Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New acoustic attack steals data from keystrokes with 95% accuracy

bleepingcomputer.com

Post reply on HN
Print view View original

161–170 of 239 posts

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#161

Post by pests »

swid wrote: post #58
tehsauce wrote: post #33

Would love a wireless keyboard that works using this! It wouldn’t need any battery, charging or syncing!

Some old TV remotes used to work this way. They were made by Zenith and are called Space Command remotes. Apparently they are the reason TV remotes are sometimes called clickers. https://www.theverge.com/23810061/zenith-space-command-remot...

I've never considered how odd clicker is for remote but it feels totally natural to me. Like something my parents or grandparents would say. Never thought about where it came from.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#162

Post by kmeisthax »

bqmjjx0kac wrote: post #10
thedookmaster wrote: post #7

I don't use the qwerty layout, I use colemak. Likely this mitigates this for myself.

This is just security through obscurity. For real security, you need a cryptographically rolling keyboard layout.

...wait, are you telling me Konami shuffling the touch input for e-Amusement PINs[0] was a good idea!?

[0] Okay... deep breath

Konami is a pachinko manufacturer with a side hustle making rhythm games for Japanese arcades. They have an online service that all their games connect to called e-Amusement. You can log into it using an e-Amusement Pass card, and your card is locked to a PIN number you have to set up when you first use it. Cabinets with touchscreens give you a touch keypad, except all the digits are shuffled around, which is a total pain in the ass and you have to do this for every credit.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#163

Post by Sai_ »

tedunangst wrote: post #156
jgtrosh wrote: post #68

Earlier quoted context omitted.

Only if it doesn't only rely on a master password

What actually are you going to do if you spy on my zoom call and learn my master password is bigjarofpickles?

Hacker: tedunangst, what’s your email? Wanna invite you to that thing!

Hacker: man, I hate typing passwords. Do you use password managers? Any reccos?

… I am become hacker, destroyer of tedunangst’s bank account.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#164

Post by filchermcurr »

tiltowait wrote: post #127
thereisnospork wrote: post #81

Earlier quoted context omitted.

What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.

Some old IBM keyboards (beamsprings, the predecessor to the Model F, which preceded the Model M) had solenoids inside to make them louder and sound more like typewriters. I wonder if such a setup would defeat this attack, or if it would still be possible to discern the actual keypress alongside the solenoid.

Not just limited to old IBM keyboards! The new reproduction Model F keyboards also have a solenoid option! It's fantastically loud with it banging on the solid metal case along with the buckling springs. Great keyboards in general.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#165

Post by [deleted] »

Spooky23 wrote: post #155
TechBro8615 wrote: post #74

Earlier quoted context omitted.

Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...

I used to work in an office space with an independent contractor whose schtick was that he was a genius. The affectations around his genius-ness included casually bringing up Mensa meetings, dropping magazines like Foreign Affairs and academic journals around the office, and his fucking keyboard. The keyboard had custom switches that were very loud. And he typed fast - it was like living on a gun range. Everyone in t…

[deleted]

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#166

Post by blharr »

sandworm101 wrote: post #153

Encrypted keyboards. Each key is randomly remapped at the start of each session. Some high security locks already use this to prevent over-the-shoulder cameras capturing codes.

The bank pin UI from the game RuneScape comes to mind. https://imgur.io/UAgrY7e?r

The locations of the numbers move around to prevent mouseloggers from recording your movements.

It seems like any way of doing it would end up slowing down the typist though. If it is just for the password, I could see it being possible, but if you're dealing with lots of information that needs to be protected, then it seems impossible.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#167

Post by jayd16 »

TechBro8615 wrote: post #74
OtherShrezzing wrote: post #29

Earlier quoted context omitted.

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…

Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...

I'll just have to add significantly more background clickity clacks as obfuscation.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#168

Post by yjftsjthsd-h »

someplaceguy wrote: post #128
TheCleric wrote: post #99

Earlier quoted context omitted.

Adding a gain knob to my keyboard, be right back.

My mechanical keyboard already has a knob that I've configured to control the system audio volume, all that's left is configuring Linux to play an audio recording of a keypress every time I press a key...

> all that's left is configuring Linux to play an audio recording of a keypress every time I press a key

I unironically think I've seen that config recently - someone had an actually quiet keyboard but wanted the full Mechanical Keyboard Effect™ so they just... have it play the sound per keypress. (It was not 100% clear to me whether it was an elaborate joke or a real aesthetic choice)

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#169

Post by worthless-trash »

TechBro8615 wrote: post #74
OtherShrezzing wrote: post #29

Earlier quoted context omitted.

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…

Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...

Good luck with my mech steno keyboard.
Post reply on HN