Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers work to counter a new class of coffee shop hackers

news.gatech.edu

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Researchers work to counter a new class of coffee shop hackers

#21

Post by peterwwillis »

chatmasta wrote: post #10
peterwwillis wrote: post #9

The information about side channel attacks is really interesting, and useful to defend against real attackers. But there are no coffee shop hackers. Nobody is sitting at Starbucks trying to break into your Facebook account or glean the secrets of the bake sale you're organizing next week. It would be really nice if reporting news didn't constantly require praying on the unfounded fears people have of things they don'…

Are you sure about that? Many people log into their bank accounts while online at coffee shops. A passive attacker could tape an old android phone to the bottom of a table, with a custom sniffing program running in the background. It sounds like a stretch now, but could become a more common threat if some code is released to the script kiddies.

If a hacker wants money they can go online and buy 100 credit cards for less than $10. If they want bank accounts, they can take over someone's sloppily-admined botnet that's already collected thousands of accounts. Even script kiddies know this stuff; those are usually the people who run botnets or make money off spam.

You spend more time trying to pilfer anything useful than would ever be useful. Then there's the whole getting caught bit; most hackers are prison-averse. The only hacking you will see at Starbucks is benign proof-of-concept stuff and research.

Re: Researchers work to counter a new class of coffee shop hackers

#23

Post by parktheredcar »

127001brewer wrote: post #20
parktheredcar wrote: post #17

http://en.wikipedia.org/wiki/Van_Eck_phreaking

This is also talked about in the book, "Silence on the Wire". http://www.amazon.com/Silence-Wire-Passive-Reconnaissance-In...

Thanks for sharing, that looks like an interesting read.

There was also this paper (linking to summary) about figuring out how to decode the audio of someone typing on a keyboard.

https://freedom-to-tinker.com/blog/felten/acoustic-snooping-...

Re: Researchers work to counter a new class of coffee shop hackers

#24

Post by keithpeter »

"The processor draws different amounts of current depending on the operation, creating fluctuations that can be measured. Saving data to memory also requires a large amount of current, creating a “loud” operation."

Could you not recompile a kernel or something to make enough side channel 'noise' to jam the cpu/memory related 'signal' from your actual typing? Like the cook banging two saucepans together as Utz and the Critic talked in that flat in Prague? (Utz by Bruce Chatwin).

Heavy on battery, and might not address the pure keyboard side channel signal if I have understood the article correctly.

Re: Researchers work to counter a new class of coffee shop hackers

#25

Post by 127001brewer »

parktheredcar wrote: post #23
127001brewer wrote: post #20

Earlier quoted context omitted.

This is also talked about in the book, "Silence on the Wire". http://www.amazon.com/Silence-Wire-Passive-Reconnaissance-In...

Thanks for sharing, that looks like an interesting read. There was also this paper (linking to summary) about figuring out how to decode the audio of someone typing on a keyboard. https://freedom-to-tinker.com/blog/felten/acoustic-snooping-...

...it's actually a good compliment while (slowly) trying to complete the challenges on http://cryptopals.com/

Re: Researchers work to counter a new class of coffee shop hackers

#27

Post by kefka »

Hmm. I never really thought about it until now. I used to be a hacker (not so nice one), but those days are long gone.

One idea with this is using a microphone array with HARK(http://www.hark.jp/). I would be able to listen to any arbitrary keyboard press, and map them to a 3d scene. Assuming a bit of jitter, I could probably reproduce what you typed on your keyboard.

A smartphone with touchscreen would be impractical with this setup. I'm unsure regarding buttoned smartphones (slide out keyboard).

I've been working with 3d scene generation and voice decoding. I'm making a board room auto-transcripter. It would map where people are, and attach who says what, when. It also has uses also in the courtroom where a mic array could also overhear whispers the jurors say in open court, to potentially catch issues that would cause a mistrial.

Of course, this could also be taken to the 'listen to everything in the area and decode semi-private actions'.

Re: Researchers work to counter a new class of coffee shop hackers

#28

Post by korethr »

parktheredcar wrote: post #17

http://en.wikipedia.org/wiki/Van_Eck_phreaking

I recall that being a plot point in Neil Stephenson's Cryptonomicon. It sounded plausible enough that it didn't break my willing suspension of disbelief, but I never gave it much thought after I finished reading the book. I'm thinking now I should revisit the topic and try to evaluate how bad the emissions of my own equipment is, and what I can/should do about it, if anything. For example, should this affect my rotation policy for encryption keys?

Re: Researchers work to counter a new class of coffee shop hackers

#29

Post by korethr »

keithpeter wrote: post #24

"The processor draws different amounts of current depending on the operation, creating fluctuations that can be measured. Saving data to memory also requires a large amount of current, creating a “loud” operation." Could you not recompile a kernel or something to make enough side channel 'noise' to jam the cpu/memory related 'signal' from your actual typing? Like the cook banging two saucepans together as Utz and the…

Though a fictitious example, in the book Cryptonomicon, the protagonist did a similar trick to try to counter the emissions from his computer being read. I don't know how practical that would be IRL, however. I use Gentoo on my daily driver, and even I am not compiling all the time. And a compile job small enough to run in an infinite loop without impacting your ability to get other work done might not make enough making noise, or might have enough of a pattern to it that it could be filtered out.

Re: Researchers work to counter a new class of coffee shop hackers

#30

Post by driverdan »

peterwwillis wrote: post #9

The information about side channel attacks is really interesting, and useful to defend against real attackers. But there are no coffee shop hackers. Nobody is sitting at Starbucks trying to break into your Facebook account or glean the secrets of the bake sale you're organizing next week. It would be really nice if reporting news didn't constantly require praying on the unfounded fears people have of things they don'…

Using an absolute like "there are no coffee shop hackers" isn't accurate. It's probably not common but there are some.

I've thought about why you'd target people in coffee shops / public places. There's a coffee shop in Austin near the capitol that's frequented by politicians and their associates. They often have meetings there or sit and work on their laptops. I think the reasons you'd target them are obvious.

Post reply on HN