Traditional Keyboard Sounds Can be Decoded By Listening Over a VoIP Connection, Researchers Say (onthewire.io) 57
Reader Trailrunner7 writes: Researchers have known for a long time that acoustic signals from keyboards can be intercepted and used to spy on users, but those attacks rely on grabbing the electronic emanation from the keyboard. New research from the University of California Irvine shows that an attacker, who has not compromised a target's PC, can record the acoustic emanations of a victim's keystrokes and later reconstruct the text of what he typed, simply by listening over a VoIP connection.
The researchers found that when connected to a target user on a Skype call, they could record the audio of the user's keystrokes. With a small amount of knowledge about the victim's typing style and the keyboard he's using, the researchers could accurately get 91.7 percent of keystrokes. The attack does not require any malware on the victim's machine and simply takes advantage of the way that VoIP software acquires acoustic emanations from the machine it's on.
The researchers found that when connected to a target user on a Skype call, they could record the audio of the user's keystrokes. With a small amount of knowledge about the victim's typing style and the keyboard he's using, the researchers could accurately get 91.7 percent of keystrokes. The attack does not require any malware on the victim's machine and simply takes advantage of the way that VoIP software acquires acoustic emanations from the machine it's on.
New research perhaps, but not new results (Score:5, Informative)
While their specific research may be new, the results are hardly new. Its been nearly 11 years since more original research was released [berkeley.edu] with similar results. Looks like this may be the first time Slashdot has reported this though.
Re: (Score:2)
A comparable story was posted to Slashdot a little over a decade ago (early to mid 2000s?), though the percentages were lower that 91%, IIRC (it might have been based on your Berkeley link). I recall wondering if cubes next to mine could be susceptible to such "hacking" (i.e. spying).
Re: (Score:2)
Re: (Score:2)
Re:New research perhaps, but not new results (Score:4, Insightful)
What is new however, is that 25% of my keyboard interactions now involve autocomplete popping up and me selecting something with a mouse. Better hurry up and exploit this while you can...
Re: (Score:2)
I think the real difference is that the audio chain is no longer perfect - it's over VoIP and the audio has been compressed to favor voice over complete fidelity. So the audio of the typing would be distorted since it's not considered important audio. And even with this distortion is it possible to figure out which keys were pressed.
Re: (Score:1)
In the real world, there's a difference between "eh, we can probably do X" and actually doing the research to show that we can do X. I know, that's a hard concept for J. Random Slashdot Idiot to comprehend.
Re: (Score:2)
Acoustic cryptanalysis
https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
But this is "on the internet", so it is new!
the big question is (Score:1)
Not on Apple's fancy new keyboards (Score:2)
with close to zero key throw,
I imagine they're whisper silent, almost as if they were just a piece of glass.
Besides people will only be typing short security-unimportant tweets on the damn things anyway, since real long-form documents will be a pain to type.
Re: (Score:2)
Perhaps one can listen to finger joints clicking?
Re: (Score:1)
with close to zero key throw,
I imagine they're whisper silent, almost as if they were just a piece of glass.
Besides people will only be typing short security-unimportant tweets on the damn things anyway, since real long-form documents will be a pain to type.
Oh, so you've seen the new keyboards that AREN'T OUT YET???
Re: (Score:1)
I'd guess (s)he is referring to the design of the MacBook keyboards (which I think it also on the new wireless keyboard) that have been out for quite some time.
Ok, well, they are far from silent, nor "like typing on a piece of glass". The keys are short-throw, to be sure; but hardly ZERO throw.
But I guess to some people, if its not a Model "M", then its not really a keyboard (rolls eyes)...
here's a workaround then (Score:3)
apt-get install bucklespring (there's a Mac build, dunno how do you install there -- or if you even still can install anything not from the App Store)
The author of this program [github.com] has sampled the sound of every key on a real Model M, so you can install this and pretend you have a keyboard for grown-ups. On the downside, everyone in your building can learn what you type without requiring a VoIP link.
1 million monkeys (Score:1)
"Four score and seven years ago our fathers brought forth on this continent..."
Re: (Score:1)
The last time I saw the results of 1 million monkeys typing, it was mostly things like "Obama is a secret muslim communist working with Crooked Hillary to destroy America and take our guns!"
Of course you can (Score:1)
call a spade a spade (Score:2)
so what you really mean is 'someone else already wrote a program to identify any car that drives by with good accuracy just by matching it against known engine sounds, and i can write a several-line script to call that program'
which is way less impressive than your original, misleading claim.
Re: Of course you can (Score:2)
with an fft and engine sound database, you could get a not-too-terrible result in an hour or two just using nearest-neighbor methods. it's not totally trivial, but it's something i would expect an undergraduate to be able to do as homework.
try reading the paper about shazam's core method. it's amazingly simple (which isn't to say they haven't done a lot of work tweaking it of course).
Re: (Score:2)
it's not that new.
Re: (Score:2)
Usually followed by one of my long time players muttering "Only thing that's sure when he makes us roll for perception is that there's nothing to be found..."
sooo...eh...new type of wireless keyboard? (Score:2)
Use naturally occurring acoustic waves instead of EM waves?
Is it patented?
Re: (Score:2)
TV remote controls used to be ultrasonic, and worked by striking small aluminum rods of slightly different length, to produce different (inaudible) tones.
While those remote controls only had a few basic functions, I see no reason why this couldn't be replicated for a 104/105-key keyboard.
Reconstructing text - Already been done (Score:2)
</sarcasm>
Re: (Score:2)
Hello 90s (Score:1)
Sorry, but I think this news is from 90s or early 00s. I still clearly remember the effort to decode the sound of the keyboard, but then it was working with a particular keyboard and it was told that application has to be trained to decode clicks of another keyboard.
Re: (Score:2)
i remember the same, about the ibm clickety click (official name i think) keyboard
This will make a great addition to (Score:2)
the housefly cam that's recording video of your keyboard from the ceiling,
and the laser pointed at your office window that is recording the window vibrations as you proofread by mumbling to yourself as you write.
Acoustic/Electronic? (Score:2)
Researchers have known for a long time that acoustic signals from keyboards can be intercepted and used to spy on users, but those attacks rely on grabbing the electronic emanation from the keyboard.
I don't get it. What are these electronic emanations which can be acoustically picked up?
Oh please, if this were true (Score:1)
Seriously, if it was possible to effectively translate the sounds made by a keyboard, then the computers used to record Confidential, Secret, and Top Secret data would all have to be located in windowless rooms where you could not capture said sounds.
That's funny.
As if some of us on here worked in such windowless rooms back in the 70s and 80s ....
(grin)