8 ms·
Decoding Vibrations From Nearby Keyboards With Mobile Phone Accelerometers [pdf]
- killnine 13y agoI d bet my mechanical keyboard makes this even easier. I wonder how this technique will fair in the future, with touch screen keyboards taking over?
- codeulike 13y agoOur application instead detects and decodes keystrokes by measuring the relative physical position and distance between each vibration. We then match abstracted words against candidate dictionaries and record word recovery rates as high as 80%. So we're all going to have to use constantly vibrating keyboards now to fool the accelerometers. Oh great.
- bby 13y agoRandom vibrations.
- DanBC 13y agoI'd be interested to see what happens if the keyboard is put on rubber grommets or a sponge mousepad. It'd be tricky to get enough damping without making the typing action horrible, I think.
- mseebach 13y agoPut your phone on something soft? I like to leave mine on a sponge mousepad so the vibration doesn't amplify through the table.
- loceng 13y agoSounds like a good time to me..
- noir-york 13y agoOr switch on the aircon, or play some music.
- JoachimS 13y agoActually, you probably want to do something similar to what Danny Hillis did with Babble. In his case emit speech sounding zero info sounds. In this case, vibrate similarly to a keyboard writing Lorem Ipsum (though not exactly that - then it could be filtered out). Best thing would be to train the babble-keyboard with the pattern of the specific user.
- JonSkeptic 13y agoWhile interesting, I don't view it as having much of an impact. Page 6 states that there was a significant training period for their machine learning algorithm that involved sending the bluetooth from the keyboard through the phone to train it. In the real world, if you have compromised someone's phone and have access to their key strokes through bluetooth, why do you need this method at all? Even in some contrived circumstance where it was more feasible, it would probably be better 100% of the time to try to compromise the phone's bluetooth, audio, camera, or wifi capability before targeting the accelerometer and then hoping that they happen to leave their phone close enough to the keyboard and hope that your algorithm can decode keystrokes on a keyboard that it has never heard before, which may also be a type of keyboard that it has not heard before. All in all, it's a cool experiment which shows that we can do some interesting and non-conventional stuff with accelerometers, but it's not practical in the slightest.
- xerophtye 13y agowhat if it's your own phone? Like you place it near someone's keyboard and use it to spy on them? (I confess, i haven't read the paper yet) btw would this work for laptops? wouldn't the signal be a bit different?
- JonSkeptic 13y ago>btw would this work for laptops? wouldn't the signal be a bit different? Yes, and that's the major problem with its practicality. The researchers had to make use of a long training period on one specific keyboard (I don't believe they specify how many typists were involved in the training process, though). The rub, is that when they take this phone to another keyboard or have another typist at the keyboard, it will need to be trained again, just to reach 80% accuracy. If you want to spy on someone with your phone there are far better/more reliable/efficient ways to do it that do not involve training a machine learning algorithm to process key strokes from a specific keyboard with, at most, a couple of typists on it (hopefully they are all the typists you want). Not to mention what happens if the phone gets moved. A few inches and their training period would probably be borked eight ways to Sunday.
- 13y ago
- djpowell 13y agokillnine: btw you have been hell-banned for the past 18 months. pretty harsh.
- user24 13y agowow. I can't even see what he did to deserve it.
- wglb 13y agoPerhaps it was the submission of tea party article about a forged birth certificate.
- rthomas6 13y agoIt's surprising to see so many hellbanned accounts that don't seem to know or care, and continue to post. I wonder if their posts get fake upvotes.
- cscheid 13y agoSeems like a rare case where using this technique gives you much more entropy from a good passphrase than from a good password (although I guess over the shoulder watching is similar)
- mbq 13y agoI wouldn't submit such thing without checking how the accuracy changes when the phone is relocated, when the desk is changed or even when a different specimen of the same keyboard type is used. But I strongly agree that the sensor access privilege is deeply underrated -- Android doesn't even mention it!
- delinka 13y agoI don't see why you need realtime "decoding" of the vibrations. You record the motion, then later analyze it. I'm sure different kinds of work involve different patterns of typing (e.g. writing code uses different typing patterns than transcribing legal documents) and those patterns can be recognized after the fact to reconstruct most of the typing. That said, there are much easier methods to go about obtaining keystrokes from a victim ...
- deleted 13y ago[deleted]
- iandanforth 13y agoThis is a real problem. You should be scared. Also, you should buy a VibraDamp Laptop/Keyboard mat from me. Protect yourself today! For added protection I will also make up and sell a VibraDamp Mini to keep your phone on!
- twic 13y agoMade out of the finest hatter's tinfoil!
- glifchits 13y agoMakes me want to try to learn DVORAK
- hudibras 13y agoI've already added it to my "Here's the advantages of Dvorak, you should totally join my cult" speech.
- mekpro 13y agoCan this research be improved to turn all dumb keyboard into wireless one ? I'm not sure in technical limitation on how much this can be improved.
- jl6 13y agoNice idea for a battery-free wireless feature, but then I guess we'd be complaining about this security issue.
- OldSchool 13y agoHopefully a disclosure like this prevents at least one patent.
- ChuckMcM 13y agoOk, who wants to be the first person to build a usb powered 'thumper' which sits on your desk and raises the noise floor for vibrations and defeats this attack?
- marshray 13y agoHow about we just not buy products with a microphone or accelerometer that doesn't also have a hard cutout switch?
- javajosh 13y agoA very interesting generalization of Tempest [1]. Has anyone tried to recover keypresses from a video of someone typing? That would be an interesting challenge, I would think, especially if the video is at a poor angle. [1] https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)
- chris_mahan 13y agoThat's won't work with the touchscreen keyboard.
- matiasb 13y agoI thought about a similar idea some weeks ago :d
- nly 13y agoThis made me install an Android app (Seismograph) to test to see how my Nexus 4 picked up my key presses. I had it set to the maximum sample rate, with my phone on the desk as close to my laptop as possible whilst not touching it, and it couldn't pick up anything. I suspect therefore this is more of an issue for to-the-desk peripheral keyboards. It does make me wonder though if the sound of each individual key press is subtle and unique enough to be identified.
- JoachimS 13y agoI would love to see how much better the detection would be if the accelerometer input was combined with the microphone.