New acoustic attack steals data from keystrokes with 95% accuracy • Hacker News Board

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#151

Post by kristopolous » Sun, Aug 06, 2023, 4:12 AM UTC

jgtrosh wrote: post #68

yowzadave wrote: post #36

Earlier quoted context omitted.

I guess more reason to just use a password manager to autofill your password?

Only if it doesn't only rely on a master password

[insert yubikey plug]

I don't use one but I know people who swear by them.

Also this is an extremely obvious result. Typing is obviously a form of "penmanship", it was well known that telegraph operators could identify each other by how they tapped out Morse code in the 1800s.

People have been able to do this based upon key stroke latency and even identify people based on habitual mouse patterns for decades.

Audio recordings work as yet another reliable proxy? Shocked!!

I am amazed that people can do such obvious things and get published, have articles written on them... I need to get in on that, sounds easy

I can make a web demo. You turn on the microphone type a couple things into a box on the web browser.

Then you go to a different window and continue typing and then the model predicts What you are typing. As long as it's proper grammar you can get to effectively 100% accuracy. It'll appear to be spooky magic.

I just might take the time.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#152

Post by user3939382 » Sun, Aug 06, 2023, 4:27 AM UTC

There’s an app somewhere that removes your keyboard audio from your audio streams. Sounds like it is a vulnerability remediation.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#153

Post by sandworm101 » Sun, Aug 06, 2023, 4:33 AM UTC

Encrypted keyboards. Each key is randomly remapped at the start of each session. Some high security locks already use this to prevent over-the-shoulder cameras capturing codes.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#154

Post by [deleted] » Sun, Aug 06, 2023, 4:35 AM UTC

TechBro8615 wrote: post #74

OtherShrezzing wrote: post #29

Earlier quoted context omitted.

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…

Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...

[deleted]

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#155

Post by Spooky23 » Sun, Aug 06, 2023, 4:37 AM UTC

TechBro8615 wrote: post #74

OtherShrezzing wrote: post #29

Earlier quoted context omitted.

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…

Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...

I used to work in an office space with an independent contractor whose schtick was that he was a genius. The affectations around his genius-ness included casually bringing up Mensa meetings, dropping magazines like Foreign Affairs and academic journals around the office, and his fucking keyboard.

The keyboard had custom switches that were very loud. And he typed fast - it was like living on a gun range. Everyone in the office probably would have chipped in for a hitman, but alas, the CTO, whose office had a solid door, was “inspired” that the mechanical feedback helped fuel inspiration in boy wonder.

Had we thought of the security risks of the keyboard, I would have brought good scotch to the infosec dude while expressing my concerns.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#156

Post by tedunangst » Sun, Aug 06, 2023, 4:38 AM UTC

jgtrosh wrote: post #68

yowzadave wrote: post #36

Earlier quoted context omitted.

I guess more reason to just use a password manager to autofill your password?

Only if it doesn't only rely on a master password

What actually are you going to do if you spy on my zoom call and learn my master password is bigjarofpickles?

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#157

Post by raydiatian » Sun, Aug 06, 2023, 4:49 AM UTC

How does it handle against me shrieking loudly while I type? Specifically screaming at my keyboard

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#158

Post by mercer » Sun, Aug 06, 2023, 4:52 AM UTC

kristopolous wrote: post #151

jgtrosh wrote: post #68

Earlier quoted context omitted.

Only if it doesn't only rely on a master password

[insert yubikey plug] I don't use one but I know people who swear by them. Also this is an extremely obvious result. Typing is obviously a form of "penmanship", it was well known that telegraph operators could identify each other by how they tapped out Morse code in the 1800s. People have been able to do this based upon key stroke latency and even identify people based on habitual mouse patterns for decades. Audio re…

You sound confident enough that'd I'd like to see you show that off :P.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#159

Post by pests » Sun, Aug 06, 2023, 4:55 AM UTC

Aerroon wrote: post #135

fatfingerd wrote: post #77

Earlier quoted context omitted.

Not according to the article.. Microphones are sensitive enough to mount the attack on quieter keyboards.

Microphones are surprisingly sensitive. I can listen to music in my closed-back headset at a regular volume. My desk mic can pick this up. Without boosting the audio it's barely audible that there's music, but after adding some gain you get almost the full song profile (and background noise). I can even pick out some of my breathing from the recording. If I turn on noise suppression and noise gate it's fine.

I was two rooms away from someone playing music on a smart Google device. I could very barely hear that music was playing at all and only just barely made out it was a song I had been interested in but kept missing. I pulled out my S22+ and used Shazam. somehow it was able to pick it up easily.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#160

Post by Galanwe » Sun, Aug 06, 2023, 4:58 AM UTC

failuser wrote: post #147

lispisok wrote: post #6

So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all

How come keyboard sound suppression is not a standard option in all online communication apps? It’s not that hard, keyboard sounds are pretty distinct.

Maybe because it's easier said in an HN comment than in real life