this post was submitted on 02 Dec 2023
439 points (95.6% liked)

Technology

60024 readers
2754 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
 

Researchers in the UK claim to have translated the sound of laptop keystrokes into their corresponding letters with 95 percent accuracy in some cases.

That 95 percent figure was achieved with nothing but a nearby iPhone. Remote methods are just as dangerous: over Zoom, the accuracy of recorded keystrokes only dropped to 93 percent, while Skype calls were still 91.7 percent accurate.

In other words, this is a side channel attack with considerable accuracy, minimal technical requirements, and a ubiquitous data exfiltration point: Microphones, which are everywhere from our laptops, to our wrists, to the very rooms we work in.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 61 points 1 year ago (4 children)

Neat, so when my friends are taking about satisfyingly clackety keyboards I can inform them it’s a security hazard.

[–] [email protected] 38 points 1 year ago

I'll accept the risk. I need the clicky

[–] [email protected] 12 points 1 year ago (2 children)

Good luck, I have a non standard key layout

[–] [email protected] 10 points 1 year ago (1 children)

It's still vulnerable to dictionary attacks

[–] [email protected] -4 points 1 year ago (1 children)
[–] [email protected] 12 points 1 year ago (1 children)

??? If you can map sound to qwerty keystroke placement, then it's a simple matter of mono alphabetic substitution for other layouts to generate candidate texts. Using a dictionary attack to find more candidate layouts would absolutely work.

[–] [email protected] 7 points 1 year ago (1 children)

No, all the timings change. You can't just swap out the letters and hope it matches. Additionally I was responding to the poster claiming a dictionary attack on a password would work - only if it's in the dictionary.

[–] [email protected] 6 points 1 year ago (1 children)

The method is not based on timings. It is based on identifying the unique sound profile of each keystroke

[–] [email protected] 5 points 1 year ago (2 children)

How can you make that claim? They used deep learning, does anyone know what characteristics the AI is using?

[–] [email protected] 4 points 1 year ago

I can only make that claim with as much confidence as yours that a non-standard keyboard layout would protect you. By your own argument, how can you make the claim that using a different keyboard layout will protect you? Everyone has a different typing style and their keyboards have different sound profiles, so clearly the AI needs to sample enough data from you and compare it to a dictionary to individually on audio collected of your typing. How do you know that the characteristics of the keyboard layout play an identifying role in this kind of attack when the AI has no concept of which sounds correspond to which keys until it has done its training?

[–] [email protected] 2 points 1 year ago

A pretty simple deep learning approach would be to take a large sample and first identify the individual key sounds. From there it can start associating the most common letters with the most common sounds and switch it around until dictionary words start coming out. Once it can identify individual keys you could even brute force it in a pretty reasonable timeframe. The keyboard layout is the least important part because the individual key sound output is going to vary keyboard by keyboard and even potentially user by user. If you used a password without dictionary words and used a different keyboard layout exclusively for entering the password that would likely defeat this sort of attack.

[–] [email protected] 3 points 1 year ago
[–] [email protected] 4 points 1 year ago

Good luck making an acoustic map of the tens thousands of possible case, switch and key cap combinations.

[–] [email protected] 4 points 1 year ago

Middle management will finally get rid of clacky keyboards with this weird trick