Author Topic: On keyboard science: Keyboard Acoustic Emanations Revisited.  (Read 3153 times)

0 Members and 1 Guest are viewing this topic.

Offline ideus

  • * Exalted Elder
  • Thread Starter
  • Posts: 8123
  • Location: In the middle of nowhere.
  • Björkö.
On keyboard science: Keyboard Acoustic Emanations Revisited.
« on: Tue, 08 December 2015, 10:45:17 »

On keyboard science: Keyboard Acoustic Emanations Revisited.


Zhuang and collaborators reported:


We examine the problem of keyboard acoustic emanations. We
present a novel attack taking as input a 10-minute sound recording
of a user typing English text using a keyboard, and then recovering
up to 96% of typed characters. There is no need for a labeled
training recording. Moreover the recognizer bootstrapped this way
can even recognize random text such as passwords: In our experiments,
90% of 5-character random passwords using only letters can
be generated in fewer than 20 attempts by an adversary; 80% of 10-
character passwords can be generated in fewer than 75 attempts.
Our attack uses the statistical constraints of the underlying content,
English language, to reconstruct text from sound recordings
without any labeled training data. The attack uses a combination
of standard machine learning and speech recognition techniques,
including cepstrum features, Hidden Markov Models, linear classi-
fication, and feedback-based incremental learning.


http://www.cs.berkeley.edu/~tygar/papers/Keyboard_Acoustic_Emanations_Revisited/ccs.pdf

Offline SpAmRaY

  • NOT a Moderator
  • * Certified Spammer
  • Posts: 14667
  • Location: ¯\(°_o)/¯
  • because reasons.......
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #1 on: Tue, 08 December 2015, 10:53:01 »
I knew it was important to have a quiet keyboard :eek:

Offline Snowdog993

  • Grace Under Pressure
  • Posts: 1587
  • Location: Over There! (Pointing)
  • Justifiably Clueless.
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #2 on: Tue, 08 December 2015, 11:14:35 »
I knew it was important to have a quiet keyboard :eek:

Okay.

Keyboard 1:  Dell TM
Quietkey R
PS/2 keyboard, manufacturer part number 2P121, in use for about 6 months.

Keyboard 2:  Dell TM
Quietkey R
PS/2 keyboard, manufacturer part number 035KKW, in use for more than 5 years.

Keyboard  3:  Dell TM
Wireless keyboard,  manufacturer  part number W0147, new.

STAY AWAY FROM DELL KEYBOARDS!

Offline ander

  • * Esteemed Elder
  • Posts: 1186
  • Location: Vancouver, BC
  • I type, therefore I am
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #3 on: Wed, 09 December 2015, 06:00:57 »
Huh—just one more thing to worry about.  :?|

Possible solution: Take the opposite, non-stealth approach. Use a Model M, clack away, and don't give a damn if anyone knows what you're typing. Occasionally type "Ha ha, I know you're analyzing my keypresses—get a life!" Chuckle to self.
We are not chasing wildly after beauty with fear at our backs. – Natalie Goldberg

Offline ideus

  • * Exalted Elder
  • Thread Starter
  • Posts: 8123
  • Location: In the middle of nowhere.
  • Björkö.
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #4 on: Wed, 09 December 2015, 07:22:19 »
Loving the sound on my boards more than ever, the PCB mounted one has a great deep sound, like a baritone voice, the plate mounted is a bass singer, I love both.

Offline Data

  • Posts: 2608
  • Location: Orlando, FL
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #5 on: Wed, 09 December 2015, 07:41:04 »
The take-away from this is: don't use single English dictionary words as passwords.  5 characters?  You gotta be kidding me.

Offline Oobly

  • * Esteemed Elder
  • Posts: 3929
  • Location: Finland
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #6 on: Wed, 09 December 2015, 08:00:37 »
It's most likely any system that does this would be trained with as standard a keyboard as possible so.. rubber dome. Which means most of us mech users are safe. Especially if you mod your switches. A good proportion of GH'ers will have boards that sound unique, due to the customisation possible (PCB mount, plate mount, plate material, case design, case material, keycap profile / material / thickness, orings / trampolines, MX / Alps / Topre, tactile / clicky / linear, etc...).
Buying more keycaps,
it really hacks my wallet,
but I must have them.

Offline ander

  • * Esteemed Elder
  • Posts: 1186
  • Location: Vancouver, BC
  • I type, therefore I am
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #7 on: Wed, 09 December 2015, 16:16:44 »
Loving the sound on my boards more than ever, the PCB mounted one has a great deep sound, like a baritone voice, the plate mounted is a bass singer, I love both.

Right on! Along with their typing feel, speed, and looks, the great sound properties of MKs are what make them so charming to us. You could also worry that your partner's good looks make it more likely they'll cheat on you—but do you want to live that way? (And why did you bother finding a good-looking partner then?)

If you work in a setting where security is paramount, you have a lot more to worry about than how your KB sounds. Someone could point a laser at one of your windows and hear not only your keyboard, but anything you or anyone else in the room was saying, the numbers you were dialing on your phone, and so on. If you're in that kind of environment, I suppose you're already taking strenuous security measures. But to promote paranoia among rank-and-file MK enthusiasts—I think that'd be pretty sad.

The take-away from this is: don't use single English dictionary words as passwords.  5 characters?  You gotta be kidding me.

I agree—some people would rather risk it all than do something inconvenient. (Consider how we're still damaging our planet for the sake of convenience, even though we've realized for decades what we were doing to it.)

But really, should it take something as esoteric as the threat of acoustic KB eavesdropping to motivate people to use secure p/w's?

