5 ms·

Also a good time to mention “Van Eck Radiation”. This is something all CRT screens, and to a lesser extent, LCDs, emit. If you pick up this radiation and know t

Also a good time to mention “Van Eck Radiation”. This is something all CRT screens, and to a lesser extent, LCDs, emit. If you pick up this radiation and know the model of the screen being used, you essentially have access to a live visual of a person’s monitor. Also worth mentioning that just like the Secret Service has an ink database on all the printer types in the world, the NSA is supposed to have a database of what different keyboards sound like. This means that simply by recording the sound of you typing, they can infer keystrokes / characters. Obviously the easiest way to record this is by hacking your phone, which is right next to you. https://en.m.wikipedia.org/wiki/Van_Eck_phreaking https://en.m.wikipedia.org/wiki/Van_Eck_phreaking

unimpressive 9y ago
Actually, the exploit with the keyboards is both more interesting and more sophisticated than that. As described in Silence On The Wire, essentially how it works is that English letters are not randomly distributed. If you hear any given keystroke, you know that the most likely letter to be pressed knowing nothing else is the letter 'e'. This on its own isn't very helpful, but you don't type every letter on your keyboard at the same speed. It takes you ever so slightly longer to type 'z' than 'f'. You of course also only type one key at a time, as a consequence it's possible to merely follow a procedure something like this to recover English text given audio of it being typed on a standard keyboard: - Assign a prior probability of letter frequencies based on a corpus of the language text you're analyzing. - Separate the different keystrokes in the audio file into a series of times between keystrokes. (i.e, have your program recognize one keystroke as distinct from another) - Based on the subtle timing differences between keystrokes, assign various lengths to different timings. - Using the prior probability of the letter frequencies, assign the different time lengths to different characters based on their frequencies. - You now have a straightforward mapping between the distance between two keystrokes and the character typed, which should allow you to decode the typed text. Further calibration can probably be had by considering a word dictionary and using fuzzy matching to detect how often words are decoded incorrectly and what the correct decoding would be.
- smrq 9y ago
  That's absolutely fascinating, not to mention a stronger attack. I use a self-designed and manufactured keyboard, so I'd definitely be immune to a database of various keyboard designs--mine is one-of-a-kind. But I doubt that the differences in key layout would be sufficient to thwart the timing attack. Of course, if you know or suspect that you are under such surveillance, you could try and alter your typing cadence, e.g. by switching to hunt-and-peck.
  - ghettoimp 9y ago
    Perhaps some good music is the perfect defense. It would obscure the sound of the keyboard, and also make it easy to type with the beat. :)
  - zentiggr 9y ago
    Or switch to alternate keyboard layouts that have dissimilar key distances & locations. Using Dvorak/Colemak etc would throw this method off unless it managed to retrain for the particular differences due to layouts. Maybe a random layout generator that would mask this effect and only cost typing speed for the extra defense?

unimpressive 9y ago

Actually, the exploit with the keyboards is both more interesting and more sophisticated than that. As described in Silence On The Wire, essentially how it works is that English letters are not randomly distributed. If you hear any given keystroke, you know that the most likely letter to be pressed knowing nothing else is the letter 'e'. This on its own isn't very helpful, but you don't type every letter on your keyboard at the same speed. It takes you ever so slightly longer to type 'z' than 'f'. You of course also only type one key at a time, as a consequence it's possible to merely follow a procedure something like this to recover English text given audio of it being typed on a standard keyboard: - Assign a prior probability of letter frequencies based on a corpus of the language text you're analyzing. - Separate the different keystrokes in the audio file into a series of times between keystrokes. (i.e, have your program recognize one keystroke as distinct from another) - Based on the subtle timing differences between keystrokes, assign various lengths to different timings. - Using the prior probability of the letter frequencies, assign the different time lengths to different characters based on their frequencies. - You now have a straightforward mapping between the distance between two keystrokes and the character typed, which should allow you to decode the typed text. Further calibration can probably be had by considering a word dictionary and using fuzzy matching to detect how often words are decoded incorrectly and what the correct decoding would be.

smrq 9y ago
That's absolutely fascinating, not to mention a stronger attack. I use a self-designed and manufactured keyboard, so I'd definitely be immune to a database of various keyboard designs--mine is one-of-a-kind. But I doubt that the differences in key layout would be sufficient to thwart the timing attack. Of course, if you know or suspect that you are under such surveillance, you could try and alter your typing cadence, e.g. by switching to hunt-and-peck.
- ghettoimp 9y ago
  Perhaps some good music is the perfect defense. It would obscure the sound of the keyboard, and also make it easy to type with the beat. :)
- zentiggr 9y ago
  Or switch to alternate keyboard layouts that have dissimilar key distances & locations. Using Dvorak/Colemak etc would throw this method off unless it managed to retrain for the particular differences due to layouts. Maybe a random layout generator that would mask this effect and only cost typing speed for the extra defense?