Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards • Hacker News Board

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#81

Post by bluGill » Tue, Jul 10, 2018, 7:21 PM UTC

mikec3010 wrote: post #58

chris_mc wrote: post #52

Earlier quoted context omitted.

I always heard you should type your PIN at the ATM, then touch all of the buttons a bunch to block this ability. That way they only see that all the buttons were touched, not your PIN. Especially important now that thermal cameras (crappy ones) are pretty cheap.

Why should I care? It's the bank's responsibility to secure their equipment and refund any dollars stolen from me.

Two reasons: if the bank can convince the court that you withdrew the money you are stuck with the lass. Even if the bank does suck up the loss, you will be out your own money for several months while they investigate (they could be the police or the bank)

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#82

Post by neuralRiot » Tue, Jul 10, 2018, 7:29 PM UTC

>Attackers need to be able to place a camera with thermal recording features near a victim, and the camera must have a clear view of the keys for the Thermanator attack to work.

Wouldn't be easier to just set up a regular video camera which can be the size of a jacket button?

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#83

Post by zokier » Tue, Jul 10, 2018, 7:40 PM UTC

Not exactly novel research, the earliest mention I could quickly find of pretty much the same idea was from 2005

http://lcamtuf.coredump.cx/tsafe/

and then dozen different iterations since then.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#84

Post by neuralRiot » Tue, Jul 10, 2018, 9:52 PM UTC

amarant wrote: post #17

at first, this seems completely harmless, but there are a few scenarios in which this could potentially be a viable attack. I doubt it's much use on computers, but imagine someone rigging a candid infrared camera across the street from an ATM. You'd block the cameras view while typing, but then you leave and it's game over.

A thermal camera that have enough resolution to get individual keys from across the street is not gonna be cheap, A 1.8Mpx @30Hz is above $20k without lens.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#85

Post by seandougall » Tue, Jul 10, 2018, 10:44 PM UTC

cortesoft wrote: post #74

JoshTriplett wrote: post #71

> The research team argues that it may be time to move away from passwords as a means to secure user data and equipment. Many people have expressed this sentiment. By all means we should be using two-factor authentication everywhere. But what, besides a password, has the critical property of residing entirely within your mind and not being obtainable without your cooperation (barring issues like this)? Physical token…

Yeah, and you can't rotate your fingerprints or retinal scans.

If you only train one fingerprint at a time, most people can rotate up to nine times. It's a bit inconvenient, though. :)

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#86

Post by cortesoft » Wed, Jul 11, 2018, 2:03 AM UTC

seandougall wrote: post #85

cortesoft wrote: post #74

Earlier quoted context omitted.

Yeah, and you can't rotate your fingerprints or retinal scans.

If you only train one fingerprint at a time, most people can rotate up to nine times. It's a bit inconvenient, though. :)

Yeah, but stealing a single glass could get all your future passwords.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#87

Post by [deleted] » Wed, Jul 11, 2018, 7:11 AM UTC

[deleted]

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#88

Post by tzakrajs » Wed, Jul 11, 2018, 7:15 AM UTC

_raoulcousins wrote: post #62

When I use an ATM, I always run my fingers along all of the keys after entering my pin. Nice to know it's not totally crazy.

You can also use something other than your fingers to press the buttons.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#89

Post by angry_octet » Wed, Jul 11, 2018, 8:40 PM UTC

moftz wrote: post #68

mrguyorama wrote: post #60

Earlier quoted context omitted.

Is an ATM card and PIN not two factors?

I can wire my entire bank account away without any 2FA with online banking. My bank just started doing SMS verification for new devices but that's still not really enough. Like just get on the TOPT train and leave it alone.

I think you need to change banks.

Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards

#90

Post by angry_octet » Wed, Jul 11, 2018, 8:44 PM UTC

leni536 wrote: post #56

stevekemp wrote: post #16

Earlier quoted context omitted.

It seems like a limitation of this attack is that you must have the camera pointed at the keys ~1 minute from the last time it was used. (Presumably because the heat dissipates quite quickly.) With that in mind a TOTP solution probably won't help, most systems that use 2FA will allow two adjacent codes to be considered valid to cope with "minor" clock-drift. If you're already using the computer 1 minute after the rea…

Allowing adjacent codes and accepting the same code twice is not the same. I would be surprised if TOTP allowed for accepting the same code twice.

Typically this is allowed. Probably because otherwise the server would have to store and compare state, but also because otherwise the user could be locked out for 60s.