Security is a major concern in many corporations, and in other situations, it can be a matter of national security. In the past, finding out what a user has done on the system could be a long task, costing many hours and money. Many have resolved to monitoring the user from remote sources (i.e. cameras, intercepting communications). But this is only a limiting reach. A software solution soon arose: a "key logger."

A key logger could record all keystrokes made by a user on a particular computer. The implementation, however, was a problem. Most of the time, the software could be detected, and finally disabled. Other cases found it difficult to even install the key logging software(password protected system, no rights, etc...). The next step in evolution: a hardware-based key logger.

Interface Security, Ltd., based in Christchurch, New Zealand, has developed a hardware based key logger. Using flash memory, and with capacities of up to 2 million keystrokes, the KeyGhost product is a very compact, and reasonably priced security product.

The model I received was the "KeyGhost II Standard," with a memory capacity of 97,000 keystrokes. Models are available that can record as many as 2,000,000 keystrokes, and use 128-bit encryption.

KeyGhost package.

KeyGhost is available from distributors in many countries, but I received mine directly from the good folks at Interface Security, in New Zealand. An overnight FedEx package arrived early morning. Upon opening, I discovered the KeyGhost II Standard, and the KeyGhost ML (Multi-lingual).

KeyGhost package contents.

The 20 page manual explains everything on how to implement the "EMC Balun"-style key logging device. Setup is simple, plug the PS/2 keyboard into one end of the KeyGhost, and the other end of the KeyGhost into the PS/2 port on the computer. That's it! No software to install, nothing for the computer user to detect.

KeyGhost II device (sorry, image is blurred for security reasons).

If the computer user is aware of something odd in plugged in that possibly was not there before, KeyGhost makes an alternative. A KeyGhost integrated into a keyboard. I did not get the chance to experience this, but they do integrate it into the Microsoft Natural Keyboard (just one of the keyboards available). Either way, as the "in-between" interface, or the hidden keyboard module, the KeyGhost does its job securely, and well.

One benefit of having the EMC shield type KeyGhost is that after it is done with it's duty, it can be taken elsewhere, and the data retrieved. The same computer does not have to be used as the KeyGhost is, in essence, independent of computers. It just happens to be recording what gets sent through it, on a flash chip, which requires no battery power to retain it's contents.

Our testing process began with simple tasks. Plug it in, and go about our everyday business, occasionally accessing the KeyGhost log file. This log can be played back into any text editor, and is accessed by typing in a certain combination of characters (a "password" for short). The default password is "vghostlog." Typing this within notepad reveals the KeyGhost menu.

The KeyGhost menu.

The Tests:

Test 1:
After having some fun with the KeyGhost, we began serious testing. Our first test involved trying to defeat the KeyGhost - without unplugging the device.

We were unable to defeat the KeyGhost's logging capability. We had tried everything, from random keystrokes, to methodically devised "keyboard confusion" tactics. Two hours of non-stop attempts resulted in us losing two hours of our life. Many of our testing tactics have usually caused other products to shatter, but this KeyGhost amazed us. It is truly a masterpiece.

Test 2:
Our second test involved speed (this was further divided into subsections). As this device does interface between the keyboard and PS/2 port, we wanted to see if this would result in a slowdown. In fifteen different tests, there was no reduction in input rate from the keyboard.
The next "speed" test involved the extraction rate. This can be adjusted on the device (in case of older systems, that cannot handle the rate that the KeyGhost plays back the recorded keys). We set the rate to the fastest, and filled the buffer with 16,256 keystrokes. The KeyGhost "Optimize Speed" menu allows setting a speed from 1 - 20000 (with 1 being fastest).

