Acoustic Attack

I am working to create an implementation of an Acoustic Keyboard Emission attack (basically just trying to figure out what you are typing from the sounds of the keys), and was wondering if anyone here had done anything similar. There seems to be some published work, a couple of githubs, but not much else. Do you think attacks like this are live in the wild? Should I be worried about these things?

are you an important enough target to warrant this attack? probably not, then you wouldnt be wasting your time here

He is the Osama Tear of Mr Robot.

>>3343 Do you mean "tier"? If not I don't understand your comment.

>>3341 >are you an important enough target to warrant this attack? probably not, then you wouldnt be wasting your time here Where is your phone relative to your keyboard right now? Once someone has put the initial R&D time into developing code to do this, deployment is trivial and not subject to how "important" anyone is.

>>3341 >>3357 It only needs to be built once and can then be deployed en-masse everywhere. Initial investment cost would quickly become irrelevant.

ngl I sincerely doubt that it's possible to get reliable data out of this, using less than excellent microphones. I'll happily read any research on it.

>>3360 In fact there is http://www.cs.cornell.edu/~shmat/courses/cs6431/zhuang.pdf

>>3361 hmmm, impressive, but I still wouldn't consider it something to be worried about much at the moment, the recovery rate is pretty bad in real-world environments(varied keyboards and significant ambient noise). Maybe for a targeted attack, but just trying to recognize all keystrokes from all phones would generate a lot of junk data.

Phoneposter masterrace. All touchscreen taps sound the same.

>>3362 Hmm I guess you are right. I'm not so much worried about it, as trying to implement it. I've managed to get FFT and cepstrum stuff working now, but I'm having trouble making the python libraries work in real time. I may have to switch languages or try to improve efficiency.

>>3367 Well I ran into more issues with the cepstrum stuff. Trying to get it to work in real time is proving to be a bit of a pain in python. I'm hoping to get that all working tomorrow though, then next week on to the meat of the challenge. Doing this a few hours a week really slows progress

>>3340 You could mitigate against this by how they mitigated bugged rooms back in the day, by turning the radio on or using static/white noise generators. But instead you could play audio of key presses to confuse the device listening (I am not too familiar with it how it works so I could be wrong). Or pre-record some random keypresses in the same environment and play it back. With this you could make the data gathered unusable/scrambled with gibberish at the least.

back in 2011 I remember reading about a keylogger that would use the phones accelerometer to log keystrokes if it was placed on the same table: https://www.wired.com/2011/10/iphone-keylogger-spying

You need the same keyboard to record the different key sounds or gather plenty of data from the target to make a statistical analysis to link key-sound. Outside of that imo it makes no sense to use this attack type. The only usecase would be a system that's perfectly protected while the user still had his mobile nearby. Now where would this ever happen? Most people will be completly insecure and security aware people won't get a mobile phone near their airgapped saferoom.

>Do you think attacks like this are live in the wild? If they are then it's mostly high end governmental agency that doesn't have access of air gapped secure system. Everyone carries a phone around themselves, which means that this is probably the case. Other than that, there are keyloggers for that kind of stuff. Nobody aint got time for Acoustic emission attack, it's easier to just infect or phish. I guess this type of attack could be done with those laser window listeners. >Should I be worried about these things? Not really

>>3340 I think this is one of the things a neural network might be able to learn to do.

>>5303 There should be no "might" in that sentence. It's p much what supervised learning does best. As long as you provide it with training data that contains enough variance, then it'll do it without a problem. What's really concerning, however, would rather be the 2 following aspects: >Microphone placement should be consistent By this I mean if you want to take your system out into the wild and design it as portable, it'll most likely consist of "something" + a bug. The placement of the bug will affect how sound gets picked up >Different people have different typing This is the most worrisome. I remember reading online something along the lines of "you can be fingerprinted by typing habits", meaning that if you're an 80yr old grandma, your typing will 99.9% not sound the same as would if you'd be a young black male, for example.

>>4045 >>5304 how about this for a theoretical targeted attack: >target is live-streamer >train network with generic keyboard/mic combo that best approximates their setup >collect supplementary data from their stream (from e.g. them typing in chat, hotkeys from the game they are playing, etc.). luckily they have one of those $200 blue whateverthefuck mics so sample quality is quite good. >refine network with this new training set. i think i read somewhere that this is the preferred approach for training a network when specific data is limited. >wait for them to type a password probably not worth the effort unless you're just doing it for kudos. acoustic attacks should in principle still work over the phone too, so i could imagine a slightly more general attack targeting bank call centers or something.

>>5305 also worth noting that you probably don't need an exact password. if you can narrow it down to which area of the keyboard each keypress is coming from, you'll significantly reduce the possible permutations for a subsequent brute force attack.

>>5306 throw in some markov chaining in there and it's already turned into a most *likely very short* list of actual words, innit?

>>3363 Oh yeah until somebody sneaks from behind and just watches.