Earlier quoted context omitted.
What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.
Or auto-mute upon key press.
Or just use a password manager.
New acoustic attack steals data from keystrokes with 95% accuracy
131–140 of 239 posts
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#132Similar to the unique heartbeat each of us have, the way people type may be another fingerprinting method. When I type passwords and PINs, I often make motions to keys that I'm not hitting to fool the invisible stalker behind me.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#133Re: New acoustic attack steals data from keystrokes with 95% accuracy
#134This is hardly a new concept btw. In 2005 ACM's CCS Zhuang, Zhou and Tygar presented Keyboard Acoustic Emanations Revisited [1] We examine the problem of keyboard acoustic emanations. We present a novel attack taking as input a 10-minute sound recording of a user typing English text using a keyboard, and then recovering up to 96% of typed characters. There is no need for a labeled training recording. Moreover the rec…
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#135Earlier quoted context omitted.
Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...
Not according to the article.. Microphones are sensitive enough to mount the attack on quieter keyboards.
Microphones are surprisingly sensitive. I can listen to music in my closed-back headset at a regular volume. My desk mic can pick this up. Without boosting the audio it's barely audible that there's music, but after adding some gain you get almost the full song profile (and background noise).
I can even pick out some of my breathing from the recording.
If I turn on noise suppression and noise gate it's fine.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#136I heard about stuff like this years ago, and how the CIA could get passwords by pointing long distance microphones at people's windows.
I suspected that the famously terrible Treasury Direct website with its on-screen keyboard was a half-assed attempt to prevent this sort of attack.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#137Earlier quoted context omitted.
95% means that on average only 1 in 20 keystroke will be wrong. Even if your password is very long (40-60) that means only 2-3 errors. Since more people are not machines their long password will be a combination of words like the famous "horsestaplebatterycorrect" example from xkcd. Even if you flip a few letters from something like the above a human attacker will easily be able to fix it manually. "horswstaplevatter…
On average 2-3 errors. However the real thing we want to look at is what is my chance of guessing right across ALL characters. For 1 it's 95%, for 2 it's 90.2%, and it gets worse from there. The formula for accuracy would be .95^c where c is the number of characters in the password. So the chance of getting EVERY key correct in a 40 character password is < 13% and < 5% for 60 characters.
What if the password is typed twice? You can easely figure it out then.
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#138So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all
I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…
seems like a very niche case to be warranting the headline and Hackernews front page
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#139I'm not clear why people are poo-pooing this as if it's not a big deal. From a security and espionage point of view this is pretty significant - the audio learning has got to the point that a sensitive audio bug can bascially be key logger. There are a ton of context where an audio tap would be much easier to get in place than a traditional network attack (and with modern shotgun mics, might not even require being in…
you would need to tie microphone input with the actual keys typed, and enough of it to train a model. nothingburger
Re: New acoustic attack steals data from keystrokes with 95% accuracy
#140Earlier quoted context omitted.
What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.
Some old IBM keyboards (beamsprings, the predecessor to the Model F, which preceded the Model M) had solenoids inside to make them louder and sound more like typewriters. I wonder if such a setup would defeat this attack, or if it would still be possible to discern the actual keypress alongside the solenoid.
I'm guessing it would be easier (assuming you trained it on that keyboard), because each solenoid would be fairly unique due to manufacturing tolerances. Just my gut feeling, I have no data to back it up.