Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New acoustic attack steals data from keystrokes with 95% accuracy

bleepingcomputer.com

Post reply on HN
Print view View original

91–100 of 239 posts

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#91

Post by [deleted] »

omgJustTest wrote: post #90
lispisok wrote: post #6

So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all

The answer is that likely all the above are used. Asking for “what signal it is detecting” might be better asked from a “what is the greatest signal bearing information” being used… which would help in averting attacks. This kind of stuff could be real menacing in all sorts of public places like airports, coffee shops and etc.

[deleted]

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#93

Post by 3np »

gleenn wrote: post #54
bee_rider wrote: post #49

Earlier quoted context omitted.

If you have 2FA and one part of it is easily figured out, then you have one factor authentication. If you cared enough about the authentication in the first place to bother with 2FA, then I guess it seems like the reduction there is still something to be worried about, right? Lots of “two factor authentication” schemes seem to involve just getting a text or something, so, not very secure at all. Of course, this is ba…

Perfect is the enemy of good. Text based 2FA is compromisable relatively easily but at least it's an extra hurdle.

It's the "or just" being the issue there, not the "use 2fa".

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#94

Post by mejutoco »

zaxomi wrote: post #82
mxwsn wrote: post #51

The example figure shows a key hit every half second, which suggests a pecking style of typing at around 24 wpm. This way the model gets very clean waveforms. I wonder how their approach would work with average or fast typists. The sound profiles might be much harder to link to characters.

Sovjet listened successfully to typewrites back in the 1970s.

Impressive. To be fair, a lot of typewriters jam if you press more than one key at a time, plus they are very loud.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#95

Post by amelius »

whoopdedo wrote: post #46

If this means the end of those loud mechanical keyboards then good. I never liked the clicking noise.

No it means the beginning of people playing recordings of loud mechanical keyboards all day to thwart the snooping algorithms.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#96

Post by foobiekr »

Tempest1981 wrote: post #5
tedunangst wrote: post #2

But what passwords are you typing while on zoom and why aren't you on mute?

When calling my cellular/internet/medical/financial provider, it might be interesting to "see" what they are typing. (Or if they're randomly surfing the internet.)

Given your username, you might find this interesting:

https://en.m.wikipedia.org/wiki/Tempest_(codename)

TEMPEST considered almost everything from electromagnetic leakage to exactly the attack described here.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#97

Post by zootboy »

bee_rider wrote: post #42
segfaultbuserr wrote: post #27

Earlier quoted context omitted.

Some places use touchscreen keypads for PIN entry exactly for this reason: to allow randomization, e.g. for opening a locked door, or for authorizing a transaction.

That is interesting. I’m sure it depends on the application to some extent. I can type my pin in without looking at all, so I can cover it up while doing it. If I had to hunt and peck, it’d easier for an onlooker to observe my slower motions I think. But if I used the same machine often enough to produce wear specific to me, this randomization would be really useful.

I use a randomized PIN pad on my phone, and I've gotten quite used to it. I can enter my PIN almost as fast as I could on an unscrambled pad; it's definitely not hunting and pecking.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#98

Post by belval »

apendleton wrote: post #80
jgtrosh wrote: post #68

Earlier quoted context omitted.

Only if it doesn't only rely on a master password

A nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.

95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd.

Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually.

"horswstaplevatterucorrect" for example is still intelligible.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#99

Post by TheCleric »

thereisnospork wrote: post #81
fatfingerd wrote: post #77

Earlier quoted context omitted.

Not according to the article.. Microphones are sensitive enough to mount the attack on quieter keyboards.

What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.

Adding a gain knob to my keyboard, be right back.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#100

Post by TheCleric »

belval wrote: post #98
apendleton wrote: post #80

Earlier quoted context omitted.

A nice thing about master passwords though is that since you don't have to type them in as often, they can be very long. 95% accuracy probably isn't good enough to reliably reproduce a sentence-length master password, at least if it's only captured once.

95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd. Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually. "horswstaplevatter…

On average 2-3 errors. However the real thing we want to look at is what is my chance of guessing right across ALL characters. For 1 it's 95%, for 2 it's 90.2%, and it gets worse from there. The formula for accuracy would be .95^c where c is the number of characters in the password. So the chance of getting EVERY key correct in a 40 character password is < 13% and < 5% for 60 characters.
Post reply on HN