Slashdot Log In
The Security Risk of Keyboard Clicks
Posted by
simoniker
on Thu May 13, 2004 07:38 AM
from the tap-tap-oops dept.
from the tap-tap-oops dept.
Gudlyf writes "First the blinking LED security issue, now this: listening to tell-tale keyboard clicks to decipher from afar what a person is typing. This isn't limited to just computer keyboards -- ATM's, telephone keypads, security doors, etc. Apparently with $200 worth of sound equipment and software, these keyboard clicks can be translated to within 80% accuracy. Of course, a whole lot of this is just theory."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Great... (Score:5, Funny)
Of course, someone will probably now figure out that tapped glass reverberates at a different frequency...
Re:Great... (Score:5, Interesting)
Sorry.
Parent
Re:Great... (Score:5, Insightful)
Parent
Re:Great... (Score:5, Funny)
It seems that no matter what you do, we'll be screwed anyway. We might as well go to a trust-based system. How about everybody just changes all their passwords to 'secret'?
Parent
Re:Great... (Score:5, Funny)
First somebody gives away the 12345, now secret.
Sheesh.. What's this world coming too?
-J-
Parent
Re:Great... (Score:3, Funny)
Ah Spaceballs, what would we do without you?
Re:Great... (Score:3, Interesting)
Re:Great... (Score:5, Interesting)
I came across this type of device when entering a bank building. You had to enter a 6-digit code into a keypad to unlock the door. Each key was a tiny LCD display and the location of each digit was randomized for each use.
Parent
Re:Great... (Score:5, Funny)
Parent
Re:Great... (Score:4, Interesting)
7 5 2
4 3 1
0 9 6
8
This solves the problem for ATMs. If you dim the LEDs and polarize the light, you would make it more difficult for a camera to find the password also. Obviously this only applies to a numeric keypad (for ATMs and the like) since it would be a pain in the ass to change the lettering dynamically on a keyboard (at least for the user). The solutions for those using keyboards could be as simple as using a smartcard with a PIN number (which you enter on the randomized 10 digit display). The sooner we get rid of the biggest security risk on computers IMHO (guessable passwords) the better.
Parent
Re:Great... (Score:3, Insightful)
Re:Great... (Score:5, Informative)
Of course, it took about 5 times longer to get in than with a key or swipe card (since the code was 8 numbers), but there's always a trade-off.
here's a picutre [semcorp.com] of one.
Parent
low~ (Score:5, Informative)
Yeah, I put a surprise in there too
Sounds fishy (no pun intended) (Score:3, Interesting)
Well, while hitting the keys harder or softer may make little difference (note that the frequency is captured), doing weird tricks like
Re:Sounds fishy (no pun intended) (Score:3, Insightful)
It seems to me that the only way to defeat this is to modify or otherwise conceal the noise of te keyboard. But what would be the point of doing that? If someone has been able to plant a microphone sensitive enough to detect subtle differences i
Re:Sounds fishy (no pun intended) (Score:3, Interesting)
Then there's always the copy-and-paste method - copy characters off the screen and paste into the password window.
'scuse me, I'm low on aluminum foil.
"Of course, a whole lot of this is just theory." (Score:5, Funny)
Re:"Of course, a whole lot of this is just theory. (Score:5, Insightful)
Statement 1: "Apparently with $200 worth of sound equipment and software, these keyboard clicks can be translated to within 80% accuracy."
Statement 2: "Of course, a whole lot of this is just theory."
My Statement: No, only one of those statements can be true
Parent
Security risks (Score:5, Insightful)
Its not like I have the secrets to nuclear weapons research, nor do I have tomorrows stock market numbers. I and average Joe 24 Pack.
So you can listen to my keystrokes and decipher what I am typing. I'm sure that if you asked me, I'd tell you anyway. People are far greater a security risk than computers.
And well, if you have such sensative documents, Tempest your computer, unplug it from EVERY network and work.
I agree that these are good academic exercises to see how one person can spy on another, but does it matter to 99% of the world. NO. Anywho, my girlfriend just yelled at me so I needed to vent.
Re:Security risks (Score:5, Funny)
Anywho, my girlfriend just yelled at me so I needed to vent.
Huh? Quit making up words!
Parent
bah (Score:4, Insightful)
80% accuracy can be useless... or not (Score:5, Interesting)
OTOH if all you want is a 6-character password, and it's typed a couple of times a day, then listening with 80% accuracy for a day may well be enough.
Re:80% accuracy can be useless... or not (Score:3, Interesting)
Also, if the software provide with the estimated value for the accuracy of each keystroke (and which other key stroke may be likely for the produced sound) then you can direct your keyspace search to the most likely key first.
One of the problem I have with this technique is that the guy had to record the sound of each key 30 times before starting to try to recognize keystrok
Re:80% accuracy can be useless... or not (Score:3, Informative)
Actually, it will reduce the key space by much more than that. Assume a 10 char password, with each char picked among 96 (Ascii without ctrl chars).
Without any help, you'd have 96**10 = 66483263599150104576 possibilities to try out.
By having the output from the algorithm, and assuming only two of its guess are false, you'd only have to try 10*9/2*96*96 = 414720 combinations.
Well, of course, you don't know that exactly two chara
Re:80% accuracy can be useless... or not (Score:3, Interesting)
Not to be a math nazi... but to just squeeze out the minimal qualification of "hundreds" of errors per page, assuming you're speaking at the granularity of single words (since that's the granularity spell checks work at), you'd have to have 1000 words per page. I doubt most professional documents would have that many words per page (and you'd have to do it at an 8 point font to make it happen anyway), so it may be of some use after all, especially where accuracy is less important, or the documents are small
LED clock (Score:3, Funny)
This is easy to overcome (Score:5, Funny)
Thereby ensuring NOBODY's going to be able to decipher a word you're saying.
