How to check for keyloggers on your computer

What happens on your keyboard does not stay on your keyboard. 

Using an employer-issued computer comes with its own specific set of privacy risks. The struggle to avoid even accidentally clicking on NSFW material as we go about our busy office lives is, for many, all too familiar. And yet, the true threat often lurks undetected behind the scenes: keyloggers recording your every keystroke and sending them away for upper management review.

If you’re not very familiar with keyloggers, don’t fret, many people aren’t. That’s kind of the point. A keylogger is a generic term for piece of software that runs in the background of a computer and literally records every single key you press, often along with every mouse click you make. In the aggregate, they can record everything from the content of the emails you write, to your passwords, to any personal chats you have in a corporate Slack or private social media account accessed from your work desk. 

Keyloggers are a particularly invasive type of corporate monitoring software designed to keep tabs on employees’ actions, but are far from the only kind. PCMag (which, like Mashable, is owned by Ziff Davis), published a review of this type of software earlier this year. Of the ten “employee monitoring tools“ examined, seven offer “keystroke recording,” and nine allow the employer to take screenshots of a worker’s computer screen. 

“Once an incognito agent is installed on a machine (sometimes hidden in the Running Processes list under disguised names), the most powerful employee monitoring tools can act as an all-seeing eye,” notes the product review. “It can see into everything from what apps an employee has open to with whom they’re chatting to, what they’re saying.” 

For anyone who has ever checked a personal email, bank account balance, or the results of a medical test on a work computer, the above described scenario is a nightmare. 

Your rights

While your boss monitoring your every move is definitely creepy, it’s perfectly legal. According to the head of the National Workrights Institute, Lewis Maltby, you shouldn’t expect privacy on work devices. 

“Employees have virtually no right to privacy on employer-provided computers,” explained Maltby over email. “Even highly personal communications that would be protected if they took place over the telephone are not protected if an employer computer is involved.”

And it’s not just what you do on a work computer, warns Maltby, but what you do in front of it that should concern you. 

“Even worse, employers can remotely turn on the webcam while the laptop is in the employee’s home,” he added. 

Thankfully, however, that doesn’t mean you’re totally at the mercy of an invasive manager or corporate overlord. 

Turning the tables 

The first step, of course, is determining if your computer is in fact being monitored. This is tricky. According to EFF Cybersecurity Director Eva Galperin, a combined digital and physical inspection technique is required. 

“You can use most antivirus products to detect software keyloggers, but there are also keyloggers that plug right into the keyboard,” explained Galperin over email. “For those, it’s best to just familiarize yourself with what the products look like so that you recognize them.”

While this is great advice — especially if you’re worried about an abusive partner installing a keylogger on your personal computer — if your company installed such a program on your work device there’s a good chance the corporate-installed antivirus won’t pick it up. 

That doesn’t mean you’re on your own, however. 

Noted security researcher and founder of Objective-See, Patrick Wardle, explained that there are several methods to check for keyloggers on Macs. And, he insisted, you really should. 

“I think it’s definitely something users should be concerned of — as both malware, or (shady?) IT departments could install such software,” he explained over Twitter direct message. 

Wardle noted that there are two straightforward approaches concerned individuals can take. 

“[People] can check the System Preferences — as certain classes of keyloggers have to be given/approved ‘accessibility access’ in order to capture keystrokes,” he wrote. 

Under “System Preferences” on a Mac, go to “Security & Privacy” and select “Accessibility.” If you see any weird programs that you don’t recognize, you should take the time to investigate them (and maybe deny said programs access to control of your computer). 

“Of course,” cautioned Wardle, “legit apps can show up here too … for example the virtualization software I use.”

Wardle’s second suggested detection method involves a little more legwork on your part but also requires less guesswork. Specifically, that would be “a free open-source keylogger detector for macOS” that he created.  

So, what to do if you discover a work-installed keylogger on your computer? Assuming your IT department put it there, your best bet is to never again use your work computer for anything personal. Like, ever. 

Be aware that everything you type, as well as screenshots of your monitor, could one day end up printed out and placed in front of you during a contentious meeting with HR — or in the personal collection of an unscrupulous IT head. 

“Employers take [work laptops] back when an employee quits or is fired,” explained National Workrights Institute head Maltby, “and IT techs frequently look at everything that’s on them, including sensitive personal matters.”

So when you’re at the office and the need arises for personal communication, stick to your personal smartphone. When at home, use your own computer and leave that work laptop in the drawer. And, if you’re fortunate enough to be in a position to do so, consider getting a job where you’re not spied on 24/7.