4 ms·

Every key stroke has a unique sound signature. You just need to record it with a microphone that isn't terrible. For this reason a bugged room can be a bug in e

Every key stroke has a unique sound signature. You just need to record it with a microphone that isn't terrible. For this reason a bugged room can be a bug in every keyboard in that room if the attacker is assumed to be sophisticated. There have been some projects which attempted this[1]. It may be hard to do a non-terrible DIY laser microphone that would allow to achieve this while targeting a non-laptop surface. After you have the recording the biggest challenge is a problem solving one, you need to isolate the waveform for every keystroke, convert it to something that can be compared with other waveforms (and cluster them) and then solve the resultant substitution cipher (waveform -> key identity). If the keyboard was used for any length of time, you can assume the entry of common words and phrases occurred at some point and the solution to the cipher is trivial. If you have the resources to collect the data, it should be possible to train a transformer model to convert an audio recording to the output of sound signatures belonging to key strokes of a keyboard or multiple keyboards. The trick would be to not try to train it to do the entire problem which will almost certainly fail or not generalize. [1] <https://github.com/shoyo/acoustic-keylogger https://github.com/shoyo/acoustic-keylogger>

spondylosaurus 2y ago
Re. "every key stroke has a unique sound signature": is this because each key in a keyboard has subtle differences/defects unique to that particular device, or because of where the key sits within a QWERTY keyboard, geometry-wise? I'm trying to understand whether this requires a "decoder ring" recording ahead of time (in the case of the former—okay, on this keyboard an A sounds like this, a B sounds like this...), or whether you'd be able to pull this off with no prep work because an A always sounds like an A and a B always sounds like a B.
- travisjungroth 2y ago
  Your question is off a bit. It isn’t exactly either of those. Each combination of room, mic, keyboard, and letter is going to have a unique sound signature. But, you don’t need prep work. If you can just record enough keystrokes, it’s possible to figure out what sounds go with what letters. This is the “substitution cipher” the other comment mentioned. For example, the sound that comes every 2-10 letters or so but rarely twice is spacebar. The one that sometimes comes between two spaces is I. It’s obviously more advanced, but just to give you an idea.
  - spondylosaurus 2y ago
    Ahhh that makes sense! And sounds a lot less convoluted than either of the methods I envisioned :P
  - account42 2y ago
    > The one that sometimes comes between two spaces is I A convenient theory but not a fact.
    - allannienhuis 2y ago
      Why does it need to be perfectly accurate? These are examples intended to communicate the principle, not instructions on how to do frequency analysis. This description may be incomplete, but it does make it pretty clear how frequency analysis works in general terms. This criticism seems misplaced to me.
      - travisjungroth 2y ago
        > These are examples intended to communicate the principle, not instructions on how to do… Thank you. A lot of people don’t get these are two different things. I’m not going for perfect, I’m going for “oh I get it.”
  - joncrocks 2y ago
    I believe this approach in general is known as https://en.wikipedia.org/wiki/Frequency_analysis https://en.wikipedia.org/wiki/Frequency_analysis It would be trickier however if looking at raw keystrokes, as one has to consider several confounding factors: * The caret can be moved both by keystrokes and mouse * You don't know what is being typed. If someone is typing people's names all day, or writing software then the analysis of letter/key frequency will be shifted Not impossible, but makes the process harder.
