6 ms·

Interestingly novel! In my university days, long before the days of tablets and smartphones, the computer labs were the usual place where people will congregat

by kinkora 10y ago

Interestingly novel! In my university days, long before the days of tablets and smartphones, the computer labs were the usual place where people will congregate to do their assignments or basically kill time on the internet in between classes. One day, my mates and I noticed how annoyingly loud some people type on their keyboards and out of sheer boredom, we decided we could come up with an algorithm to determine what a person was typing simply from recording the sound of the keystrokes from our vantage point. Taking that sound clip, we graphed it out and we proceeded to hash out each "stroke" based on how loud it was in relation to the distance of where we were from the keyboard + the angle of the keyboard. Fun times ensued. ;)

NoCoastCoder 10y ago
And this worked? Seems hard to believe.
- nerdponx 10y ago
  I think I read about a similar "keylogging" technique in Popular Science at one point.
  - trendia 10y ago
    Researchers recover typed text using audio recording of keystrokes (2005) [0] [0] http://www.berkeley.edu/news/media/releases/2005/09/14_key.shtml http://www.berkeley.edu/news/media/releases/2005/09/14_key.s...
    - purrcat259 10y ago
      Turns out my ducky blues mechanocal keyboard has a big disadvantage when it comes to this then
- cmdrfred 10y ago
  It would cut entropy down by a great deal if you even simply knew how long the password was.
  - wruza 10y ago
    I've seen a movie where a bad guy entered password and a good girl counted the number of characters: one-two-three-four-five. Then she noticed that his suit had "GREED" badge on it. Combining these two facts she succesfully hacked into his laptop and prevented some shit. Since then I started to always mix few backspaces into my passwords. Not that I'm really bad, but life is life.
    - ballenf 10y ago
      The backspace key on most keyboards has a very distinct sound. Not to mention it's positioning means timing will be noticeably different as well. Might be better off mixing in a few meaningless modifier keys (press Ctrl, Alt or Caps Lock).
      - sigjuice 10y ago
        I usually type a long string of gibberish, sneak in ctrl-U at some point and then enter my actual password
        idanoeman 10y ago
        Unless the gibberish is the same every time, the repeated sound of your password will still be parsable from a long enough sound recording of your computer usage.
        sigjuice 10y ago
        The gibberish is unlikely to ever be the same.
        jaredsohn 10y ago
        I think it is more accurate to say that the gibberish is unlikely to _always_ be the same. I think one can tend to create similar gibberish over time. I've worked on a system where I needed to do a new signup every time I wanted to test a feature and I've run into issues where the gibberish I entered matched an account that I had previously created.
- deleted 10y ago
  [deleted]
- scoot 9y ago
  No. The idea that you could discern the difference between keys based on their relative volume due to their distance and angle from the recording device is complete nonsense. OP is living a fantasy and taking HN along for the rise.
- scoot 9y ago
  No. The idea that you could discern the difference between keys based on their relative volume due to their distance and angle from the recording device is complete nonsense. OP is living a fantasy and taking HN along for the ride.
user5994461 10y ago
There is a paper from one of the guys who made RSA about that. They can reconstitute private keys, by listening repeatedly to the sound the power supply of a laptop makes when encrypting/decrypting emails, from 5m away.
- Shivetya 10y ago
  the good old days in the military where our main communications computers and such were in shielded areas to prevent leakage outside which could be picked up.
  - Neliquat 9y ago
    Tempest certification is still very much alive and well fyi.
- enraged_camel 10y ago
  This type of thing is called a side-channel attack, if you're interested. https://en.wikipedia.org/wiki/Side-channel_attack https://en.wikipedia.org/wiki/Side-channel_attack
programd 10y ago
I think it was in the book Spycatcher [0] that I recall there was a story of how English intelligence bugged a foreign embassy with a microphone and was able to figure out what they were typing on a typewriter by analyzing the sound of the keystrokes. That was way back in the 1950's I think, so the idea has been around for a while. The book has a lot of interesting details about spy technology at the time. In addition to all the juicy intelligence stories it's also a fun read from a security engineering point of view. The British government tried to ban it which naturally triggered the Streisand effect and made it a best seller. [0] https://en.wikipedia.org/wiki/Spycatcher https://en.wikipedia.org/wiki/Spycatcher
ww520 10y ago
The good old side channel attack. Kudos.
kakarot 10y ago
Acoustic analysis of keystrokes is nothing new to most of us. Some of us are even familiar with acoustic cryptoanalysis[0]. However, combine these methods with this[1] tech, inspired on the work done here[2], and we have ourselves an impending crisis on our hands. [0] Acoustic Cryptoanalysis - https://courses.csail.mit.edu/6.857/2014/files/23-shroff-hu-tang-acoustic-cryptanalysis.pdf https://courses.csail.mit.edu/6.857/2014/files/23-shroff-hu-... [1] Extracting Audio From Visual Information - https://news.mit.edu/2014/algorithm-recovers-speech-from-vibrations-0804 https://news.mit.edu/2014/algorithm-recovers-speech-from-vib... [2] Eularian Video Magnification - https://people.csail.mit.edu/mrub/papers/vidmag.pdf https://people.csail.mit.edu/mrub/papers/vidmag.pdf Let's run through a scenario. Your office orders pizza every Tuesday at the same time, via a coworker's cell phone. You are working on a technology that has the potential to disrupt several leading industries that are in bed with the government. After much lobbying, it is decided one day that your call to Domino's is to be rerouted via your broadband processor to an operative that mirrors your order to the real Domino's, and hand delivers the pizza at the front desk. On their way out, they place a small, embedded, self-destructable camera device that focuses on your fancy new plexiglass installment. Over the next few weeks, the device documents all keystrokes and conversations from the front desk, and finds a way to socially engineer a copy of your codebase. Next year, seemingly out of nowhere, another venture suddenly launches ahead of your launch schedule, with your exact business model. All because you wanted some plexiglass and didn't think it was worth the money to actively scan the entire perimeter for bugs daily. If this sounds crazy and far-fetched to anyone, then it would behoove them to look into past CIA infiltration techniques and also to realize that this is exactly the kind of stuff the CIA exists to do.
evincarofautumn 10y ago
That reminds me—in elementary school, I used to figure out what someone was writing by listening to the sound of their pencil, sometimes by putting my head to the desk. It probably worked mainly because they were writing pretty slowly in large print, but I imagine you could come up with a software implementation as a useless gimmick if you had enough training data. I’ve considered implementing this as a keyboard layout in Android, so you could put your phone on the desk and type by scratching a stylus or fingernail on the surface next to it.

