Slashdot Mirror
Keyboard Sound Aids Password Cracking
stinerman writes "Three students at UC-Berkley used a 10 minute recording of a keyboard to recover 96% of the characters typed during the session. The article details that their methods did not require a 'training text' in order to calibrate the conversion algorithm as has been used previously. The research paper [PDF] notes that '90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts.'"
'90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts.'
Looks like you're screwed because my luggage password is 5 digits long, but all digits are numbers in a sequential order starting with one. Ha ha!
-Valiss
Does this mean that instead of keystroke loggers, spyware is now going to monitor our microphone input? This almost sounds like something out of a bad 80's movie.
I'd have a hard time believing this method transcends all keyboard models, and all typists.
If you can get a mike that close to a keyboard to listen to the keystrokes, then you can probably place a micro camera and get the same results.
Ninjas don't carry tic tacs
Another old fashioned way to get passwords w audio: Just tap the "help desk" phone line.
... that my voice is my passport.
'90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts.
All the systems where I work will lock you out after 5 bad attempts. What kind of password system lets you try 75 (or even 20) times?
It just goes to show that when you have physical access to a computer, the security's already broken...
Get a free iPod Nano 4GB!
Security experts recommend you don't speak the name of the key you're hunting for as you type your password with a single finger.
Now I'll need tinfoil wallpaper too, time to go to Cosco...
"In order to make an apple pie from scratch, you must first create the universe." -- Carl Sagan, Cosmos
Honestly, I've always wondered about this. But then it occurs to be that you could type the ALT+Numeric equivalent of your password characters, just to throw off the bad guys. You know, ALT+100 = "d", etc. Or, just bang the drum slowly when entering the password - loud, thumpy keystrokes. Or put the keyboard in your lap momentarily to alter the acoustic signature.
Or, don't worry. I mean, realistically, what are the odds of this crack actually happening in the non-ultra-spooky world? And once you're in that playground, it's biometrics, smartcards, etc., anyway, right?
Don't disappoint your bird dog. Go to the range.
Be careful, chief. Lets type in the cone of silence.
-
Roses are #FF0000, Violets are #0000FF, find / -name '*base*' |xargs chown -R us && mv zig greatjustice
It is actually a typo on my part, not caught by Taco. The paper in question is from the CS Dept of UC Berkeley.
I use the Dvorak layout myself. It would help prevent this in two ways.
1. The keystroke timing would be much different
2. Constantly making errors which require much backspace pressing
25 years ago (gah!) I really freaked out my boss because I made a big production of turning my back to him as he typed the root password. I turned back and told him what he just typed.
It wasn't anything fancy, just familiarity with the sound that keyboard made and the usual pauses as fingers move to various keys.
I also used to be able to tell you what number was dialed from the touchtones.
P.S. a college friend said that he would occasionally talk to others in morse code after a long duty shift when he was in the military. Forget the nonsense in the introductory material - anyone who really knows morse code and knows it fast hears it as words. It's not hard to take the final step and speak it like you hear it.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
This technique must be usable on most keyboards, because judging from this the FBI sometimes uses (or has used in the past) this technique. From the page:
Oh and by the way, that page was written in 1998, so these UC-Berkley students (and the /. editors) are about 7 years slow.
If you use Windows you can also use osk.exe (On Screen Keyboard) to enter your password, this will allow you to bypass the keyboard completely. This also assumes that you have taken precautions against TEMPEST and CRT diffuse visible light monitoring.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
While it is an interesting topic, controlled conditions are required for this to work correctly.
They use a deterministic method to find the next probable character for a given sequence. Deterministic in that if I type 't' and then type 'h' and there are only so many combinations available after that (this is the Markov chain part). Er basically a sort of decision coverage. That is used with the spell check dictionaries they mention for English text recognition. It is interesting too that they are using a neural network (though appropriate) to recognize the patterns. But because they did not make their own, the details are a bit brief.
The problem I see is that the password detection is not flushed out enough and based upon what they state, it is not as powerful as it sounds. The deterministic method won't work for all passwords (as they typically are not English). Their "analysis" is basically a speed up on a dictionary hack (it helps to know the size of the password from the keystrokes), eliminating possibilities by way of possible patterns. But what about special characters, does a shift+key sound that different? Mixed cases, etc? And the deterministic approach does not work if the password is random AND the network has to be trained for THAT persons typing style and keyboard. Is that likely?
I would be more worried about Van Eck Phreaking.