Zoom is good at filtering out rather loud background noises. I can't imagine that the sound of background typing during a conversation could be detected by the other party.
New acoustic attack steals data from keystrokes with 95% accuracy
11–20 of 239 posts
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#12Earlier quoted context omitted.
When calling my cellular/internet/medical/financial provider, it might be interesting to "see" what they are typing. (Or if they're randomly surfing the internet.)
Call support, get the URLs and logins for all their internal apps. Ouch!
Presumably all their backoffice stuff is only accessible via VPN. Oh, wait...
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#13Timing attacks have been attack vector for a while? I remember reading a tool on HN a couple years ago about it. You don’t even need audio, the rate of which you enter the keys into the password field is enough.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#14I don't use the qwerty layout, I use colemak. Likely this mitigates this for myself.
At least it would have, until just now, when you recklessly disclosed your secret keyboard layout. :P
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#15I don't use the qwerty layout, I use colemak. Likely this mitigates this for myself.
Couldn't they just translate the detected keystrokes to colemak layout?
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#16I don't use the qwerty layout, I use colemak. Likely this mitigates this for myself.
This specific attack could also be easily mitigated by dictating your passwords instead.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#17So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all
I think this linited attack surface can work without having to generalize one model to multiple people or keyboards. One advantage of a Zoom attack is that you get “plaintext” shortly after hearing the “ciphertext” if you can get the target to type into the chat window. And when you hear typing in other contexts it’s likely to be something that matches a handful of grammars that an LLM can recognize already (written languages, programming languages, commands, calculation inputs) - and when it doesn’t, that’s probably a password.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#18I don't use the qwerty layout, I use colemak. Likely this mitigates this for myself.
This is just security through obscurity. For real security, you need a cryptographically rolling keyboard layout.
Brilliant suggestion. Have a TRNG or a CSPRNG (if too poor for a TRNG) choose the next layout at random for you, ideally with every keystroke. Good luck cracking that!
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#19Time to inject background audio of me typing "fuck you" into my zoom calls.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#20Timing attacks have been attack vector for a while? I remember reading a tool on HN a couple years ago about it. You don’t even need audio, the rate of which you enter the keys into the password field is enough.
How do you get the rate?