Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New acoustic attack steals data from keystrokes with 95% accuracy

bleepingcomputer.com

Post reply on HN
Print view View original

141–150 of 239 posts

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#141

Post by dools »

OtherShrezzing wrote: post #29
lispisok wrote: post #6

So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…

And there are therefore millions of hours of video that could be attack surface area already in the wild

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#142

Post by zuminator »

pengaru wrote: post #43

So microphones need to get muted automatically by password prompts, seems simple enough in principle.

That would certainly solve the password issue. And if a sufficiently paranoid person is aware of this attack vector, they could just manually mute the mic at any time they are typing in any sensitive information. I initially was thinking that using a Dvorak or even better custom layout would help, but upon further reflection I think not -- the first-pass output would be equivalent to a substitution cipher, and quickly solved as such.

This topic has me wondering though if it's possible to detect finger positioning or for that matter screen information from the reflection off the typist's eyeballs/eyeglasses shown in a webcam, or perhaps even if possible in principle, in practice most webcam resolution is simply too poor for that.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#143

Post by tharne »

TechBro8615 wrote: post #74
OtherShrezzing wrote: post #29

Earlier quoted context omitted.

I believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from…

Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...

Mechanical keyboard user here. Most of us use mechanical keyboards because they're a lot more fun to type on. That's it. Because if you're not having fun, what's the point?

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#144

Post by FireBeyond »

mdp2021 wrote: post #28
glitchc wrote: post #18

Earlier quoted context omitted.

Brilliant suggestion. Have a TRNG or a CSPRNG (if too poor for a TRNG) choose the next layout at random for you, ideally with every keystroke. Good luck cracking that!

Could be done by using a device with a display - e.g. an "ereader" - to present a random keyboard layout. But, good luck being efficient typing on that. At that point, better use a different input model. Or, use techniques such as those in the article, such as random keypresses played during the actual ones.

Some banks went through a phase of this - website would present an on screen keyboard for the password field with a randomized layout.

I'm sure customer frustration was huge.

Re: New acoustic attack steals data from keystrokes with 95% accuracy

#147

Post by failuser »

lispisok wrote: post #6

So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all

How come keyboard sound suppression is not a standard option in all online communication apps? It’s not that hard, keyboard sounds are pretty distinct.
Post reply on HN