Feeds

Key clicks betray passwords, typed text

Big audio dynamite

Choosing a cloud hosting partner with confidence

Eavesdroppers armed with a shotgun microphone or a small recording device could make off with a computer user's sensitive documents and data, three university researchers said in a paper released this week.

The researchers, from the University of California at Berkeley, found that a 10-minute recording of a person typing at the keyboard reveals enough information for a computer analysis to recover nearly 90 per cent of the words entered. The recording can be low quality - the researchers used a $10 microphone - and the system does not need previous samples of a user's typing to perform the analysis. Moreover, the technique can frequently guess a person's password in as little as 20 attempts.

"Primarily this is a message to the security community saying we need to change our thinking on authentication," said Doug Tygar, a professor of computer science and information management at UC Berkeley and the principal investigator of the study. "This is not very exotic attack in that the equipment used is dirt cheap and the software is readily available."

The research is the latest study to underscore the potential for attackers to steal information from computers by analyzing machine emanations--the sound, light and magnetic energy given off by a system. Many attacks rely on intercepting and decoding encrypted communications, such as the signals used by the Bluetooth standard or wireless passport technology. However, machine emanations can inadvertently leak the information displayed on a computer screen or reveal details of the system current calculations.

The paper builds on research by two IBM researchers that showed that software trained to recognize different key clicks could identify the right key about 80 percent of the time. The researchers, Dmitri Asonov and Rakesh Agrawal, also found that telephone keys could be recognized by such software, known as a neural network, more than 90 percent of the time.

UC Berkeley's Tygar, along with students Li Zhuang and Feng Zhou, improved the recognition to an accuracy of nearly 96 per cent using a different processing algorithm, a non-neural-network recognition algorithm and the assumption that English words were being typed.

The researchers extracted audio features from the sounds of a user's keystrokes and lumped similar sounding keys into categories. Then, using statistical properties of the English language -for example, 'e', 't' and 'o' occur most frequently and 'j' never follows 'b' - the researchers assigned letters to each category. Assigning the categories automatically resulted in 60 per cent of the letters guessed correctly, but only 20 per cent of the words, the paper stated.

Adding spelling and grammar checking increased the character recognition slightly, but made word recognition dramatically better - more than half of all words were correctly guessed, according to the researchers. By using the previous results to feed back into the algorithm, the accuracy was further improved. Three rounds of feedback resulted in more than 92 percent of characters correctly guessed in a typical scenario, though the software recognized more than 96 per cent of characters in some cases, the paper stated.

The researchers found that at least five minutes of recording time - approximately 1,500 key strokes - were needed to recognize characters with a high degree of accuracy. A five-minute record resulted in better than 80 per cent accuracy, while a ten minute sample increased that accuracy to more than 90 per cent, the paper stated.

While the researchers used spelling and grammar to improve the recognition software's accuracy, the system could frequently recognize the characters that make up non-word passwords. If allowed twenty guesses, the system could recognize 90 per cent of all five-character passwords, 77 per cent of all eight-character passwords and 69 per cent of all ten-character passwords correctly.

The attack resembles Cold War spycraft, said Bruce Schneier, chief technology officer for Counterpane Internet Security and a well-known security expert. The Soviets used to bug the American Embassy and analyzed the sounds of typewriter keys clacking to guess what was being typed, he said.

"Suddenly, everyone can do this," he said. "If I can get access to your workspace, I can get your passwords. With cameras and microphones getting smaller and smaller, it will be harder to keep secrets."

Quieter keyboards are not necessarily a solution, the researcher found. In a test of three keyboards that produce less noise, characters were recognized correctly more than 90 pe rcent of the time.

While a cell phone failed to foil the recognition system, multiple typists in the same room caused recognition rates to lower. Such defenses are fodder for future research, Berkeley's Tygar said.

"Our research goal is not to build better tools for espionage," he said. "The reason to do this work is to highlight a concern, but you can't consider the problem of defense without first understanding the problem of attack."

Copyright © 2005, SecurityFocus

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
Apple grapple: Congress kills FBI's Cupertino crypto kybosh plan
Encryption would lead us all into a 'dark place', claim G-Men
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.