9 ms·
So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly o
by lispisok 3y ago
So they generated training data from one laptop and microphone then generated test data with the exact same laptop and microphone in the same setup, possibly one person pressing the keys too. For the Zoom model they trained a new model with data gathered from Zoom. They call it a practical side channel attack but they didnt do anything to see if this approach could generalize at all
- jprete 3y agoI think this linited attack surface can work without having to generalize one model to multiple people or keyboards. One advantage of a Zoom attack is that you get “plaintext” shortly after hearing the “ciphertext” if you can get the target to type into the chat window. And when you hear typing in other contexts it’s likely to be something that matches a handful of grammars that an LLM can recognize already (written languages, programming languages, commands, calculation inputs) - and when it doesn’t, that’s probably a password.
- voytec 3y agoGood enough for PoC.
- OtherShrezzing 3y agoI believe that is the generalisable version of the attack. You're not looking to learn the sound of arbitrary keyboards with this attack, rather you're looking to learn the sound of specific targets. For example, a Twitch streamer enters responses into their stream-chat with a live mic. Later, the streamer enters their Twitch password. Someone employing this technique could reasonably be able to learn the audio from the first scenario, and apply the findings in the second scenario.
- hackernewds 3y agoseems like a very niche case to be warranting the headline and Hackernews front page
- yowzadave 3y agoI guess more reason to just use a password manager to autofill your password?
- kypro 3y agoOr just use 2fa
- bee_rider 3y agoIf you have 2FA and one part of it is easily figured out, then you have one factor authentication. If you cared enough about the authentication in the first place to bother with 2FA, then I guess it seems like the reduction there is still something to be worried about, right? Lots of “two factor authentication” schemes seem to involve just getting a text or something, so, not very secure at all. Of course, this is bad 2FA, but it is popular.
- gleenn 3y agoPerfect is the enemy of good. Text based 2FA is compromisable relatively easily but at least it's an extra hurdle.
- 3np 3y agoIt's the "or just" being the issue there, not the "use 2fa".
- GhostWhisperer 3y agowhich is the point of 2fa – when the 1st factor fails the 2nd holds
- barrotes 3y agoNow that I know about the existence of this generation of acoustic attacks I would like to have the possibility to insert a second "master password" different from the main one, that instead of letting me directly access to my passwords just allows me to use fingerprint to get them. Guess if it's already possible
- dvngnt_ 3y agofor a few years I've used rtx voice to remove keyboard typing and other background noise
- TechBro8615 3y agoFinally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...
- fatfingerd 3y agoNot according to the article.. Microphones are sensitive enough to mount the attack on quieter keyboards.
- thereisnospork 3y agoWhat we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.
- meepmorp 3y agoI've wanted to integrate a cap gun into a keyboard, basically a an old fashioned roll of paper caps and solenoid to whack 'em, triggered by exclamation points.
- TheCleric 3y agoAdding a gain knob to my keyboard, be right back.
- idbehold 3y agoWhen conducting coding interviews remotely I often switch from my mechanical keyboard to my laptop keyboard (for taking notes) because I know how annoying/distracting that sound can be on calls. Suffice it to say, having a gain knob on my mechanical keyboard would be wonderful.
- someplaceguy 3y agoMy mechanical keyboard already has a knob that I've configured to control the system audio volume, all that's left is configuring Linux to play an audio recording of a keypress every time I press a key...
- bitshiftfaced 3y agoI think maybe you wouldn't even need to see the keystrokes. Given enough examples of just audio, I wonder if you could work out the keys using the statistical letter patterns in language.
- dools 3y agoAnd there are therefore millions of hours of video that could be attack surface area already in the wild
- Geee 3y agoIt's for a targeted attack. It doesn't need to be generalized.
- moonchrome 3y agoSeems simple to defend - use a password manager.
- cmod 3y agountil you have to type your password to unlock it
- tomjakubowski 3y agoyour password manager hopefully uses an additional factor to enable it on a new device, so definitely avoid typing that in on Twitch
- moonchrome 3y agoBiometric unlock or PIN ? I have to type my master password on restart, hopefully you can do that off screen.
- angry_octet 3y agoHigh security safe locks have had protection against this for a long time: you press up/down arrows to move from a random starting digit to the correct digit. On screen pin entry with jumbled number mappings does the same thing. It also makes the inter-stroke delay rather independent of position, because the brain has to search the screen (although repeated digits and previously occuring digits are quicker, which is why some jumble at every keystroke). Keyboards with OLED keys (like the Apple Touchbar or the Optimus[1]) might also work. [1] https://www.artlebedev.com/optimus/popularis/ https://www.artlebedev.com/optimus/popularis/
- omgJustTest 3y agoThe answer is that likely all the above are used. Asking for “what signal it is detecting” might be better asked from a “what is the greatest signal bearing information” being used… which would help in averting attacks. This kind of stuff could be real menacing in all sorts of public places like airports, coffee shops and etc.
- deleted 3y ago[deleted]
- tehwebguy 3y agoDo keystrokes still come through Zoom? The noise filtering has become extremely aggressive lately, often hear people say “Sorry about that engine / ambulance / city noise” but nobody knows what they’re talking about.
- failuser 3y agoHow come keyboard sound suppression is not a standard option in all online communication apps? It’s not that hard, keyboard sounds are pretty distinct.
- surge 3y agoYeah and in fact, I've heard of this attack being done in the past, but it heavily depends on the typist, the keyboard, etc. Cadence, sound, etc changes with the typist and hardware. This isn't new, and has very few, if any practical applications for wide spread replication.
- randomcarbloke 3y agoit is definitely possible to generalise this, a couple of years ago I did the same with a pair of microphones.