by kinkora 10y ago

NoCoastCoder 10y ago

And this worked? Seems hard to believe.

nerdponx 10y ago
I think I read about a similar "keylogging" technique in Popular Science at one point.
- trendia 10y ago
  Researchers recover typed text using audio recording of keystrokes (2005) [0] [0] http://www.berkeley.edu/news/media/releases/2005/09/14_key.shtml http://www.berkeley.edu/news/media/releases/2005/09/14_key.s...
  - purrcat259 10y ago
    Turns out my ducky blues mechanocal keyboard has a big disadvantage when it comes to this then
cmdrfred 10y ago
It would cut entropy down by a great deal if you even simply knew how long the password was.
- wruza 10y ago
  I've seen a movie where a bad guy entered password and a good girl counted the number of characters: one-two-three-four-five. Then she noticed that his suit had "GREED" badge on it. Combining these two facts she succesfully hacked into his laptop and prevented some shit. Since then I started to always mix few backspaces into my passwords. Not that I'm really bad, but life is life.
  - ballenf 10y ago
    The backspace key on most keyboards has a very distinct sound. Not to mention it's positioning means timing will be noticeably different as well. Might be better off mixing in a few meaningless modifier keys (press Ctrl, Alt or Caps Lock).
    - sigjuice 10y ago
      I usually type a long string of gibberish, sneak in ctrl-U at some point and then enter my actual password
      - idanoeman 10y ago
        Unless the gibberish is the same every time, the repeated sound of your password will still be parsable from a long enough sound recording of your computer usage.
        sigjuice 10y ago
        The gibberish is unlikely to ever be the same.
        jaredsohn 10y ago
        I think it is more accurate to say that the gibberish is unlikely to _always_ be the same. I think one can tend to create similar gibberish over time. I've worked on a system where I needed to do a new signup every time I wanted to test a feature and I've run into issues where the gibberish I entered matched an account that I had previously created.
deleted 10y ago
[deleted]
scoot 9y ago
No. The idea that you could discern the difference between keys based on their relative volume due to their distance and angle from the recording device is complete nonsense. OP is living a fantasy and taking HN along for the rise.
scoot 9y ago
No. The idea that you could discern the difference between keys based on their relative volume due to their distance and angle from the recording device is complete nonsense. OP is living a fantasy and taking HN along for the ride.

