Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
bleepingcomputer.com
Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
1–10 of 94 posts
Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
#2would continuing to type or holding the keys after/before entering my password help?
Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
#3If the adversary has the level of physical access required to pull this off you've already lost.
Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
#4would continuing to type or holding the keys after/before entering my password help?
Slightly, as well as removing^H^H^H^H^H^H^H^Hdeleting characters, but the picture invariably shows the keys used, so it will in any case reduce the complexity of brute force attacks by several orders of magnitude.
Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
#5If the adversary has the level of physical access required to pull this off you've already lost.
What's that saying, 'physical access is total access'?
Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
#6If the adversary has the level of physical access required to pull this off you've already lost.
Exactly. If the adversary has a camera pointed at your keyboard, they can even possibly attempt the more radical (and indefensible) “I literally recorded what you typed” attack. Scary stuff.
Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
#7If the adversary has the level of physical access required to pull this off you've already lost.
One can easily attach a long tele lens to one of these cameras, so one could capture passwords through windows. Specialized IR lenses are expensive, but regular lenses can do a good enough job.
Edit: my bad IR doesn't go through most glass material. Still, laptops are commonly used in public, and through lenses or otherwise, your password can be leaked. That's worrying enough to stop the "physical access means total access" adagio in this thread.
Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
#8If the adversary has the level of physical access required to pull this off you've already lost.
What's that saying, 'physical access is total access'?
Physical access is often considered total access in the infosec community.
It implies the ability to, with enough prep time ahead of the actual physical access, inject malware through a physical interface (USB flash drive, rogue peripheral/HID, directly interfacing with an existing HID device), among others.
Edit: and in this case it includes planting cameras and other recording devices which can be assumed to have effectively limitless video/audio resolution.
Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
#9If the adversary has the level of physical access required to pull this off you've already lost.
Exactly. If the adversary has a camera pointed at your keyboard, they can even possibly attempt the more radical (and indefensible) “I literally recorded what you typed” attack. Scary stuff.
Indefensible is debatable. It can be defeated using any of the major 2FA mechanisms (FIDO U2F, HOTP/TOTP come to mind).
Re: Thermanator Attack Steals Passwords by Reading Thermal Residue on Keyboards
#10If the adversary has the level of physical access required to pull this off you've already lost.
One can easily attach a long tele lens to one of these cameras, so one could capture passwords through windows. Specialized IR lenses are expensive, but regular lenses can do a good enough job. Edit: my bad IR doesn't go through most glass material. Still, laptops are commonly used in public, and through lenses or otherwise, your password can be leaked. That's worrying enough to stop the "physical access means total…
Thermal cameras don't really work through glass