Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

bleepingcomputer.com

Post reply on HN
Print view View original

21–30 of 94 posts

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#21

Post by IshKebab »

faitswulff wrote: post #20
amarant wrote: post #17

at first, this seems completely harmless, but there are a few scenarios in which this could potentially be a viable attack. I doubt it's much use on computers, but imagine someone rigging a candid infrared camera across the street from an ATM. You'd block the cameras view while typing, but then you leave and it's game over.

This is a fairly well known attack on ATMs with plastic keys, but last I heard metal keys make it nearly impossible to carry out.

Yeah metal reflects thermal IR like a mirror.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#22

Post by raverbashing »

faitswulff wrote: post #20
amarant wrote: post #17

at first, this seems completely harmless, but there are a few scenarios in which this could potentially be a viable attack. I doubt it's much use on computers, but imagine someone rigging a candid infrared camera across the street from an ATM. You'd block the cameras view while typing, but then you leave and it's game over.

This is a fairly well known attack on ATMs with plastic keys, but last I heard metal keys make it nearly impossible to carry out.

Well you still have to get the order right, though it might be possible to have an idea through the temperature differences

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#23

Post by amarant »

faitswulff wrote: post #20
amarant wrote: post #17

at first, this seems completely harmless, but there are a few scenarios in which this could potentially be a viable attack. I doubt it's much use on computers, but imagine someone rigging a candid infrared camera across the street from an ATM. You'd block the cameras view while typing, but then you leave and it's game over.

This is a fairly well known attack on ATMs with plastic keys, but last I heard metal keys make it nearly impossible to carry out.

replace ATM with the CC terminal in your favorite foodtruck then. this is even better, since you're not likely to type in a withdrawal amount into those (and thus adding noise by pressing more keys)

same thing goes, but they're rarely made of metal

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#24

Post by ajuc »

Uberphallus wrote: post #4
whatcanthisbee wrote: post #2

would continuing to type or holding the keys after/before entering my password help?

Slightly, as well as removing^H^H^H^H^H^H^H^Hdeleting characters, but the picture invariably shows the keys used, so it will in any case reduce the complexity of brute force attacks by several orders of magnitude.

If I was an attacker and had easy to recover footage and weird "whole keyboard is highlighted" footage - I would just discard the bad footage.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#25

Post by whatcanthisbee »

Uberphallus wrote: post #4
whatcanthisbee wrote: post #2

would continuing to type or holding the keys after/before entering my password help?

Slightly, as well as removing^H^H^H^H^H^H^H^Hdeleting characters, but the picture invariably shows the keys used, so it will in any case reduce the complexity of brute force attacks by several orders of magnitude.

so is the hardware keys the only answer?

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#26

Post by Uberphallus »

_verandaguy wrote: post #8
protonimitate wrote: post #5

Earlier quoted context omitted.

What's that saying, 'physical access is total access'?

Physical access is often considered total access in the infosec community. It implies the ability to, with enough prep time ahead of the actual physical access, inject malware through a physical interface (USB flash drive, rogue peripheral/HID, directly interfacing with an existing HID device), among others. Edit: and in this case it includes planting cameras and other recording devices which can be assumed to have e…

It implies using your laptop in public, or typing in a keypad. And keypads tend to be used to separate public and private areas (and even worse, people leave the scene immediately after using it, making the attack even more inconspicuous).

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#28

Post by _trampeltier »

whatcanthisbee wrote: post #2

would continuing to type or holding the keys after/before entering my password help?

Yes. Just hold your fingers over some random keys after inserting the card and wait to enter the pin. And after that just keep your hand over the keypad while you wait for the money.

(I work for over 10 years with thermal cameras and know the limits)

Post reply on HN