6 ms·

While interesting, I don't view it as having much of an impact. Page 6 states that there was a significant training period for their machine learning algorithm

While interesting, I don't view it as having much of an impact. Page 6 states that there was a significant training period for their machine learning algorithm that involved sending the bluetooth from the keyboard through the phone to train it. In the real world, if you have compromised someone's phone and have access to their key strokes through bluetooth, why do you need this method at all? Even in some contrived circumstance where it was more feasible, it would probably be better 100% of the time to try to compromise the phone's bluetooth, audio, camera, or wifi capability before targeting the accelerometer and then hoping that they happen to leave their phone close enough to the keyboard and hope that your algorithm can decode keystrokes on a keyboard that it has never heard before, which may also be a type of keyboard that it has not heard before. All in all, it's a cool experiment which shows that we can do some interesting and non-conventional stuff with accelerometers, but it's not practical in the slightest.

xerophtye 13y ago
what if it's your own phone? Like you place it near someone's keyboard and use it to spy on them? (I confess, i haven't read the paper yet) btw would this work for laptops? wouldn't the signal be a bit different?
- JonSkeptic 13y ago
  >btw would this work for laptops? wouldn't the signal be a bit different? Yes, and that's the major problem with its practicality. The researchers had to make use of a long training period on one specific keyboard (I don't believe they specify how many typists were involved in the training process, though). The rub, is that when they take this phone to another keyboard or have another typist at the keyboard, it will need to be trained again, just to reach 80% accuracy. If you want to spy on someone with your phone there are far better/more reliable/efficient ways to do it that do not involve training a machine learning algorithm to process key strokes from a specific keyboard with, at most, a couple of typists on it (hopefully they are all the typists you want). Not to mention what happens if the phone gets moved. A few inches and their training period would probably be borked eight ways to Sunday.
jre 13y ago
It's definitely far from being an easy attack. But it raises an interesting question in that the current smartphone security models don't require special permissions for accelerometer access whereas they do for cameras and other things. With this kind of stuff and other advances in activity recognition, allowing any app to record anything using the accelerometer might become a privacy threat.
- diydsp 13y ago
  Yes I am very relived they published this. I assumed this was possible acoustically many years ago, but never told anyone ahahha. When I saw this headline, I feared seismic (accelerometers) might do an even better job at it, but fortunately, it looks like they don't.
  - showerst 13y ago
    I have some bad news for you =P. https://www.schneier.com/blog/archives/2009/03/sniffing_keyboa.html https://www.schneier.com/blog/archives/2009/03/sniffing_keyb...
    - s_q_b 13y ago
      Modern SCIFs vibrate window panes to prevent laser microphones. They also use EMF shielding to prevent TEMPEST attacks. Most interesting to me is that they were aware of TEMPEST leakage as early as WWII.
- paulgb 13y ago
  Both Android and iPhone expose an accelerometer API even to web pages without user input, although I'm not sure what the sample rate is.
  - VladRussian2 13y ago
    sounds like one can be tracked even without GPS, just by integrating accelerometer data and even one fixed point of reference may be not necessary as the pattern of movements can, in many cases, be uniquely aligned with the pattern of streets/etc...
jacquesm 13y ago
You could train it with a similar setup and then use the training data to target another.
- f0r 13y ago
  Would this be a template attack? (pdf: http://saluc.engr.uconn.edu/refs/sidechannel/chari02template.pdf http://saluc.engr.uconn.edu/refs/sidechannel/chari02template...)
  - jacquesm 13y ago
    Hm. Not an expert on the subject but I think by some readings of that you could consider it to be one. After all, if you duplicate the setup you're going to bug that gives you exactly the same kind of advantage that a template attack gives you, one where you have many more samples than you'd have if all you had to use was the target itself. You could even try to parallelize this to determine sensitivity to conditions by creating a number of setups all slight variations on the target. This should help to establish how reliable the output of the actual side-channel is.
- brador 13y ago
  I'd use a dictionary and Bayesian net. You're given word lengths and keystroke signatures. You are not told which key matches which signature. It essentially becomes an encryption cracking problem, kinda like "e is the most common letter so that's the vibration sig we'll see the most".
  - MrMeker 13y ago
    I think the backspace key would be the best key to try to find a reference for. It is often pressed multiple times in a row and would allow for recognition of common typos.
    - brador 13y ago
      You could also get a sketch map of the keyboard from key press volume, louder means closer, find backspace, model phone position in relation to keyboard position, take it from there.
darkxanthos 13y ago
What one could do though is greatly limit the search space for a password. It could definitely tell you how many characters and give at least areas of the keyboard.
santosha 13y ago
Sure, it probably has not much real world impact. But you have to remember this is academic research, not industry security research. The point of academic research is to come up with non-standard ideas that are sort-of feasible, caveats are okay - but might become important in the future.
nyan_sandwich 13y ago
Right, and when someone made the first transistor, it was no smaller than a vacuum tube. Clearly impractical. Give it time. A proof of concept does not represent the upper limit of what a technology can do.
aaron695 13y ago
>Page 6 states that there was a significant training period for their machine learning algorithm that involved sending the bluetooth from the keyboard through the phone to train it. You shouldn't need to train it via this method, you pretty much know exactly how often each letter of the alphabet is used so once you differentiate between keys it's just standard substitution encryption cracking = very easy. The keyboard type should be irrelevant, if you can uniquely identify keys being pressed it's a easy game over.
marshray 13y ago
No, in the real world adversaries have been perfecting (i.e., 'training') these techniques for longer than most of us have been alive. http://www.nsa.gov/public_info/_files/cryptologic_spectrum/tempest.pdf http://www.nsa.gov/public_info/_files/cryptologic_spectrum/t...

xerophtye 13y ago

what if it's your own phone? Like you place it near someone's keyboard and use it to spy on them? (I confess, i haven't read the paper yet) btw would this work for laptops? wouldn't the signal be a bit different?

