chung Cheng University, Chiayi County, Taiwan (R.O.C.) [Email: pclin@cs.ccu.edu.tw](Email: pclin@cs.ccu.edu.tw) { Dept. of Applied Inform. Sci., Chung Shan Medical University, Taichung City, Taiwan (R.O.C.) [Email: apple@csmu.edu.tw](Email: apple@csmu.edu.tw) Abstract—Nowadays keystroke logging is one of the most widespread threats used for password theft. In this paper, rather than detecting existing malware or creating a trusted tunnel in the kernel, we present a different method QTE (Quick Time Events) to protect the password that a user provides fora web page to login to a web service. Installing such solutions in a host only requires limited privileges of related computers. The QTE method utilizes a canvas to cue users when their input will be recorded or ignored by the QTE add-on, which provides a chance for users to obfuscate keyloggers by inserting meaningless letters among the keystrokes of their passwords. QTE can be applied to all websites without any modi􀀂cation of them. Keywords-Authentication, computer security, keylogger, privacy. I. INTRODUCTION Keystroke logging is a behavior of recording keystrokes, and a program with this property is called a keylogger. Typically, keyloggers sniff users’ input, such as bank accounts or passwords, behind the scenes and upload the logs to attackers. Since keyloggers are easy to implement and produce high pro􀀂t, about half of malware includes a keylogger in their code according to a Symantec’s report [1] . In 2005, more than eight hackers were accused of planning to steal over 423 million dollars from a Japanese bank by installing keyloggers in her systems [2], which highlights the potential danger of keystroke logging. In spite of many related works proposed various promising methods to defend keyloggers, they are less feasible in practice owing to the prerequisite of having root privileges ora dependable device. Besides, even though some companies like Google and Facebook provide the one-time password mechanism, it is only available for their services rather than all websites. Furthermore, in order to use their mechanism, one must reveal her/his personal data, such as a phone number, to each service provider and therefore sacri􀀂cesher/his privacy right indeed. To make matters worse, in last year, some reports [1][3] found that about 12% of leaked data were revealed by insiders and 96% of leaked information are personal data. With the popularization of computers and Internet, it is very common for users to log in online banks or e-mail services using public computers. However, it is challenging to design a secure system in a public computer since common users only have limited privileges, and various persons can use the computer without being monitored. Therefore, an appropriate solution for keyloggers in this scenario must be able to be able to be actively executed by users without special privileges and applied to all websites. To meet the prerequisites, we propose the QTE method for users to defend their systems against keyloggers. The QTE method provides a secure environment for users to in

FAQs

What problem does the paper address?

The paper addresses keystroke logging used to steal passwords during web login, especially in environments where users lack special privileges.

How does QTE protect a user's password?

QTE records keystrokes only during valid time intervals and uses animation cues to indicate when inputs will be recorded or ignored, letting users obfuscate captured keystrokes.

Can QTE be used on websites without modifications?

Yes. The paper states the QTE method can be applied to all websites without modifying them or relying on pre-set passwords.

Sep 4, 2026

Upload by Mia