Acoustic Keylogger . . .

This a review of a paper by some reasearchers who have developed a method of translating the sound of keystokes into text. The method requires only fifteen minutes of recorded material to be useful. Apparently passwords are somewhat difficult because the program is designed to take advantage of characteristics of English, but it can produce a short list, and as it says, one which usually includes the actual key. Presumeably if the program was modified to take into account period of time around keystrokes, picking up passwords would be much easier.


http://www.freedom-to-tinker.com/?p=893
Acoustic Snooping on Typed Information
Friday September 9, 2005 by Edward W. Felten

Damn, that's interesting. It reminds me of something I read a long time ago about people testing a specialized network "sniffer" that worked by reading the flashes from the LED on the back of a network adapter.

I have read something along this line before...here on AO

something about .....tempest

and how the military shields their posts from this type of "electronic eavesdropping"

I believe the technology has been around for a while......although not readly available to the general public

MLF

I thought that tempest was just the technology that could decode the radiation coming off a standard CRT to replicate the image? Did the project also include these other eavesdropping techniques?

http://en.wikipedia.org/wiki/TEMPEST

And here's a PhD. thesis on the subject by Kuhn. No acoustics invovled as far as I can see.

http://www.cl.cam.ac.uk/TechReports/UCAM-CL-TR-577.pdf

A sort of proof concept application of the tempest technology is available here.

http://www.erikyyy.de/tempest/

All the best,

T

The article I read also talked about listening to keystrokes....

This was a couple of years ago....in a google search...and alot of digging :D

MLF

As far as I knew, this study is fairly new. There may have been the idea that it was possible, but only recently have they researched it in depth.
Acoustical Snooping
This is the story I found on it that was posted on Google News 16 hours ago, maybe Berkley is just re-entering the study they started years ago? I dunno, this is the first I've heard about it.

well i don't think this can be widely used
immagine all the noise around us

and ppl type at different rates.. which can make the sound difficult to notice
and in case this is working it is very easy to stop it
just turn those speakers u just bought on some rocking song

Quote:

---

As far as I knew, this study is fairly new. There may have been the idea that it was possible, but only recently have they researched it in depth.

---

Ohhh...Ok

I must be mistaken..

Cause if its not on google....or wikipedia :rolleyes:

I am sure it couldnt have existed years ago....

Must be my overactive imagination :D

MLF

Quote:

---

Originally posted here by beee
well i don't think this can be widely used
immagine all the noise around us

and ppl type at different rates.. which can make the sound difficult to notice
and in case this is working it is very easy to stop it
just turn those speakers u just bought on some rocking song

---

Where you work that might be an option to blast your radio, but in a cube farm that is far from possible.

Background noise doesn't really drown out the noises of keyclicks. I can hear my partners keystrokes right behind me with no problems.

People typing at different rates doesn't really matter, as the idea is that the system will learn from listening over a 15 minute period and tune itself to that persons style of typing.

well it won't catch me trust that! lool

but it is a nice idea and somehow different

u can put something that will make noise that human ears doesn't hear and still interfers with the recording

and how it is gonna learn from the typing?
guess u won't ask someone please type that for me for 15 minutes
and after 15 minutes ppl get tired and the speed will change loool
u can't log the human behavior

anyway,i think this is all a possibly how
but it is somehow nice,soft and funny conversation loool
zenger u are so much into that thing
did u code something like it?
want a hand lool ?

Quote:

---

Ohhh...Ok

I must be mistaken..

Cause if its not on google....or wikipedia

I am sure it couldnt have existed years ago....

Must be my overactive imagination

MLF

---

That's why I said "as far as I knew." And maybe a link to an article that MENTIONS the study being conducted PRIOR to last week might help. I'm sorry that the fact that I get my news from Google offends you, but I wasn't trying to 'show you up' or something. I'm trying to have a conversation about something I was unaware of prior to recently and if the study had been 'years ago' I figured there would be mention of it in the article describing the recent resurgence of the study. I looked a little bit but couldn't find anything except the recent article that I've already seen. I'm not saying it didn't happen years ago, I'm pretty much assuming it did since you say so and why would you lie, so don't get mad at me, but I would like to know one way or the other, just because I'm interested in the study and why it is suddenly in the news again. Excuse my slight sarcasm but give and you shall recieve, but I am being serious and I didn't mean any offense.

http://cryptome.org/tempest-time.htm

http://www.google.ca/search?hl=en&lr...&as_q=keyboard

Here you go.....