It's most likely any system that does this would be trained with as standard a keyboard as possible so.. rubber dome. Which means most of us mech users are safe. Especially if you mod your switches. A good proportion of GH'ers will have boards that sound unique, due to the customisation possible (PCB mount, plate mount, plate material, case design, case material, keycap profile / material / thickness, orings / trampolines, MX / Alps / Topre, tactile / clicky / linear, etc...).

Oob, I don't think it's a matter of anyone being able to recognize a set of standard sounds that a particular model of KB makes, if that's what you're saying.

My understanding is that computers are so fast now, and software so finely tuned, differences between the sounds of keys on any keyboard can theoretically be used to determine which keys are pressed, once there's enough data and the principles of character-frequency are applied to it. And if anything, MKs are likely to make more noise than RDs, of course.

Even if this becomes true on any real scale, though, it'll be of limited use if people take basic precautions. Want a password an acoustic eavesdropper can't analyze?:

1. Go to Steve Gibson's Secure Password page.

2. Select and copy any number of random, uniquely generated characters.

3. Paste them into your p/w manager.

I refuse to live in fear, imagining that hackers are pointing laser beams at me. There's always something you could worry about to the point of making yourself sick. IMHO, life's too short without making it even shorter.
We are not chasing wildly after beauty with fear at our backs. – Natalie Goldberg

Offline ideus

  • * Exalted Elder
  • Thread Starter
  • Posts: 8123
  • Location: In the middle of nowhere.
  • Björkö.
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #8 on: Wed, 09 December 2015, 16:49:50 »
This thread is turning into a very interesting one.

Offline Altis

  • Posts: 974
  • Location: Canada
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #9 on: Wed, 09 December 2015, 20:03:48 »
The take-away from this is: don't use single English dictionary words as passwords.  5 characters?  You gotta be kidding me.

I recommend that if you want convenience, pick something long and complex that's easy enough to type. Something like =-o=-o=-o is super easy to type but actually quite difficult to brute force or guess (unless someone sees you).

Anyways, interesting OP. I could probably do it by ear for my HHKB since the keys all sound rather distinct.

Keyboards that have extremely similar key sound across the board actually sound more irritating since it's almost like a repetitive noise rather than a bunch of similar noises.
WhiteFox (Gateron Brown) -- Realforce 87U 45g -- Realforce 104UG (Hi Pro 45g) -- Realforce 108US 30g JIS -- HHKB Pro 2 -- IBM Model M ('90) -- IBM Model M SSK ('87) -- NMB RT-101 & RT-8255C+ (Hi-Tek Space Invaders) -- Chicony KB-5181 (Monterey Blue Alps) -- KPT-102 (KPT Alps) -- KUL ES-87 (62/65g Purple Zealios) -- CM QFR (MX Red) -- Apple Aluminum BT -- Realforce 23u Numpad -- Logitech K740 -- QSENN DT-35 -- Zenith Z-150 (Green Alps)

Offline keshley

  • Posts: 417
  • Location: Ohio
    • Blog n stuff
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #10 on: Wed, 09 December 2015, 20:38:43 »
Didn't they do this in Sneakers? I love that movie, but I don't have a copy of it, so haven't seen it in a while...
  
HHKB Pro 2       Pok3r

Offline ander

  • * Esteemed Elder
  • Posts: 1186
  • Location: Vancouver, BC
  • I type, therefore I am
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #11 on: Fri, 11 December 2015, 05:38:04 »
I recommend that if you want convenience, pick something long and complex that's easy enough to type. Something like =-o=-o=-o is super easy to type but actually quite difficult to brute force or guess (unless someone sees you).

It also looks like something that's moving real fast, which might discourage the eavesdroppers. ("Whoa, this guy's going so fast, we'll never catch up with him!")

Keyboards that have extremely similar key sound across the board actually sound more irritating since it's almost like a repetitive noise rather than a bunch of similar noises.

On the surface, that may seem irrelevant. But actually, if someone's listening and trying to figure out what you're typing, the more annoying your keyboard sounds, the better. I could hire out my wife to stand in the background and complain, too—I don't think anyone would stick around to listen to that.
We are not chasing wildly after beauty with fear at our backs. – Natalie Goldberg

Offline Oobly

  • * Esteemed Elder
  • Posts: 3929
  • Location: Finland
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #12 on: Fri, 11 December 2015, 08:55:35 »
I guess if they're using character frequency metrics it's fairly believable, but it would take a long time capturing audio and you'd have to type exactly the same way all the time for it to work. Move your board, the sound changes and screws up the metrics. Or change the caps, or swap the board or the language used.... I think this software would have a hard time with me, I tend to swap caps, modify switches, change boards, etc, pretty often.

There is a better way, though: IBM with solenoid. Drowns out any difference between presses completely.
Buying more keycaps,
it really hacks my wallet,
but I must have them.

Offline ideus

  • * Exalted Elder
  • Thread Starter
  • Posts: 8123
  • Location: In the middle of nowhere.
  • Björkö.
Re: On keyboard science: Keyboard Acoustic Emanations Revisited.
« Reply #13 on: Fri, 11 December 2015, 15:41:31 »
I guess if they're using character frequency metrics it's fairly believable, but it would take a long time capturing audio and you'd have to type exactly the same way all the time for it to work. Move your board, the sound changes and screws up the metrics. Or change the caps, or swap the board or the language used.... I think this software would have a hard time with me, I tend to swap caps, modify switches, change boards, etc, pretty often.

There is a better way, though: IBM with solenoid. Drowns out any difference between presses completely.


This is very interesting.