user5994461 10y ago

There is a paper from one of the guys who made RSA about that. They can reconstitute private keys, by listening repeatedly to the sound the power supply of a laptop makes when encrypting/decrypting emails, from 5m away.

Shivetya 10y ago
the good old days in the military where our main communications computers and such were in shielded areas to prevent leakage outside which could be picked up.
- Neliquat 9y ago
  Tempest certification is still very much alive and well fyi.
enraged_camel 10y ago
This type of thing is called a side-channel attack, if you're interested. https://en.wikipedia.org/wiki/Side-channel_attack https://en.wikipedia.org/wiki/Side-channel_attack

programd 10y ago

I think it was in the book Spycatcher [0] that I recall there was a story of how English intelligence bugged a foreign embassy with a microphone and was able to figure out what they were typing on a typewriter by analyzing the sound of the keystrokes. That was way back in the 1950's I think, so the idea has been around for a while. The book has a lot of interesting details about spy technology at the time. In addition to all the juicy intelligence stories it's also a fun read from a security engineering point of view. The British government tried to ban it which naturally triggered the Streisand effect and made it a best seller. [0] https://en.wikipedia.org/wiki/Spycatcher https://en.wikipedia.org/wiki/Spycatcher

ww520 10y ago

The good old side channel attack. Kudos.

kakarot 10y ago

Acoustic analysis of keystrokes is nothing new to most of us. Some of us are even familiar with acoustic cryptoanalysis[0]. However, combine these methods with this[1] tech, inspired on the work done here[2], and we have ourselves an impending crisis on our hands. [0] Acoustic Cryptoanalysis - https://courses.csail.mit.edu/6.857/2014/files/23-shroff-hu-tang-acoustic-cryptanalysis.pdf https://courses.csail.mit.edu/6.857/2014/files/23-shroff-hu-... [1] Extracting Audio From Visual Information - https://news.mit.edu/2014/algorithm-recovers-speech-from-vibrations-0804 https://news.mit.edu/2014/algorithm-recovers-speech-from-vib... [2] Eularian Video Magnification - https://people.csail.mit.edu/mrub/papers/vidmag.pdf https://people.csail.mit.edu/mrub/papers/vidmag.pdf Let's run through a scenario. Your office orders pizza every Tuesday at the same time, via a coworker's cell phone. You are working on a technology that has the potential to disrupt several leading industries that are in bed with the government. After much lobbying, it is decided one day that your call to Domino's is to be rerouted via your broadband processor to an operative that mirrors your order to the real Domino's, and hand delivers the pizza at the front desk. On their way out, they place a small, embedded, self-destructable camera device that focuses on your fancy new plexiglass installment. Over the next few weeks, the device documents all keystrokes and conversations from the front desk, and finds a way to socially engineer a copy of your codebase. Next year, seemingly out of nowhere, another venture suddenly launches ahead of your launch schedule, with your exact business model. All because you wanted some plexiglass and didn't think it was worth the money to actively scan the entire perimeter for bugs daily. If this sounds crazy and far-fetched to anyone, then it would behoove them to look into past CIA infiltration techniques and also to realize that this is exactly the kind of stuff the CIA exists to do.

evincarofautumn 10y ago

That reminds me—in elementary school, I used to figure out what someone was writing by listening to the sound of their pencil, sometimes by putting my head to the desk. It probably worked mainly because they were writing pretty slowly in large print, but I imagine you could come up with a software implementation as a useless gimmick if you had enough training data. I’ve considered implementing this as a keyboard layout in Android, so you could put your phone on the desk and type by scratching a stylus or fingernail on the surface next to it.