Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 94 posts

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#41

Post by brianberns »

amarant wrote: post #23
faitswulff wrote: post #20

Earlier quoted context omitted.

This is a fairly well known attack on ATMs with plastic keys, but last I heard metal keys make it nearly impossible to carry out.

replace ATM with the CC terminal in your favorite foodtruck then. this is even better, since you're not likely to type in a withdrawal amount into those (and thus adding noise by pressing more keys) same thing goes, but they're rarely made of metal

A debit card can be used as a credit card at a CC terminal. No PIN and no transaction fee. I don't think you'll find many people typing a PIN into a CC terminal in the wild.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#42

Post by privacypoller »

no_one_ever wrote: post #32
amarant wrote: post #17

at first, this seems completely harmless, but there are a few scenarios in which this could potentially be a viable attack. I doubt it's much use on computers, but imagine someone rigging a candid infrared camera across the street from an ATM. You'd block the cameras view while typing, but then you leave and it's game over.

This is why I habitually run my fingers across the keypad after entering my PIN. Paranoid thinking? Maybe.

I do something similar but I think it's far more likely that a cheap webcam is positioned where it can view the keypad of those who don't screen it well. I always throw in a few "phantom" keypresses when entering a pin for my cc or bank card.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#43

Post by nomel »

blobbers wrote: post #33

Apparently the attacker has never seen my macbook air running a heavy compilation job. Fan is cranked and the keyboard is so hot that there is no way they are getting my password! Nothing but noise to a thermal camera...

Maybe they would look for cool spots. I assume you would only run into problems where the key was the same temperature as your finger.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#44

Post by krageon »

fabricexpert wrote: post #37

> THERMANATOR - The hottest attack of the summer! Coming soon to a computer near you! Are our jobs really this dull that we have to give our projects stupid hollywood names

I thought naming things was one of those aspects of the job which can be nice and entertaining. It's easy to remember, where is the harm in this?

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#45

Post by taumhn »

brianberns wrote: post #41
amarant wrote: post #23

Earlier quoted context omitted.

replace ATM with the CC terminal in your favorite foodtruck then. this is even better, since you're not likely to type in a withdrawal amount into those (and thus adding noise by pressing more keys) same thing goes, but they're rarely made of metal

A debit card can be used as a credit card at a CC terminal. No PIN and no transaction fee. I don't think you'll find many people typing a PIN into a CC terminal in the wild.

AFAIK it's mostly in the US that using cards don't always require PINs. Here in Canada I have to enter my PIN whether it's my credit or debit card, for every purchase at a CC terminal. The only exception is if I'm using contactless payment. This was also true in Europe last I checked.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#47

Post by Uberphallus »

brianberns wrote: post #41
amarant wrote: post #23

Earlier quoted context omitted.

replace ATM with the CC terminal in your favorite foodtruck then. this is even better, since you're not likely to type in a withdrawal amount into those (and thus adding noise by pressing more keys) same thing goes, but they're rarely made of metal

A debit card can be used as a credit card at a CC terminal. No PIN and no transaction fee. I don't think you'll find many people typing a PIN into a CC terminal in the wild.

All the time in the EU, except if the card has NFC, then without PIN up to 20€ (depending on the bank).

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#48

Post by qop »

fabricexpert wrote: post #37

> THERMANATOR - The hottest attack of the summer! Coming soon to a computer near you! Are our jobs really this dull that we have to give our projects stupid hollywood names

Counterpoint:

What if you could say "Yeah boss, Thermanator is complete and ready to be unleashed." and mean it?

I spent thirty years turning in shit like "PrimitiveSpoofAttackDHCP" and "TCPThreadPoolFlooder" but now I'm realizing I couldve been writing bond villain superweapons all this time.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#50

Post by blobbers »

nomel wrote: post #43
blobbers wrote: post #33

Apparently the attacker has never seen my macbook air running a heavy compilation job. Fan is cranked and the keyboard is so hot that there is no way they are getting my password! Nothing but noise to a thermal camera...

Maybe they would look for cool spots. I assume you would only run into problems where the key was the same temperature as your finger.

I was half making a joke... but I believe if you have a large external thermal source or sink the time for keys to renormalize would be dramatically shorter.
Post reply on HN