    - lrschaeffer 2y ago
      Yeah, lots of different uses for a keyboard with wildly different frequency distributions. Writing an English letter != text chat in Spanish != data entry != league of legends. It's also not quite a substitution cipher due to modifiers (shift), toggles (caps lock), non-printable characters (escape, volume up/down), and deletion (backspace/delete). It's an interesting problem you'd probably try to solve with Markov chains back in the day, but now you'd just throw machine learning at.
- lrschaeffer 2y ago
  As other commenters have said, you're just going to learn the decoder ring from context, but I'm also curious. If I take off the keycaps to clean the keyboard and then put them back, do I need to relearn the defects? If I rip out all the switches and rearrange them, do the defects follow the switches or is it more about the position of the key? Is there some resonance that could change if I move the keyboard onto a desk pad. If I switch to Dvorak in software, obviously the key presses mean something different, but also I'll type completely differently. How much does user cadence/timing matter? To what extent is user cadence/timing identifying? Anyway, I assume the answers aren't known because it would be an ethics/privacy nightmare to run these kinds of experiments on anyone but yourself.
reachableceo 2y ago
You would presumably need todo this for the exact keyboard and acoustic properties of your target. And , what if they move the keyboard to their lap? Or put the keyboard legs down? Also many keyboards are very quiet clicks these days. And what if I’m playing music? I imagine a surreptitiously planted keystroke logger is far simpler. Or perhaps camera(s).
- seanthemon 2y ago
  If you have access to the target computer you would just hack it directly to send you the information like an evil maid attack. No reason to do this keystroke sound hooey..
  - deleted 2y ago
    [deleted]
- Aardwolf 2y ago
  Mine has clicky clicks, because I like it! Perhaps a speaker in the keyboard that emits a random click-sound to mask the real sound could be helpful here. But it might confuse the typist when it emits the spacebar sound after you typed a regular letter...
  - Tsiklon 2y ago
    Some keyboards like the “Class 80” have a solenoid or a beeper built in that you can turn on to your liking
  - Shadowmist 2y ago
    I think a speaker is going to sound a bit different than actual keys.
    - shawnz 2y ago
      All you need to do is obscure the original sound of the key press so that it can't be distinguished from presses of other keys. You don't need to create an authentic key press sound from scratch
heavenlyblue 2y ago
And it's very easy to break this by randomising keyboard layout every time someone enters their password. And that is already used in many systems.
- sorrythanks 2y ago
  that perhaps protects passwords but what if you're just trying to learn what somebody is writing?
- BobaFloutist 2y ago
  That sounds like an exhausting system to use.
  - DoctorOetker 2y ago
    Not really just visualize 2 rows of alphabet: the top row normal alphabetic, the bottom row the character you'd have to type to select the upper row character. This obviously assume the screen is not simultaneously snooped, which is feasible..
dtgriscom 2y ago
There's only so much information you can get this way, because at some point you'll hit fundamental noise thresholds.
IshKebab 2y ago
How "not terrible" are we talking here. I can totally believe this works with a proper microphone next to the keyboard in a room with no other sounds. A phone mic in an office environment though? I would be very surprised. The sample from that link seems to be the former: https://github.com/shoyo/acoustic-keylogger/blob/master/datasets/samples/sample.wav https://github.com/shoyo/acoustic-keylogger/blob/master/data... Doesn't really tell me anything about how realistic this attack is.

