Didier Stevens

I did some tests with a Keelog keylogger, the AirDrive Forensic Keylogger: I wanted to find out how much power that keylogger requires.

This is my test setup:

1. This is the USB keyboard
2. The USB cable of the keyboard is plugged into the USB breakout board
3. This is the USB breakout board, allowing me to measure the voltage and current of the USB power lines
4. This is specialized multimeter that can measure power (by measuring voltage and current simultaneously)
5. The USB cable of the USB breakout board is plugged into a USB extension cable that is plugged into a computer

In this standby state, with all its LEDs turned of, the keyboard consumes 11 mW.

That’s not much power. Compare this with the Numlock LED turned on, and we have 4 times as much: 47 mW:

And here I have the keylogger plugged in (between the keyboard and the USB breakout board):

Now the total power measured is 383 mW: that’s for the keyboard (with LEDs turned off) and the keylogger.

That’s a huge difference with 11 mW for a keyboard without keylogger.

If this keylogger would be hidden into the keyboard, it would be easily detected using this measurement method, because this particular keyboard requires 30+ times less power than the keylogger itself.