Method to obfuscate keyboard keys against interception
Systems and methods for obfuscating keyboard keys against interception are provided. In an example, a protected application is dynamically virtualized in user space, wherein the virtualization comprises an isolated keyboard path. Keystrokes are injected to the isolated keyboard path, wherein the injected keystrokes are associated with a respective timestamp, and user input keystrokes are obfuscated with the injected keystrokes and the obfuscated keystrokes are passed to a low level hook. The obfuscated keystrokes passed to the low level hook are separated according to tags associated with the obfuscated keystrokes to obtain the user input keystrokes. The user input keystrokes are transmitted to a target window of the protected application.
1. A system, comprising:
at least one processor; and
at least one memory storing instructions thereon that, when executed by the at least one processor, cause the at least one processor to:
dynamically virtualize a protected application in user space, wherein the virtualization comprises an isolated keyboard path;
inject keystrokes to the isolated keyboard path, wherein the injected keystrokes are associated with a respective timestamp;
obfuscate user input keystrokes with the injected keystrokes, wherein the obfuscated keystrokes are passed to a low level hook;
separate the obfuscated keystrokes passed to the low level hook according to tags associated with the obfuscated keystrokes to obtain the user input keystrokes; and
transmit the user input keystrokes to a target window of the protected application.
2. The system of claim 1 , wherein the protected application is dynamically virtualized without privileged kernel drivers.
3. The system of claim 1 , wherein the protected application is dynamically virtualized by generating a custom micro-container to support execution of the application.
4. The system of claim 1 , wherein the instructions cause the at least one processor to:
convert user input keystrokes and injected keystrokes to keyboard events;
obfuscate the keyboard events; and
transmit the keyboard events to the low level hook.
5. The system of claim 1 , wherein the instructions cause the at least one processor to compare the tags to a user key list, and extract keys that correspond to tags found in the user key list to separate the obfuscated keystrokes.
6. The system of claim 1 , wherein virtualization is achieved using micro-containers implemented through user space application programming interface implementation.
7. The system of claim 1 , wherein virtualization is achieved using micro-containers implemented through user space binary translation and emulation.
8. A method, comprising:
dynamically virtualizing, using at least one processor, a protected application in user space, wherein the virtualization comprises an isolated keyboard path;
injecting, using at the least one processor, keystrokes to the isolated keyboard path, wherein the injected keystrokes are associated with a respective timestamp;
obfuscating, using at the least one processor, user input keystrokes with the injected keystrokes, wherein the obfuscated keystrokes are passed to a low level hook;
separating, using at the least one processor, the obfuscated keystrokes passed to the low level hook according to tags associated with the obfuscated keystrokes to obtain the user input keystrokes; and
transmitting, using at the least one processor, the user input keystrokes to a target window of the protected application.
9. The method of claim 8 , wherein the protected application is dynamically virtualized without privileged kernel drivers.
10. The method of claim 8 , wherein the protected application is dynamically virtualized by generating a custom micro-container to support execution of the application.
11. The method of claim 8 , comprising:
converting user input keystrokes and injected keystrokes to keyboard events;
obfuscating the keyboard events; and
transmitting the keyboard events to the low level hook.
12. The method of claim 8 , wherein the instructions cause the at least one processor to compare the tags to a user key list, and extract keys that correspond to tags found in the user key list to separate the obfuscated keystrokes.
13. The method of claim 8 , wherein virtualization is achieved using micro-containers implemented through user space application programming interface implementation.
14. The method of claim 8 , wherein virtualization is achieved using micro-containers implemented through user space binary translation and emulation.
15. At least one non-transitory storage media storing instructions that, when executed by at least one processor, cause the at least one processor to:
dynamically virtualize a protected application in user space, wherein the virtualization comprises an isolated keyboard path;
inject keystrokes to the isolated keyboard path, wherein the injected keystrokes are associated with a respective timestamp;
obfuscate user input keystrokes with the injected keystrokes, wherein the obfuscated keystrokes are passed to a low level hook;
separate the obfuscated keystrokes passed to the low level hook according to tags associated with the obfuscated keystrokes to obtain the user input keystrokes; and
transmit the user input keystrokes to a target window of the protected application.
16. The non-transitory storage media of claim 15 , wherein the protected application is dynamically virtualized without privileged kernel drivers.
17. The non-transitory storage media of claim 15 , wherein the protected application is dynamically virtualized by generating a custom micro-container to support execution of the application.
18. The non-transitory storage media of claim 15 , comprising:
converting user input keystrokes and injected keystrokes to keyboard events;
obfuscating the keyboard events; and
transmitting the keyboard events to the low level hook.
19. The non-transitory storage media of claim 15 , wherein the instructions cause the at least one processor to compare the tags to a user key list, and extract keys that correspond to tags found in the user key list to separate the obfuscated keystrokes.
20. The non-transitory storage media of claim 15 , wherein virtualization is achieved using micro-containers implemented through user space application programming interface implementation.