MLF

Maynot be the exact technology...but acoustic logging of keystrokes has been around for a while....each key has a different electronc input....AFAIK

Here's an article that mentions acoustic keylogging specifically, along with some other acoustic information gathering methods.

Quote:

---

Q5: What about other acoustic attacks?
Eavesdropping on keyboard keystrokes has been often discussed . . .

---

http://www.wisdom.weizmann.ac.il/~tromer/acoustic/

Also, if you google Asonov and Agrawal you will come up with some more stuff.

I sortof agree with beee, my keyboard makes pretty loud noises when pressing and releasing keys, and it makes a fairly loud click when i rest my finger back on a key I just got done hitting, and sometimes ill type two or three letters before letting go of the first key I hit. I'm wondering if the test recording they used might have been someone deliberately typing somewhat slowly, or if they tested it on different types of keyboards. Laptop keyboards would probably be most susceptible to something like that I think.
Either way it's a scary thought. I'd love to just look at the algorithms they use for something like that.

Thx for the links guys, I was searching for accoustic keylogging and the like

Quote:

---

Originally posted here by beee
well it won't catch me trust that! lool

but it is a nice idea and somehow different

u can put something that will make noise that human ears doesn't hear and still interfers with the recording

and how it is gonna learn from the typing?
guess u won't ask someone please type that for me for 15 minutes
and after 15 minutes ppl get tired and the speed will change loool
u can't log the human behavior

anyway,i think this is all a possibly how
but it is somehow nice,soft and funny conversation loool
zenger u are so much into that thing
did u code something like it?
want a hand lool ?

---

No, I don't want a hand, nor have I coded anything of the like. I just appreciate the effort that went into coming up with the idea and making it work.

You seem to debunk it without even understanding how it works. I'd almost bet you didn't even read the article/paper about it and yet you say it won't work.

At one point in time people said the same exact things about giving voice commands to a computer. It won't work, theres background noise that will confuse it. We've come a long way in that realm. These things were overcome just like they are in this situation.

You stated your point originaly in such a way as if the people who came up with this idea and implemented it would have never thought of something as simple as background noise. Yes, if you drown out your keystrokes with something else then you're right this won't be doable, but in the general public this isn't the case. Do you listen to loud music everytime that you type something? How about at the library?

Have you delt at all with cryptography? If not I'll fill you in with a little information. Some things are used more often than others. The word "the" for instance. The letter 'e' is the most used letter in the english language. These repetitions are what leads to breaking a cipher. Although it may take some time in data cryptography because of the complex algorithms. This is virtually the same thing. You may randomize you keystrokes a little, but in most people there is a certain rythm about their typing. Take a look at some keyboard dynamics sites. Companies can actually use the rythm of your keystrokes to find out if it is the correct person typing.

You start off saying it won't work, and then come up with using some non-audible mitigation for it. Why mitigate something that can't happen? The truth of the matter is that it could happen and by learning about it you will better be able to protect against it. At one point in time people had your attitude towards keyloggers. They won't work, cause they'd have to install it on my computer. Guess what, the theif got smarter.

Lastly, I replied originally to your comment because I thought that it wasn't very well stated and had no real evidence to back it up. I replied to this one mostly because I'm insulted with you last comment, "want a hand lool".

I never thought of it as simply cryptography. Now I can definately understand how this could work. Think about how simple it would be to put one of the thousands of inexpensive and easy to get ahold of miniature audio transmiters and how easy it would be to stick it behind someone's monitor, or under their keyboard. If they can decrypt 256bit encrypted data ill bet they can figure out what you'r typing. Cuz the spacebar is REDICULOUSLY obvious you have your word separator right up front so that makes it much simpler. And I'm sure every keyboard in the world has certain keys that have quirks and make a very different noise from the rest, just knowing that is a large step, I can think of lots of things like that that in combination with anti-cryptography tactics could most definately make it possible.

This crazy guy in one of my classes was talking about this today. If it were to be done, I think it would require a few example for the program to work with. Who knows, the guy could have three sticky keys and that could ruin all the data coming in. I'd love to see it work though.