American computers are being watched

Workplace Surveillance: Tips on Detection and Countermeasures

The suspicion arises again and again: The boss seems to know details about the way his employees work, which he shouldn't actually know about. Suddenly he was talking about games at work, private e-mail, extended work breaks - are the PCs perhaps being monitored with spy software?

In fact, such cases have already become known. Monitoring one's own employees is only permitted in absolute exceptional cases, and then not permanently. But as an employee, you should know what monitoring is possible today and, of course, how you can discover such tools and protect yourself from being spied on.

Orwell says hello: That is what surveillance programs offer

There is a whole genre of software for monitoring workstations. These programs are closely related to remote control software such as the Remote Desktop included in Windows or the free VNC. However, the manufacturers have adapted and further refined them for the specific purpose. While the tools mentioned make themselves noticeable with an icon in the systray, the professional monitoring tools are invisible. Special antispy software is often able to expose these programs and in some cases even to remove them. In many companies, however, this is opposed by the assignment of rights to the workstations, which forbids users to install software. So what exactly do these programs do? The range of functions is considerable and includes, for example, the following:

  • Screenshots taken at regular intervals
  • Logs of the addresses of the websites visited and the respective length of stay
  • Chronological keylogger protocols with automatic alarm for defined keywords
  • Logs about the usage time of the programs called
  • Keyword recognition with alarm function for e-mails
  • Screenshots of social media usage, all emails sent and received, and chat messages
  • Monitoring of entries in search engines, changes to the folder structure, connected USB sticks and drives, computer usage by time and the clipboard

According to the company, ProtectCom is the German market leader for surveillance software. It produces the Orvell Monitoring and Winston Monitoring programs for PC monitoring, the latter software being particularly suitable for remote control and sending its reports by e-mail. Ordered separately, both programs cost around 60 euros each. In addition, there is the mSpy software with a reduced range of functions, for which ProtectCom advertises that it helps parents to "fulfill their parental responsibility". The PC version costs 5.25 euros a month or 63 euros for a year. The competition is small. The manufacturers of eBlaster or Spector have merged with ProtectCom, the programs have been withdrawn from the market. A number of other applications such as ActMon, Boss Everywhere, 007-Star, ISpyNow, Spy Agent, Sigint, Silent Watch or WinWhatWhere have not been officially marketed or further developed for years. What remained are the American products Retina X and Spytech NetVisor.

The software DarkComet is notorious as a surveillance tool that is also used by many criminals. It is sold as a remote control program, but with functions for monitoring built-in webcams and microphones as well as a keylogger for tapping keystrokes, it also has typical malware characteristics. Another popular software of this type is ImminentMonitor, which can be easily adapted to the respective requirements via plugins. It should also not be forgotten that in companies with their own e-mail server, central file storage or workstation backup, it is easy for the administrator to view all of a user's data without the user noticing.

How to track down the espionage tools

Since the spyware, like most other tools of this type, installs a keylogger, most antivirus programs will detect and block it. However, the administrator can define exceptions in the anti-virus software to prevent this. The user then has the option of checking for viruses himself with the help of a live CD, which boots the computer with a Linux system. However, this method again fails with espionage programs that are only loaded via the network when the computer is started.

A number of special antispyware tools can be found in the freeware directories on the web, but they are primarily aimed at criminal malware and aggressive ad trackers. However, they also track down keyloggers and hidden processes and are therefore suitable for a spyware check. The best-known representatives are called Ad-Aware, Spyware Terminator or Spybot - Search and Destroy. The latter is available as a portable version, so the employee can use it if the admin does not allow installations on the PC.

However, on devices on which it is generally not possible to run third-party software, the person concerned has little chance of tracking down a monitoring program. If there are any suspicions, he should contact the works council. In general, espionage software does not install itself either. If you regularly install the latest updates on your private computer, use an antivirus program and exercise caution when visiting suspicious websites and opening e-mail attachments, you are relatively safe from monitoring tools.

Surveillance tools for camera, audio and keyboard

One of the nastiest ways to spy on a user is by using a keylogger. In software form, it records the keystrokes and either saves them on the hard drive or sends them to another user via LAN or the Internet. Some of these programs also react to keywords and only record when a certain term has been typed. Examples of this type of software are the free Home Keylogger and Wolfeye Keylogger. Both are detected by antivirus software.

Hardware keyloggers, usually in the form of a small USB stick, which are placed between the keyboard and the PC, are an alternative. They record the keystrokes in their internal memory or send them over the network or by radio. Regular checking of the keyboard connection helps here. Software and hardware keyloggers can be tricked by using a virtual or screen keyboard, such as that offered by Windows in the settings for easier operation.

Attention: The use of keyloggers without the knowledge of the person concerned is illegal in Germany, companies must also obtain the consent of the works council.

A popular point of attack for criminals and snoops of all kinds is the webcam or notebook camera. Corresponding software such as iSpy, Yawcam, Sighthound or My Webcam Broadcaster is often available free of charge in the basic version, but extended functions such as a live stream of images to a network or Internet server are reserved for the full versions that are subject to a charge. The tools are very easy to discover - provided the administrator does not have access to the control panel and thus the list of installed programs. Home users and small offices can use the tools to monitor offices and other rooms, for example, because they can be set to react to movement.

Reading tip:Wikileaks reveals CIA hacks for Android, iOS, and more

Although often ridiculed and interpreted as a sign of paranoia, masking the notebook camera is an effective antidote. Otherwise it is possible to deactivate the camera via the Windows device manager. Anti-virus tools can also track down the monitoring software, provided no relevant exceptions have been defined. The same software that monitors the camera is often also suitable for making audio recordings via the built-in microphone. There is also a mechanical remedy for this: Take an old pair of earphones that you no longer need and insert the jack plug into the audio socket of the notebook. In this way, the built-in microphone is shut down. Then cut the cable and just use the plug.