New acoustic attack steals data from keystrokes with 95% accuracy::A team of researchers from British universities has trained a deep learning model that can steal data from keyboard keystrokes recorded using a microphone with an accuracy of 95%.
I’ll believe it when it actually happens. Until then you can’t convince me that an algorithm can tell what letter was typed from hearing the action through a microphone.
This sounds like absolute bullshit to me.
The part that gets me is that the ONLY reason this works is because they first have to use a keylogger to capture the keystrokes of the target, then use that as an input to train the algorithm. If you switch out the target with someone else it no longer works.
This process starts with using a keylogger. The fuck you need “ai” for if you have a keylogger?!? Lol.
I’m skeptical too, it sounds very hard to do with the sound alone, but lets assume that part works.
The keylogger part could be done with a malicious website that activates the microphone and asks the user to input whatever. The site would know what you typed and how it sounded. Then that information could be used against you even when you are not in the malicious website.
Hard to do, but with a very standard keyboard like a Mac keyboard the resonance signatures should be slightly different based on location on the board, take into account pattern recognition, relative pause length between keystrokes, and perhaps some forced training ( ie. Get them to type know words like a name and address to feed algorithm) I think it’s potentially possible.
Well to train ai you need to known what the correct answer is.
it doesn’t need a keylogger. Just needs a Videocall meeting, a Discord call meanwhile you type to a public call, a recording of you on youtube streaming and demoing something… etc.
It’s bad now, but where we’re at with AI… It’s like complaining that MS paint in 1992 couldn’t make photorealistic fake images. This will only get better, never worse. Improvements will come quickly.
It looks like they only tested one keyboard from a MacBook. I’d be curious if other keyboard styles are as susceptible to the attack. It also doesn’t say how many people’s typing that they listened to. I know mine changes depending on my mood or excitement about something, I’m sure that would affect it.
My wife types with her fists when I’m trying to have Zoom meetings.
Coworkers amirite 🙄
Tangentially related: Did you know, that it‘s technically also possible to reconstruct sound via smartphone accelerometers and there‘s no restrictions on which apps can use it. Have fun with this info (:
Thanks, I hate it.
Reconstruct sound using smartphone accelerators? What do you mean? That accelerometers can act as speakers and produce sound? Or they can act as microphones and record sound as numerical data of vibrations etc? Can you point me to any articles or sources?
SpyApp is spying in background
User thinks “why is battery draining so fast?”
Opens battery setting
Oh, this app shouldnt work right now
Restricts SpyApp’s battery permissions
Okay now show me the bad ending
are you saying that a cellphone accelerometer can be used as a microphone? That sounds… interesting. Do you have a source?
I am not the person you are replying to, but if the accelerometers are sensible enough, the vibration of the voice will be picked up by the accelerometer.
Since the sound we make when talking are periodical, it can probably easier to track that periodicity and reconstruct the sound from there.
It’s all my (un)educated guess.
Iirc on newer versions of Android there are restrictions on polling rate of sensor data
I’m sweating. I use blue switches. Help.
Never knew my mutant blue switch keeb would come in handy one day. I’ve lubed the blue switches and added foam and tapes so now it sounds like a clicky-thocky blue-brown switches keeb.
Mx blue and unicomp here… HELP
laughs in custom multi-layer orthogonal layout with one-of-a-kind enclosure & artisan keycaps
Only plebs type. I write all of my content in machine code with a custom compiler to translate it to QWERTY.
NSA/CIA/DEA/Interpol/FBI still trying to decode my shitposts to this day
Good luck hearing my cherry reds as I type slowly and softly!
Assuming that this does not only work on English words, this is actually really terrifying.
I have to assume it could be modified to work on any language. You just have to know the keyboard layout for the language in question do you know what to listen for. Languages with a lot of accents like French maybe could be slightly more complicated but I seriously doubt that it couldn’t be done. I’m honestly not sure how the keyboard is set up for something like Chinese with so very many characters but again if this can be done, that can be done with some dedication and know how.
There are several different ways of inputting Chinese, but generally they all map 2~6 keystrokes to one or multiple Chinese characters, and then the user chooses one. I’d imagine it wouldn’t be much harder.
Van Eck Phreaking?
It was a pipe dream then, and it’s a pipe dream now.
It says it’s acoustic, not electromagnetic…
Does the research presume the use of a qwerty keyboard?
I would think that would be a safe assumption most of the time. Less than 1% of typists use Dvorak, for example.
in french speaking countries Azerty is the standard i think
Belgium as well and I hate my country for it.
I find this article kinda mid bc No link to og paper Article doesn’t specify what kinds of keystrokes were being detected (so title seems kind of clickbait)
- probably not all kinds of keyboards if they only trained model on macbooks? Also no mention of kind of data used to demonstrate 95% accuracy
Phreaking for the modern era.
Fucking yikes
I mean, human ears an only hear so much, but something tells me this is limited to certain kinds of keys.
flfflflfuddhfflfluddh
A very widespread implication of this is if you are on a call with a bad actor and are on speaker phone, and you enter your password while talking to them, they could potentially get that password or other sensitive information that you typed.
Assuming it really is that accurate, a real-world attack could go something like this. Call someone and social engineer them in a way that causes them to type their login credentials, payment information, whatever, into the proper place for them. They will likely to this without a second thought because “well, I’m signing into the actual place that uses those credentials and not a link someone sent me so it’s all good! I even typed in the address myself so I’m sure there’s no URL trickery!” And then attempt to extract what they typed. Lots of people, especially when taking calls or voice conference meetings or whatever from their desk, prefer to not hold their phone to their ear of use a headset mic and instead just use their normal laptop mic or an desktop external one. And, most people stop talking when they’re focused on typing which makes it even easier. Hell if you manage to reach, say, the IT server department of a major company and play your cards right, you might even be able to catch them entering a root password for a system that’s remotely accessible.
Is very convoluted, but yeah, could work
Wasn’t that a thing already? Thought it was part of the Snowden releases.
