6 ms·
Actually, the exploit with the keyboards is both more interesting and more sophisticated than that. As described in Silence On The Wire, essentially how it work
by unimpressive 9y ago
Actually, the exploit with the keyboards is both more interesting and more sophisticated than that. As described in Silence On The Wire, essentially how it works is that English letters are not randomly distributed. If you hear any given keystroke, you know that the most likely letter to be pressed knowing nothing else is the letter 'e'. This on its own isn't very helpful, but you don't type every letter on your keyboard at the same speed. It takes you ever so slightly longer to type 'z' than 'f'. You of course also only type one key at a time, as a consequence it's possible to merely follow a procedure something like this to recover English text given audio of it being typed on a standard keyboard:
- Assign a prior probability of letter frequencies based on a corpus of the language text you're analyzing.
- Separate the different keystrokes in the audio file into a series of times between keystrokes. (i.e, have your program recognize one keystroke as distinct from another)
- Based on the subtle timing differences between keystrokes, assign various lengths to different timings.
- Using the prior probability of the letter frequencies, assign the different time lengths to different characters based on their frequencies.
- You now have a straightforward mapping between the distance between two keystrokes and the character typed, which should allow you to decode the typed text.
Further calibration can probably be had by considering a word dictionary and using fuzzy matching to detect how often words are decoded incorrectly and what the correct decoding would be.
- smrq 9y agoThat's absolutely fascinating, not to mention a stronger attack. I use a self-designed and manufactured keyboard, so I'd definitely be immune to a database of various keyboard designs--mine is one-of-a-kind. But I doubt that the differences in key layout would be sufficient to thwart the timing attack. Of course, if you know or suspect that you are under such surveillance, you could try and alter your typing cadence, e.g. by switching to hunt-and-peck.
- ghettoimp 9y agoPerhaps some good music is the perfect defense. It would obscure the sound of the keyboard, and also make it easy to type with the beat. :)
- zentiggr 9y agoOr switch to alternate keyboard layouts that have dissimilar key distances & locations. Using Dvorak/Colemak etc would throw this method off unless it managed to retrain for the particular differences due to layouts. Maybe a random layout generator that would mask this effect and only cost typing speed for the extra defense?