3 ms·

How worried should I be about this? The paper doesn't mention any mitigation strategies and kinda makes it sound like anybody with a wifi router ("Free Wifi") c

by rtpg 10y ago

How worried should I be about this? The paper doesn't mention any mitigation strategies and kinda makes it sound like anybody with a wifi router ("Free Wifi") could get me.

annnnd 10y ago
The tests were conducted in controlled environment - real world is another thing entirely. And if you are worried about this, then you should probably shield your computer because normal PCs emit lots of data in form of electromagnetic waves. But unless you are concerned about state-sponsored three-letter agencies spying on you (individually), I don't think there is much reason for concern. Obligatory XKCD: http://xkcd.com/538/ http://xkcd.com/538/
- tigroferoce 10y ago
  I agree on this point. A controlled environment is different from real world. It's not the first paper on this types of attacks: I remember one where the microphone of an iPhone was used to register the sound of keypressed on a keyboard [1] and another one where the vibrations on objects were used to infer the oral communication inside a closed room [2]. The main consideration is that it largely depends on who is your attacker. If you think about regular people, you should be fine; state-sponsored attackers know way too many techniques for you to be safe, unless you get very paranoid. Also keep in mind that these attacks (AFAIK) do not scale and are not automated, so a state attacker should be explicitly targeting you. Finally, you should consider that modern computers and mobile phones have so many security issues that using these advanced physical-world attacks is not necessary. [1] https://en.wikipedia.org/wiki/Acoustic_cryptanalysis https://en.wikipedia.org/wiki/Acoustic_cryptanalysis [2] http://news.mit.edu/2014/algorithm-recovers-speech-from-vibrations-0804 http://news.mit.edu/2014/algorithm-recovers-speech-from-vibr...
- astrodust 10y ago
  You could also live in a Faraday cage, but that is probably impractical.
martinko 10y ago
I would expect this to also work on networks that the attacker does not have access to. He only needs to observe signal changes, not the actual signal, so wifi encryption should not be a factor.
- rtpg 10y ago
  My reading is that the wifi sender needs to be sending at a pretty constant rate, but maybe that's just to make testing easier.
crispweed 10y ago
I didn't read the whole thing, but one thing I noted was that it looks like their results are based on 'user specific training', i.e. with a model specific to one persons hands, typing patterns, etc. Generalising this will then surely be a lot more difficult.

by rtpg 10y ago

How worried should I be about this? The paper doesn't mention any mitigation strategies and kinda makes it sound like anybody with a wifi router ("Free Wifi") could get me.

annnnd 10y ago

The tests were conducted in controlled environment - real world is another thing entirely. And if you are worried about this, then you should probably shield your computer because normal PCs emit lots of data in form of electromagnetic waves. But unless you are concerned about state-sponsored three-letter agencies spying on you (individually), I don't think there is much reason for concern. Obligatory XKCD: http://xkcd.com/538/ http://xkcd.com/538/

tigroferoce 10y ago
I agree on this point. A controlled environment is different from real world. It's not the first paper on this types of attacks: I remember one where the microphone of an iPhone was used to register the sound of keypressed on a keyboard [1] and another one where the vibrations on objects were used to infer the oral communication inside a closed room [2]. The main consideration is that it largely depends on who is your attacker. If you think about regular people, you should be fine; state-sponsored attackers know way too many techniques for you to be safe, unless you get very paranoid. Also keep in mind that these attacks (AFAIK) do not scale and are not automated, so a state attacker should be explicitly targeting you. Finally, you should consider that modern computers and mobile phones have so many security issues that using these advanced physical-world attacks is not necessary. [1] https://en.wikipedia.org/wiki/Acoustic_cryptanalysis https://en.wikipedia.org/wiki/Acoustic_cryptanalysis [2] http://news.mit.edu/2014/algorithm-recovers-speech-from-vibrations-0804 http://news.mit.edu/2014/algorithm-recovers-speech-from-vibr...
astrodust 10y ago
You could also live in a Faraday cage, but that is probably impractical.

martinko 10y ago

I would expect this to also work on networks that the attacker does not have access to. He only needs to observe signal changes, not the actual signal, so wifi encryption should not be a factor.

rtpg 10y ago
My reading is that the wifi sender needs to be sending at a pretty constant rate, but maybe that's just to make testing easier.

crispweed 10y ago

I didn't read the whole thing, but one thing I noted was that it looks like their results are based on 'user specific training', i.e. with a model specific to one persons hands, typing patterns, etc. Generalising this will then surely be a lot more difficult.