Slashdot Mirror
Compromising Wired Keyboards
Flavien writes "A team from the Security and Cryptography Laboratory (LASEC) in Lausanne, Switzerland, found 4 different ways to fully or partially recover keystrokes from wired keyboards at a distance up to 20 meters, even through walls. They tested 11 different wired keyboard models bought between 2001 and 2008 (PS/2, USB and laptop). They are all vulnerable to at least one of the 4 attacks. While more information on these attacks will be published soon, a short description with 2 videos is available."
I won't type what I think about that...
This appears to be related to why TEMPEST attacks work on monitors.
Is this going to be another one of those hollow claims backed up by a viral video, like unlocking car doors with a tennis ball?
I might have to extend my tinfoil hat to some kind of head-mounted lead telephone box.
...why should I worry? I work for BoingBoing.
Looks like a room or building size Faraday Cage (a foil hat the size of your house!) might be the only defence...
Especially considering that you can also detect what is shown on monitors (again, by detecting the electromagnetic radiation), and so on screen "keyboards" operated with a mouse become not so useful.
It's not clear from the article whether they have have the keyboard before hand to be able to record which key-press outputs what radiation, or if they can use this (and by that I mean one of the four) technique on any old keyboard, including ones they haven't seen before.
Anyway, this shouldn't be too surprising to anyone, electronics emit electromagnetic radiation, which can be captured.
I wank in the shower.
"like unlocking car doors with a tennis ball".
Its much easier with a cricket ball. Just use it to break the window.
There are 10 kinds of people in the world... those who understand binary and those who don't.
Oh no, we will have to learn to type code by tapping on a single key and read the results in the flickering of the hard drive light.
When they can manage the same trick in a noisy office environment with dozens of keyboards and monitors in use, then I'll worry.
These videos indicate that the powersupply interferes with the signal, so they only test on laptops running on battery. Does this mean that it doesn't work on desktop computers?
Instead of trying to put 72 hot keys, along with a volume knob, EQ, and 17 LEDs emitting a dizzying array of light colors, how about just a keyboard?
Without all the extra crap, there just may be a chance to reduce the overall voltage required to drive a keyboard, and therefore reduce the eminations. Could go hand in hand with all this talk of going "Green" with PCs.
Of course, that will never happen, because we're far too fascinated with keyboard bling. After all, feature-creep isn't a problem, it's a lifestyle, right?
I saw this demonstrated about 10 years ago while working for a military contractor during a demonstration to increase awareness of security risks. They were able to capture video and keyboard data through a wall adjacent to the PC being monitored. (I can't elaborate on who 'they' were...but I'm sure astute readers can guess correctly.)
If your only tool is a hammer, every problem becomes a nail.
Has anybody noticed that he types really slow? I believe it might not work correctly if many keys are pressed in a short period of time.
As everyone should know, the IBM Model M is the One True Keyboard. Surely all of the steel plating inside that thing must be good for something! If all else fails, the relentless clicking while they listen to your bugged cube or house should drive them completely insane.
Even if it doesn't prevent snooping, you could still use the thing as a self-defense weapon when Mysterious Men From the Shadows come to capture you.
SirWired
MI5 have had this for years. I mean at the range talked about in the article they can also get a good picture quality from your monitor too. This problem has been known about since the 1980s and is the reason why the security services use magnetic shielding either in an entire building or just in private rooms (such as those that exist in every British Embassy internationally).
EM leaks have no real solution at this stage except to shield like crazy. There is potential for some kind of white noise generator but different pieces of electronics would require one tuned to them and the levels required would make a blanket device expensive, or overly large.
I wouldn't worry about people listening in to your keyclicks at home just yet. Perhaps if you work a big corp and there is money on the line. Corporate espionage is big business arguably even bigger than legitimate government work.
If you watch the video he sets the keyboard.eavesdropper into a listening/polling state waiting for keypress information. From there it's filtered and decoded --fine. Now the part that seemed odd to me is it exits as soon as it finds the 'e' in 'trust no one', why?
If the eavesdropper is in a polling state it should continue looking for more keypresses, unless something there are some smoke and mirrors going on. Also, if you listen there's no termination sent --no keypresses heard on camera.
..when you operate the computer like a normal person? You know, powered on machine, typing at a normal rate..
Holy smokes. Either a coincidence or you have been snooping my network, but that is exactly the beginning of my AES key...
This post brought to you by your friendly neighborhood MBA.
Think of this as a proof of concept, with additional range yet to come. To you it might not be a big deal, but to others (e.g. the tinfoil hat crowd) it is likely a very small distance in time between the current 20 meter range and a 100 yards or more. And yet to others still, it is of concern now, for example apartment blocks, condos or dormitories where you may be less than 20 meters away from several other residents.
This post brought to you by your friendly neighborhood MBA.
It shouldn't keep them busy for long. I haven't been able to get to the description yet, but I assume a Dvorak layout, or any other layout for that matter would look like a simple replacement cipher and wouldn't take long to crack.
Isn't it odd how the program knows ahead of time how many keys you are going to type, and conveniently exits after decoding exactly that many?
Sure - it *could* have an exit condition where it quits if it hasn't seen a keystroke in n seconds. But, on the second video, it doesn't time out while the camera goes to the other room - but it does time out while the camera comes back. And besides - who would create their program that way? Just have it decode anything received in an infinite loop - far easier to use.
I see you shelled out for the decoder monkey.
"Most people, I think, don't even know what a rootkit is, so why should they care about it?"