32

I wanted to know if someone can log my keystrokes if i am on a virtual machine. Is it more secure to use a computer or a virtual machine on that computer.

user30102967
  • 447
  • 1
  • 4
  • 5
  • 2
    It might be a bit more secure if you're using a virtual keyboard inside the VM, but I wouldn't say there's a practical difference. Untrusted host can dump memory, take screenshots and do plenty of other things. – Dmitry Grigoryev Jan 05 '16 at 12:39

2 Answers2

37

RedGrittyBrick is right.

Here's how it would work:

  1. Keylogger is on host machine: even VM sessions will be keylogged.
  2. Keylogger is on virtual machine: only VM will be keylogged unless it escapes the VM.
  3. Keylogger is hardware-based: same as #1: everything can be captured, but this includes things even outside of the main operating system, as long as it's all going to the hardware. This means anything on your machine, including BIOS passwords, boot passwords, disk encryption, etc.
Mark Buffalo
  • 22,498
  • 8
  • 74
  • 91
32

A hardware keylogger will obviously capture anything typed on the keyboard it is attached to. So that includes keystrokes that are forwarded to a VM.

I would expect a software keylogger running on the host system should also capture anything typed on the local keyboard before it gets to any VM

A software keylogger running in a VM would capture keystrokes from the virtual keyboard presented by the host, so it would not capture keystrokes consumed by the host nor keystrokes forwarded to other VMs.

Keyloggers do not capture keystrokes generated remotely and transmitted to the computer hosting the keylogger by network protocols similar to SSH.

Whether host-end keyloggers can capture keystrokes from remote-desktop clients (e.g. RDP) presumably depends on details of the implementation of the remote desktop service and of the keylogger.

RedGrittyBrick
  • 1,355
  • 8
  • 14