GIAC GSNA Exam - Topic 4 Question 4 Discussion

Magic Lantern works both as an encryption-cracking tool and as a keylogger.

Answer C is incorrect. Alchemy Remote Executor is a system management tool that allows Network Administrators to execute programs

on remote network computers without leaving their workplace. From the hacker's point of view, it can be useful for installing keyloggers,

spyware, Trojans, Windows rootkits and such. One necessary condition for using the Alchemy Remote Executor is that the user/attacker must

have the administrative passwords of the remote computers on which the malware is to be installed.

Answer B is incorrect. The KeyGhost keylogger is a hardware keylogger that is used to log all keystrokes on a computer. It is a tiny

device that clips onto the keyboard cable. Once the KeyGhost keylogger is attached to the computer, it quietly logs every key pressed on the

keyboard into its own internal Flash memory (just as with smart cards). When the log becomes full, it overwrites the oldest keystrokes with

the newest ones.

Answer D is incorrect. SocketShield provides a protection shield to a computer system against malware, viruses, spyware, and various

types of keyloggers. SocketShield provides protection at the following two levels:

1.Blocking: In this level, SocketShield uses a list of IP addresses that are known as purveyor of exploits. All http requests for any page in

these domains are simply blocked.

2.Shielding: In this level, SocketShield blocks all the current and past IP addresses that are the cause of unauthorized access.