To what level could this be applied to? Could someone record keystrokes on a keyboard and in combination with typing habits start to put together a picture of what the user is typing?

If this is indeed true what steps could the user take to help mitigate this?

I know that these attacks have been demonstrated in printers but I'm wondering to what extent could they be used?

  • 3
    Recording keystrokes to understand what the user is typing is acoustic keylogging, not acoustic cryptanalysis. Acoustic cryptanalysis deals with sounds created because of the processing, not because of the keyboard input, whereas acoustic keylogging deals with sounds created by the keyboard.
    – A. Darwin
    Apr 7 '16 at 8:14
  • Reminder: you should accept one answer. Apr 12 '17 at 19:14

In my opinion acoustic cryptanalysis is more of a proof of concept then to be used in real applications.

What is possible to do?

A few years ago guys from MIT (if I am not wrong) were able to log every keys on a mechanical keyboard using an Android/IOS phone application and just by placing that specific phone near the keyboard.

Things you can do to mitigate:

  1. Use on screen keyboard.
  2. Ensure that there aren't any other device near your computer
  3. Use Snowden type pillow even if it's a bit paranoia (or not)
  4. Use smart card/ smart usb authentification
  5. Randomly generate frequencies in the 400-12000 Hz range (which seems to be the one containing keystrokes sounds) and use headphones
  • Interesting, do you know if they used a phone microphone for this or a more sophisticated one?
    – Dane
    Apr 7 '16 at 8:17
  • phone microphone ... that was there goal. :) Apr 7 '16 at 8:19
  • If we took this to the extreme using the "Snowden pillow" along with an on screen keyboard wouldn't mitigate this entirely. Imagine a scenario where the attacker knows your mouse habits too. Unless the mouse is soundless the attacker could use the time difference between the presses to give all the possible combinations of words/letters. Of course this is all percentage based as you would have to include mistakes and anomalies. However, if there is no sound recording device then yes your 3 points make it safe.
    – Dane
    Apr 7 '16 at 8:30
  • #1 is not feasible in most corporate environments, which use computers, as opposed to smartphones/tablets/..., and most computers don't have touchscreens.
    – A. Darwin
    Apr 7 '16 at 8:32
  • 3
    @dvvcnxc another idea would be to randomly generate frequencies in the 400-12000 Hz range (which seems to be the one containing keystrokes sounds) and use headphones.
    – A. Darwin
    Apr 7 '16 at 8:43

You could for instance get the person to use such programs as language apps to get an acoustic fingerprint of the sets of letters. Just imagine the permutations of 'a quick brown fox jumps over the lazy dog'. A frequency analysis on the frequencies could provide letter to key sound mapping. In which case you could mitigate this by switching between dvorak, qwerty or whatever fits your fancy. Also this requires the ability to read the data from the app to begin with.

However, you're looking at minute differences between key sounds, distance based metrics to the microphone to provide the raw data. If you shift the keyboard distance or change any of the variables, that training data is no longer valid.

The 3D printing methodology is not difficult to pull off. Since you can tell printers do not randomly go into position for printing, the raster method of printing and head movement speed makes it easy to determine where the head is.

The random noise generation idea is not such a great mitigation technique. Audio is superpositional, and the spikes from a keystroke from a popular mechanical switch key is going to push the amplitude and the spike and transients of the stroke. From a Foley point of view you should just record a stream of you typing in high audio fidelity and weave it into daily usage.

In any case, this particular method seems less successful though definitely less invasive than others.

  • The idea of an acoustic fingerprint is interesting. If you knew the keyboard the user is using then you could simply create this yourself mitigating the difficult task of getting the user to create one for you. However, this wouldn't entirely be accurate due to the manufacturing, environment and lots of other variables could alter the sound. I think this would be most successful when it comes to mechanical keyboards ofc.
    – Dane
    Apr 7 '16 at 10:35
  • @Munchen why do you think that random noise generation is not a good idea? To my knowledge, efficiently estimating an unknown signal (keystroke recording) to which random noise has been added is not a trivial task, especially if you don't know some mathematical properties of the unknown signal.
    – A. Darwin
    Apr 7 '16 at 12:00

All purely conjecture, but I'm fairly convinced this method of audio analysis fingerprinting does not work in real life. In the ocean for subs yes but keys probably not.

The initial attack of the audio signal from a mechanical keyboard is pretty loud, so it would be fairly difficult to mask.Systems that mask 40db SPL to 80db SPL for ambient sounds would not do a good enough job of blocking that sudden spike. But rubber knob keybeds might offer better mitigation.

If the technique of measurement is through drops in volume across distance, simply shifting the distance or rather the position of your keys so as not to get a clusterable audio of your keyboard would spoil the sampling stage for training data.

The idea here is to flummox the initial data gathering stage so there isn't a ground truth to base any further analysis on. Obviously the more tinfoil hatters have multiple keyboards lying around with which they randomly type strings for precisely this purpose.

Also if they are using particular characteristics of the keys themselves, then what I previously pointed out with switching keymaps don't work. Then pre sampling the keys would work.

The other way, and this is probably feasible, would be to use magnetic field detection, maybe the phone compass works this way, to detect the key code signals as it goes down the keyboard wire.

In any case it is far easier to install a hidden camera to record keystrokes than it is to do this audio analysis.

  • You say you are convinced that it is not possible in real life, but most keyboards are pretty loud, and if it's a mechanical keyboard, it has the potential to be very loud. And there are methods for listening to sounds from almost indefinitely long distances, such as beaming a laser beam at the target's window. The displacement of the laser beam, which will vibrate with the window in tune with the audio in the room, will be visible from many kilometers away and is capable of picking up high frequencies.
    – forest
    Apr 8 '16 at 2:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.