Laser Sniffing Captures Typed Keystrokes From 50-100 Feet

Death Metal writes "Chief Security Engineer Andrea Barisani and hardware hacker Daniele Bianco used handmade laser microphone device and a photo diode to measure the vibrations, software for analyzing the spectrograms of frequencies from different keystrokes, as well as technology to apply the data to a dictionary to try to guess the words. They used a technique called dynamic time warping that's typically used for speech recognition applications, to measure the similarity of signals. Line-of-sight on the laptop is needed, but it works through a glass window, they said. Using an infrared laser would prevent a victim from knowing they were being spied on." (This is the same team that was able to pick up the electromagnetic signals emitted by PS/2 keyboards.)

Re:What is it with these guys?

[srollyson]

I don't know if that's a good enough defense. TFA says that the laser sniffing method is "analyzing the spectrograms of frequencies from different keystrokes." Once you've got a signature for each key and a large enough typing sample, your problem is reduced to a simple substitution cipher.

Re:on the contrary: !Easy to dectect

[causality]

Also, the point is to point the laser at the window and have it reflect. By measuring changes in the angle of reflection you can reconstruct sound hitting the inside of the window. Double-pane glass with a vacuum between the panes removes this attack vector.

Is it common for double-pane glass to contain anything that could be called a vacuum? I'll admit I don't know but I always thought they just had regular atmospheric-pressure air between the panes, as an extra layer of insulation. Would you need a proper vacuum to dampen the sound vibrations enough to defeat this attack?

Re:Not First Post

[Anenome]

If the song you play can be identified and reproduced to a good degree of the distortion created by your room and the bass levels, then removing that from the data stream is not particularly difficult. You would actually have to play two different songs at some non-standard or perhaps continuously variable playback-rate in order to create something hard to find and duplicate so that it couldn't be simply removed from the recording. It's like those Bose noise-canceling headphones, by sampling the sound as it comes in they can subtract that sound from what you actually hear. The same would apply here.

Re:Simple. Encrypted keyboard.

[Feminist-Mom]

I'm not sure I understand. How does the user know what keys to hit? Are they not physical buttons?