JonSkeptic 13y ago
>btw would this work for laptops? wouldn't the signal be a bit different? Yes, and that's the major problem with its practicality. The researchers had to make use of a long training period on one specific keyboard (I don't believe they specify how many typists were involved in the training process, though). The rub, is that when they take this phone to another keyboard or have another typist at the keyboard, it will need to be trained again, just to reach 80% accuracy. If you want to spy on someone with your phone there are far better/more reliable/efficient ways to do it that do not involve training a machine learning algorithm to process key strokes from a specific keyboard with, at most, a couple of typists on it (hopefully they are all the typists you want). Not to mention what happens if the phone gets moved. A few inches and their training period would probably be borked eight ways to Sunday.

jre 13y ago

It's definitely far from being an easy attack. But it raises an interesting question in that the current smartphone security models don't require special permissions for accelerometer access whereas they do for cameras and other things. With this kind of stuff and other advances in activity recognition, allowing any app to record anything using the accelerometer might become a privacy threat.

diydsp 13y ago
Yes I am very relived they published this. I assumed this was possible acoustically many years ago, but never told anyone ahahha. When I saw this headline, I feared seismic (accelerometers) might do an even better job at it, but fortunately, it looks like they don't.
- showerst 13y ago
  I have some bad news for you =P. https://www.schneier.com/blog/archives/2009/03/sniffing_keyboa.html https://www.schneier.com/blog/archives/2009/03/sniffing_keyb...
  - s_q_b 13y ago
    Modern SCIFs vibrate window panes to prevent laser microphones. They also use EMF shielding to prevent TEMPEST attacks. Most interesting to me is that they were aware of TEMPEST leakage as early as WWII.
paulgb 13y ago
Both Android and iPhone expose an accelerometer API even to web pages without user input, although I'm not sure what the sample rate is.
- VladRussian2 13y ago
  sounds like one can be tracked even without GPS, just by integrating accelerometer data and even one fixed point of reference may be not necessary as the pattern of movements can, in many cases, be uniquely aligned with the pattern of streets/etc...

jacquesm 13y ago

You could train it with a similar setup and then use the training data to target another.

f0r 13y ago
Would this be a template attack? (pdf: http://saluc.engr.uconn.edu/refs/sidechannel/chari02template.pdf http://saluc.engr.uconn.edu/refs/sidechannel/chari02template...)
- jacquesm 13y ago
  Hm. Not an expert on the subject but I think by some readings of that you could consider it to be one. After all, if you duplicate the setup you're going to bug that gives you exactly the same kind of advantage that a template attack gives you, one where you have many more samples than you'd have if all you had to use was the target itself. You could even try to parallelize this to determine sensitivity to conditions by creating a number of setups all slight variations on the target. This should help to establish how reliable the output of the actual side-channel is.
brador 13y ago
I'd use a dictionary and Bayesian net. You're given word lengths and keystroke signatures. You are not told which key matches which signature. It essentially becomes an encryption cracking problem, kinda like "e is the most common letter so that's the vibration sig we'll see the most".
- MrMeker 13y ago
  I think the backspace key would be the best key to try to find a reference for. It is often pressed multiple times in a row and would allow for recognition of common typos.
  - brador 13y ago
    You could also get a sketch map of the keyboard from key press volume, louder means closer, find backspace, model phone position in relation to keyboard position, take it from there.

darkxanthos 13y ago

What one could do though is greatly limit the search space for a password. It could definitely tell you how many characters and give at least areas of the keyboard.

santosha 13y ago

Sure, it probably has not much real world impact. But you have to remember this is academic research, not industry security research. The point of academic research is to come up with non-standard ideas that are sort-of feasible, caveats are okay - but might become important in the future.

nyan_sandwich 13y ago

Right, and when someone made the first transistor, it was no smaller than a vacuum tube. Clearly impractical. Give it time. A proof of concept does not represent the upper limit of what a technology can do.

aaron695 13y ago

>Page 6 states that there was a significant training period for their machine learning algorithm that involved sending the bluetooth from the keyboard through the phone to train it. You shouldn't need to train it via this method, you pretty much know exactly how often each letter of the alphabet is used so once you differentiate between keys it's just standard substitution encryption cracking = very easy. The keyboard type should be irrelevant, if you can uniquely identify keys being pressed it's a easy game over.

marshray 13y ago

No, in the real world adversaries have been perfecting (i.e., 'training') these techniques for longer than most of us have been alive. http://www.nsa.gov/public_info/_files/cryptologic_spectrum/tempest.pdf http://www.nsa.gov/public_info/_files/cryptologic_spectrum/t...