Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers work to counter a new class of coffee shop hackers

news.gatech.edu

Post reply on HN
Print view View original

31–40 of 40 posts

Re: Researchers work to counter a new class of coffee shop hackers

#31

Post by 3pt14159 »

kefka wrote: post #27

Hmm. I never really thought about it until now. I used to be a hacker (not so nice one), but those days are long gone. One idea with this is using a microphone array with HARK( http://www.hark.jp/ ). I would be able to listen to any arbitrary keyboard press, and map them to a 3d scene. Assuming a bit of jitter, I could probably reproduce what you typed on your keyboard. A smartphone with touchscreen would be impracti…

This is already an established attack vector. Furthermore, even if you have sound proofed the room high quality DSLRs can pick up enough vibration from things like plants to reenact the sound.

Edit: Also it goes beyond just password interception. By following patterns of key presses you can detect things like language and even application.

Re: Researchers work to counter a new class of coffee shop hackers

#32

Post by wtallis »

korethr wrote: post #28
parktheredcar wrote: post #17

http://en.wikipedia.org/wiki/Van_Eck_phreaking

I recall that being a plot point in Neil Stephenson's Cryptonomicon. It sounded plausible enough that it didn't break my willing suspension of disbelief, but I never gave it much thought after I finished reading the book. I'm thinking now I should revisit the topic and try to evaluate how bad the emissions of my own equipment is, and what I can/should do about it, if anything. For example, should this affect my rotat…

> "[...] should this affect my rotation policy for encryption keys?"

Only if you're in the habit of displaying them or typing them in or otherwise transmitting them over leaky I/O channels. If all they do is get loaded from your internal SSD to RAM, then they're pretty safe. Your passwords are what's really at risk, and any secrets that you put on screen.

Re: Researchers work to counter a new class of coffee shop hackers

#33

Post by wwweston »

See also Melissa Elliott's Defcon 2012 talk "Exploring Unintentional Radio Emissions":

   http://www.youtube.com/watch?v=5N1C3WB8c0o
(I actually bought a cheap SDR dongle after watching it, to see what I could pick up. So far I've found that the antenna it comes with makes tuning into FM radio difficult :/, and when I went to use it to do some investigation about WiFi signal traffic I was reminded they have a limited range on the spectrum...)

Re: Researchers work to counter a new class of coffee shop hackers

#34

Post by clearf »

stewartbutler wrote: post #13
gregrata wrote: post #2

"typed by intercepting side-channel signals produced by the first laptop’s keyboard software, which had been modified to make the characters easier to identify." So they modified the keyboard to make it easy to detect what was typed? Not saying side-channel isn't a issue, but that's kinda silly :)

> keyboard software Sounds to me like they modified the driver so that it had some kind of emissions pattern they could track. Driver could be modified via a virus or something.

If you could modify the driver, you may not need to rely on the subtlety of the emissions patterns...

Re: Researchers work to counter a new class of coffee shop hackers

#35

Post by skizm »

kefka wrote: post #27

Hmm. I never really thought about it until now. I used to be a hacker (not so nice one), but those days are long gone. One idea with this is using a microphone array with HARK( http://www.hark.jp/ ). I would be able to listen to any arbitrary keyboard press, and map them to a 3d scene. Assuming a bit of jitter, I could probably reproduce what you typed on your keyboard. A smartphone with touchscreen would be impracti…

Would a mechanical keyboard be more vulnerable to that microphone type of attack since it is louder?

Not that many people are busting out a mechanical keyboard in a coffee shop. I'm just curious.

Re: Researchers work to counter a new class of coffee shop hackers

#38

Post by EvilSockMonster »

kefka wrote: post #27

Hmm. I never really thought about it until now. I used to be a hacker (not so nice one), but those days are long gone. One idea with this is using a microphone array with HARK( http://www.hark.jp/ ). I would be able to listen to any arbitrary keyboard press, and map them to a 3d scene. Assuming a bit of jitter, I could probably reproduce what you typed on your keyboard. A smartphone with touchscreen would be impracti…

There's already been a lot of research done on acoustic attacks. For example: http://www.inf.ed.ac.uk/publications/thesis/online/IM100855....

Re: Researchers work to counter a new class of coffee shop hackers

#39

Post by CoderOnWelfare »

Zikes wrote: post #3

The title needs changed, as the article doesn't actually address wifi hacking.

and truthfully WIFI at any cafe is easily spoofed so customers data can be routed thru your fake repeater pretending to be the original WIFI source.

This is like securing your windshield in your car, and not worrying about the car door locks.

The people who know how to snarf your information this way, probably can hack you a dozen other ways too.

Re: Researchers work to counter a new class of coffee shop hackers

#40

Post by peterwwillis »

driverdan wrote: post #30
peterwwillis wrote: post #9

The information about side channel attacks is really interesting, and useful to defend against real attackers. But there are no coffee shop hackers. Nobody is sitting at Starbucks trying to break into your Facebook account or glean the secrets of the bake sale you're organizing next week. It would be really nice if reporting news didn't constantly require praying on the unfounded fears people have of things they don'…

Using an absolute like "there are no coffee shop hackers" isn't accurate. It's probably not common but there are some. I've thought about why you'd target people in coffee shops / public places. There's a coffee shop in Austin near the capitol that's frequented by politicians and their associates. They often have meetings there or sit and work on their laptops. I think the reasons you'd target them are obvious.

Again, not the right target, and not an efficient attack. If you're targeting specific people, phishing works 200 times better. Politicians generally leave the tech-savvy business to their pages, anyway, and use blackberries for communication. Heck, in DC you can find out more secret intel just riding the subway around certain specific stops and keeping your ears open.
Post reply on HN