spondylosaurus 2y ago

Re. "every key stroke has a unique sound signature": is this because each key in a keyboard has subtle differences/defects unique to that particular device, or because of where the key sits within a QWERTY keyboard, geometry-wise? I'm trying to understand whether this requires a "decoder ring" recording ahead of time (in the case of the former—okay, on this keyboard an A sounds like this, a B sounds like this...), or whether you'd be able to pull this off with no prep work because an A always sounds like an A and a B always sounds like a B.

travisjungroth 2y ago
Your question is off a bit. It isn’t exactly either of those. Each combination of room, mic, keyboard, and letter is going to have a unique sound signature. But, you don’t need prep work. If you can just record enough keystrokes, it’s possible to figure out what sounds go with what letters. This is the “substitution cipher” the other comment mentioned. For example, the sound that comes every 2-10 letters or so but rarely twice is spacebar. The one that sometimes comes between two spaces is I. It’s obviously more advanced, but just to give you an idea.
- spondylosaurus 2y ago
  Ahhh that makes sense! And sounds a lot less convoluted than either of the methods I envisioned :P
- account42 2y ago
  > The one that sometimes comes between two spaces is I A convenient theory but not a fact.
  - allannienhuis 2y ago
    Why does it need to be perfectly accurate? These are examples intended to communicate the principle, not instructions on how to do frequency analysis. This description may be incomplete, but it does make it pretty clear how frequency analysis works in general terms. This criticism seems misplaced to me.
    - travisjungroth 2y ago
      > These are examples intended to communicate the principle, not instructions on how to do… Thank you. A lot of people don’t get these are two different things. I’m not going for perfect, I’m going for “oh I get it.”
- joncrocks 2y ago
  I believe this approach in general is known as https://en.wikipedia.org/wiki/Frequency_analysis https://en.wikipedia.org/wiki/Frequency_analysis It would be trickier however if looking at raw keystrokes, as one has to consider several confounding factors: * The caret can be moved both by keystrokes and mouse * You don't know what is being typed. If someone is typing people's names all day, or writing software then the analysis of letter/key frequency will be shifted Not impossible, but makes the process harder.
  - lrschaeffer 2y ago
    Yeah, lots of different uses for a keyboard with wildly different frequency distributions. Writing an English letter != text chat in Spanish != data entry != league of legends. It's also not quite a substitution cipher due to modifiers (shift), toggles (caps lock), non-printable characters (escape, volume up/down), and deletion (backspace/delete). It's an interesting problem you'd probably try to solve with Markov chains back in the day, but now you'd just throw machine learning at.
lrschaeffer 2y ago
As other commenters have said, you're just going to learn the decoder ring from context, but I'm also curious. If I take off the keycaps to clean the keyboard and then put them back, do I need to relearn the defects? If I rip out all the switches and rearrange them, do the defects follow the switches or is it more about the position of the key? Is there some resonance that could change if I move the keyboard onto a desk pad. If I switch to Dvorak in software, obviously the key presses mean something different, but also I'll type completely differently. How much does user cadence/timing matter? To what extent is user cadence/timing identifying? Anyway, I assume the answers aren't known because it would be an ethics/privacy nightmare to run these kinds of experiments on anyone but yourself.

reachableceo 2y ago

You would presumably need todo this for the exact keyboard and acoustic properties of your target. And , what if they move the keyboard to their lap? Or put the keyboard legs down? Also many keyboards are very quiet clicks these days. And what if I’m playing music? I imagine a surreptitiously planted keystroke logger is far simpler. Or perhaps camera(s).

seanthemon 2y ago
If you have access to the target computer you would just hack it directly to send you the information like an evil maid attack. No reason to do this keystroke sound hooey..
- deleted 2y ago
  [deleted]
Aardwolf 2y ago
Mine has clicky clicks, because I like it! Perhaps a speaker in the keyboard that emits a random click-sound to mask the real sound could be helpful here. But it might confuse the typist when it emits the spacebar sound after you typed a regular letter...
- Tsiklon 2y ago
  Some keyboards like the “Class 80” have a solenoid or a beeper built in that you can turn on to your liking
- Shadowmist 2y ago
  I think a speaker is going to sound a bit different than actual keys.
  - shawnz 2y ago
    All you need to do is obscure the original sound of the key press so that it can't be distinguished from presses of other keys. You don't need to create an authentic key press sound from scratch

heavenlyblue 2y ago

And it's very easy to break this by randomising keyboard layout every time someone enters their password. And that is already used in many systems.

sorrythanks 2y ago
that perhaps protects passwords but what if you're just trying to learn what somebody is writing?
BobaFloutist 2y ago
That sounds like an exhausting system to use.
- DoctorOetker 2y ago
  Not really just visualize 2 rows of alphabet: the top row normal alphabetic, the bottom row the character you'd have to type to select the upper row character. This obviously assume the screen is not simultaneously snooped, which is feasible..

dtgriscom 2y ago

There's only so much information you can get this way, because at some point you'll hit fundamental noise thresholds.

IshKebab 2y ago

How "not terrible" are we talking here. I can totally believe this works with a proper microphone next to the keyboard in a room with no other sounds. A phone mic in an office environment though? I would be very surprised. The sample from that link seems to be the former: https://github.com/shoyo/acoustic-keylogger/blob/master/datasets/samples/sample.wav https://github.com/shoyo/acoustic-keylogger/blob/master/data... Doesn't really tell me anything about how realistic this attack is.