ATM sounds (Score:3, Interesting)
This also got me thinking, I used to have an old MAC IIe, when you selected menu items (from that top mac tool bar) different pitches were emitted from the pc, they were quiet and possible actually created from the guns in the tube itself, but this type of thing could be used to figure out what ppl are doing... idontevenknow....
New Technique for Wireless Keyboard (Score:3, Interesting)
Place clever sig here
More reason than ever... (Score:4, Informative)
Obligatory Heinlien Reference.... (Score:3, Interesting)
Anyhow, the coordinator of the group would report the status of the group to the outside via computer. However there was only one computer and she typed on the keyboard by setting her hands under a shelf that masked the users typing. There was no screen. She simply made her notes, requests, etc by typing blindly on that keyboard.
At an old networking facility I worked at we had a similar system in place to enter the server room, there was a keypad set into the wall next to the door and in order to enter your code for entry you had to place your hand inside the little 4X4 box that masked/overlayed the keypad. Add in the background noise from the HVAC systems outside the room and we pretty much had/have a secured system.
Huh (Score:5, Funny)
If only science weren't so expensive. Imagine how many other theories we could test if we could somehow get our hands on $500!
Finkployd
will never break my password (Score:4, Funny)
Doh
Yeah ... RIGHT (Score:4, Insightful)
Eighty percent accuracy after "voiceprinting" each key thirty times and using neural nets to arrive at an abstract sound signature for each key? Of course, the simple expedient of changing keyboards will defeat that. Or by the other obvious antidote
Blinking lights on a modem can be decoded to yield the byte values sent and received? DUH
Sleep well tonight, your AFDB Brigade is on duty and alert!
Re:Yeah ... RIGHT (Score:3, Insightful)
Background noise would not help (Score:4, Interesting)
If you were to train a rifle mic direct at a keyboard from say, 20 metres away in a very busy work environment you could easily pick it up. You can also use a basic 32 band EQ to remove most noise outside of the keyboard clicking frequency.
Background noise isn't really a problem - it's truly amazing what you can do with the correct equipment. For example, the USSR bugged a US embassy by donating an wall mounted American seal. It was sweeped for bugs, and nothing found. This was because there wasn't actually a bug in there - just a simple thin wire, that would vibrate with speech. The USSR then used a highly directional microphone across the street trained at the seal. They were then able to take the vibrations of the wire, and enhance them into speech.
And that was around 20 years ago, long before the sound digital enhancement techniques of today.
So I'll sleep well, but in the knowledge that background noise ain't going to help me that much. To stop keyboard noises the noise would have to be so loud you probably wouldn't be able to work anyway.
Parent
Can be done by ear as well (Score:5, Interesting)
IT professionals: don't ignore this (Score:5, Interesting)
As IT pros, this should have a significant impact on how you think about your IT security policies. Strong password policies are still important, but this further exaggerates the need for strong physical security for all your terminals and surrounding areas.
Future - Speech Recognition (Score:3, Funny)
This technology was bound to emerge (Score:5, Interesting)
In other news: (Score:5, Funny)
Sneakers (Score:3, Informative)
No worries. (Score:3, Funny)
My Model M doesn't have a rubber membrane so I'm not worried. Then again you don't need a microphone to hear me typing on it. My neighbours can hear me typing. If someone were to stick a microphone up to it I'd be interested to know how much of their hearing they'd retain.
Fear and Paranoia Abound (Score:5, Insightful)
If you need to dispose of something with a credit card or bank account number printed on it, you could reasonably buy a paper shredder. This s warranted. However, I prefer the much simpler "temporal/spatial displacement" approach. It's about the highest level of paranoia I, peronally, indulge in. You simply tear off about two thirds of the printed account number and throw away the original document. It only has a few digits of the account number. Likely, not enough to be of use to a dumpster diver. Then you take the two thirds of the number that you tore off of the original document and tear it in half. Take it to work, or to a store or some other location and only dispose of one half of that remaining two thirds. Finally, after a wait of as long a period of time as you wish, dispose of the last bit at another remote location. (A friend's house, your parent's place, a bar, etc...) Only the most meticulous of identity thieves will bother tracking your actions in that way. If you have that level of snoop on your tail, I think you've got bigger problems than simple identity theft. You're either delusional, or you have really upset someone VERY HIGH UP.
So people, put down the crack pipes and get to realizing that there are VERY few people who care about you or your data. Fight the fear. Pound paranoia into the ground. There is little to be afraid of.
I should have saved my Atari 400 (Score:3, Funny)
Nueral Network... (Score:3, Insightful)
Who needs a machine when we've got the Mounties!?! (Score:3, Funny)
Anybody who saw the episode of the CBS evening buddy-cop-drama "Due South: A Hawk and a Handsaw" [realduesouth.com] knows that you don't need any special equipment. Just get a Canadian Mountie, have him listen to a nurse while she types in her password, and after several tries, the Mountie will be able to reproduce the password based solely on the sound of the clicks... Results are even better if the password is typed in to the tune of "I've been working on the railroad.".
In theory... (Score:3, Funny)
Of course, in theory:
- the earth is spherical in shape
- the earth revolves around the sun
- we evolved from lower species
- energy equals mass times the speed of light squared
easy fix. (Score:5, Funny)
Re:Hmmm (Score:3, Funny)
It's only a matter of time before they interpret the crinkling noises made by our protective hats and are able to read our very thoughts!