16,256 characters extraction:

Doing a simple division step (97,000 / 16,256) = 5.967, and multiplying that by the above extraction times, we see what the estimated extraction rate for a full 97,000 KeyGhost buffer would be:

As you can see, these rates aren't bad (for the fastest rate, at least). Most modern systems shouldn't need to be set to anything slower than "1," so all is well. However, if you opt for the higher keystroke models, or do need to extract at a slow rate, you are in luck. Interface Security makes a "Turbo Download Adapter." I did not get to test this device, but the device is a little "Y" adapter that plugs into a 9-pin serial/COM port and your PS/2 port. You then take the KeyGhost logger and plug it into the other side of the Turbo Download Adapter. Using free software (available on the KeyGhost website), it downloads the log "in seconds." There is one thing to note, however, the Turbo Download Adapter is NOT compatible with the Standard model (the one we reviewed), whether it be the external model, or the keyboard version. As you can see from the speed chart above, it really doesn't matter for the Standard version. However, if you had to extract 2,000,000 keystrokes, even at the fastest rate, it would take about 3.6 hours. ** ADDENDUM: 2001-08-30, we received our Turbo Download Adapter, and attempted to use it with the KeyGhost II Standard device. IT WORKS.

This temporarily concluded our speed testing process. In the case of all monitoring devices, the KeyGhost may be considered an invasion of privacy if not implemented correctly. The US Department of Justice recommends a banner/notice that expressly states that the system is monitored (the wording can be as needed). However, the KeyGhost has many more uses that just for security.

• Investigation tool


• Data backup tool


• Bad use deterrant


• Make sure kids use the computer properly

In a recent trial, a criminal was monitored by a tool similar to (if not) the KeyGhost. The device used was asked to be revealed by the defense, however, the government agency involved was able to avoid this because revelation of the device could pose as a threat to current cases. The KeyGhost, and similar products are NOT TOYS. They may be fun to play with, but they are serious products.

Another use of the KeyGhost is as a data backup tool. If the system is prone to crashes, documents that weren't saved can be recovered through the KeyGhost. Just play back the keystrokes. Having a KeyGhost installed also deters users from any activity that is deemed inappropriate (best when installed in workplaces or schools). At the house, parents can use the KeyGhost to recall what their young ones have been up to.

Test 3:
Test number three was installation time. This test is done on all products, even though it was not really required here. We had installation down to 5 seconds. A lot less time than software installs.

Test 4:
Our fourth test involved temperatures. We placed the KeyGhost in our freezer, and left it in for a little over an hour. The recorded temperature was -20C (-4 F). This is a fairly low temperature, and can cause damage to fragile electronic components. We ran this temperature test because a device such as the KeyGhost may be used on computers placed in low temperature environments. We decided against placing the KeyGhost in our storage freezer (temperatures reach -100C). After retrieving the KeyGhost, we hooked it directly into the keyboard, and plugged it into the computer. Excellent response. No keys were lost, and the input rate of the keyboard was unaffected. In fact, I am writing this paragraph with the frozen KeyGhost installed.

Test 5:
Our fifth test was to heat the KeyGhost, but we unanimously decided against that for reasons of practicality, and for fear that we could melt the tubing. We also realized that computers wouldn't be working in extreme heat such as the heat of a flame without protection. But, we do know it can work in cold temperatures. We would like to add that electronics should be protected when working in extreme temperatures, the tests we run are done under controlled situations, and are extreme to test the product. We don't want everyone running off and dropping their product in a freezer, or placing it in a microwave.

Summary and Conclusion:

Interface Security, based in New Zealand, has found a niche. Their products have many more uses than just matter of security. The KeyGhost has already been introduced to many countries, and is actively used. Before implementing the KeyGhost product, you should verify that its use will not be considered illegal.

MostlyCreativeWorkshop has decided to give this product our highest rating. The KeyGhost line of logging products can fit most people. The standard model (which I have attached to this computer), has done its job well above expectations. This review article was actually written in Microsoft Word 2002, and then we used the KeyGhost playback to retrieve the complete review - on a different computer. In the future, we hope to hear more good news from them on other products.

Jokingly, we wondered if we could use the KeyGhost as a form of data (binary) storage. We may figure out something - it wouldn't require drivers, but would be extremely slow. Another situation we saw was the use of a KeyGhost type product that isn't necessarily "covert," but it can playback keystrokes in a timed manner (example: setting up computers, or running diagnostics procedure - no user input necessary, just pre-record everything that needs to be done).

FINAL RATING: EXCELLENT!!! 10 / 10

Related links:
KeyGhost product comparison matrix (Web)
KeyGhost Turbo Download Adapter (Web)
KeyGhost Log file analyzer (Web)

KeyGhost is a trademark of Interface Security, Ltd. Other titles and names featured in this article are trademarks or registered trademarks of their respective owners.