Feeds

Typing: music to fraudsters' ears

From keyboarding to frauding

  • alert
  • submit to reddit

The Essential Guide to IT Transformation

Computer users should learn to type silently if they don't want to reveal intimate details such as passwords, according to a new study Researchers at the University of California, Berkeley have discovered that a simple audio recording of keyboard clicks can betray what users have typed, possibly leading users to betray intimate details about their lives to virus writers and fraudsters.

In an experiment carried out at the university, computer scientists were able to take several 10-minute sound recordings of users typing, feed the audio into a computer and use an algorithm to recover up to 96 percent of the characters entered on a keyboard.

"It's a form of acoustical spying that should raise red flags among computer security and privacy experts," said Doug Tygar, UC Berkeley professor of computer science and information management and principal investigator of the study. "If we were able to figure this out, it's likely that people with less honourable intentions can - or have - as well."

According to the researchers, what makes the technique feasible is that each keystroke makes a relatively distinct sound, however subtle, when hit. Given that typical users type around 300 characters per minute, enough time is left for a computer to isolate individual keystrokes and categorise the letters based upon the statistical characteristics of English text. For example, the letters "th" will occur together more frequently than "tj," and the word "yet" is far more common than "yrg."

"Using statistical learning theory, the computer can categorise the sounds of each key as it's struck and develop a good first guess with an accuracy of 60 per cent for characters, and 20 per cent for words," said Li Zhuang, lead author of the study. "We then use spelling and grammar checks to refine the results, which increased the character accuracy to 70 per cent and the word accuracy to 50 per cent. The text is somewhat readable at this point."

Moreover, after this has been achieved, the recording can be played back repeatedly in a feedback loop to "train" the computer to increase its accuracy until no significant improvement is seen. In the experiment, three feedback cycles were often enough to obtain recovery rates of 88 per cent for words and 96 per cent for characters. Once a system is trained, recovering the text becomes even more straightforward, even if the text isn't in English.

After just 20 attempts, researchers were able to retrieve 90 per cent of five-character passwords, 77 per cent of eight-character passwords and 69 per cent of 10-character passwords.

What was particularly striking about this study, the researchers said, was the ease with which the text could be recovered using off-the-shelf equipment. "We didn't need high-quality audio to accomplish this," said Feng Zhou, co-author of the study. "We just used a $10 microphone that can be easily purchased in almost any computer supply store."

So what's a PC user to do? Other than scanning one's surroundings for bugs or recording devices and making sure a room is soundproof, the researchers suggest that computer users need to rethink the use of typed passwords or even long passphrases for security.

"There are different forms of authentication that could be used, including smart cards, one-time password tokens or biometrics. That helps with passwords, but it doesn't help protect text documents we would want to keep classified. I'm not sure what the solution is, but it's important that we're aware of this vulnerability," added Tygar.

Copyright © 2005, ENN

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.