I thought something about this in 1999, this can also be done in high volume beeps like in an ATM.
New acoustic attack steals data from keystrokes with 95% accuracy
121–130 of 239 posts
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#122Re: New acoustic attack steals data from keystrokes with 95% accuracy
#123We’re entering a post-privacy era jesus
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#124The example figure shows a key hit every half second, which suggests a pecking style of typing at around 24 wpm. This way the model gets very clean waveforms. I wonder how their approach would work with average or fast typists. The sound profiles might be much harder to link to characters.
Even if there was ambiguity, some data is better than none. Given enough training data, I suspect you could find repeatable patterns in standard typists: on a qwerty layout, after typing an "A", "Q" takes 1.2-2.3x as long to type as a "J" kind of pairwise tempo patterns. Anything to reduce the search space from brute-forcing every candidate character.
Even better if the target uses a passphrase, "hXXXse battXXX stXXXXX cXXXXXX" becomes interpretable given a few landmark letter identified with high probability.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#125Earlier quoted context omitted.
I guess more reason to just use a password manager to autofill your password?
Or just use 2fa
Now that I know about the existence of this generation of acoustic attacks I would like to have the possibility to insert a second "master password" different from the main one, that instead of letting me directly access to my passwords just allows me to use fingerprint to get them. Guess if it's already possible
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#126Would love a wireless keyboard that works using this! It wouldn’t need any battery, charging or syncing!
Imagine the UX of 1 in 20 characters typed being incorrectly inferred though. The P_failure*Cost impact would strike me as insufferable even if error rate were to improve by an order of magnitude.
I was thinking it could be a keyboard designed to make sounds special sounds so it can be interpreted very accurately
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#127Earlier quoted context omitted.
Not according to the article.. Microphones are sensitive enough to mount the attack on quieter keyboards.
What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.
Some old IBM keyboards (beamsprings, the predecessor to the Model F, which preceded the Model M) had solenoids inside to make them louder and sound more like typewriters. I wonder if such a setup would defeat this attack, or if it would still be possible to discern the actual keypress alongside the solenoid.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#128Earlier quoted context omitted.
What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.
Adding a gain knob to my keyboard, be right back.
My mechanical keyboard already has a knob that I've configured to control the system audio volume, all that's left is configuring Linux to play an audio recording of a keypress every time I press a key...
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#129So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all
Do keystrokes still come through Zoom? The noise filtering has become extremely aggressive lately, often hear people say “Sorry about that engine / ambulance / city noise” but nobody knows what they’re talking about.