Slashdot Mirror
Researchers Sniff Keystrokes From Thin Air, Wires
narramissic writes "Two separate research teams have found that the electromagnetic radiation that is generated when a computer keyboard is tapped is actually pretty easy to capture and decode. Using an oscilloscope and an inexpensive wireless antenna, the Ecole Polytechnique team was able to pick up keystrokes from virtually any keyboard, including laptops — with 95 percent accuracy over a distance of up to 20 meters. Using similar techniques, Inverse Path researchers Andrea Barisani and Daniele Bianco picked out keyboard signals from keyboard ground cables. On PS/2 keyboards, 'the data cable is so close to the ground cable, the emanations from the data cable leak onto the ground cable, which acts as an antenna,' Barisani said. That ground wire passes through the PC and into the building's power wires, where the researchers can pick up the signals using a computer, an oscilloscope and about $500 worth of other equipment. Barisani and Bianco will present their findings at the CanSecWest hacking conference next week in Vancouver. The Ecole Polytechnique team has submitted their research for peer review and hopes to publish it very soon."
Upgrade to USB. Try to sniff that.
This needs a Van Eck tag, for Stephenson's Cryptonomicon bit.
None of this would happen if you used ParanoidLinux... or would it?
The Illuminati are tapping our power lines! Run! Call Cory Doctorow! Call Dan Brown! Call John Munch!
Sounds like a TEMPEST in a teapot to me.
Tinfoil keyboards! Accessorize, baby!
I will have to type "I know you're eavesdropping" every few sentences.
http://xkcd.com/525/
Two separate research teams have found that the the electromagnetic radiation that is generated when a computer keyboard is tapped is actually pretty easy to capture and decode.
...We at the NSA have known this for years.
so iphone touchpads might be just the ticket?
It would seem this could pick a whole bunch of keyboard traffic from any number of keyboards being typed at the same time.
Sounds like this could be used as a useful sniffer only if you could tag keystrokes from a specific keyboard.
Publishing is one of the first steps in peer review.
Thank you.
The Kruger Dunning explains most post on
This is exactly why I do all my typing with my mouse on an on-screen virtual keyboard. It's much faster too.
On a serious note, it is ironic that literally broadcasting a bluetooth signal over-the-air between a wireless keyboard and computer is apparently more secure than a hardwired keyboard.
Better known as 318230.
I couldn't help but think of drugs when I read the headline: Researchers sniffing lines of keystrokes, complaining about how thin the air has gotten since when they were young. By god, back then the electrons were so thick they had to use thick 8 gauge wiring to make anything work. Why, these days, the electrons have been used and re-used so much that we can use 24ga wiring for communications. Hey, are you gonna finish that line of qwertyuiop?
#fuckbeta #iamslashdot #dicemustdie
I doubt these folks will be allowed to present their stuff. As a lay man, I cannot see a genuine use of this technology without breaking the law. I hope they will present.
When a product based on this technology is manufactured, the manufacturer could face a law suit on these grounds:
The defendant manufactured a product which on usage as intended by manufacturer, breaks the law. That's tough.
I remember talk about this in the 80's. Van Eck Phreaking
THL phish sticks
Nifty wiki links:
Van Eck Phreaking
TEMPEST
Rainbow series
I didn't see anything about them picking this up from multiple keyboards. It isn't that often that you encounter one person on one computer, really. I suspect it could be quite a bit more difficult to figure out the typing of 4 users sitting around you at the airport with laptops (to say nothing of the probable response in an airport elicited by someone using an oscilloscope).
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
This sounds an awful lot like Van Eck Phreaking, which was first described in 1985... this doesn't sound like anything particularly novel....
Change to Bluetooth. That'll fix 'em, by gum! Harrr! Can't fool ME that easily!
Wait... Oh, nevermind. The only solution is to shoot people with antennae. Damned criminals...
No, wait... No, wait... No, wait...
Hmm. This is interesting. Get back to you.
deleting the extra space after periods so i can stay relevant, yeah.
You beat me to it. DOD has had a whole system (TEMPEST) for classifying this kind of EM emissions from secured systems at least since the mid 1980's. Nothing new about it at all. I recall working for a particular defense contractor where we had an entire 'black area' of the plant that was TEMPEST rated. Independent filtered power, EMF shielding everywhere, etc. It was pretty expensive to set up too.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
I knew it. Many others have been discussing the potentials for this type of eavesdropping for many years. Ha! and they laughed at me when I started protecting my stuff...
[alk]
In 1981, my supervisor in the Air Force, based on training he had as a forward air controller in Vietnam, told me how easy it was to electronically snoop in on the keystrokes generated by electric typewriters. This was in response to my question about what the "secure typewriter" was that we were standing there looking at. So the whole concept was proven, in use, and being counter-acted, years before the Van Eck phreaking article was even published.
So I'm quite baffled by this "research" being presented well over 30 years after that.
Google "Tempest." Some of this has been released, some not, but this is decades old.
Stock prices for Alcoa shot up as stores reported a sudden shortage of aluminum foil. The Alcoa spokesman was at a loss to explain the sudden shortage.
Well, there's spam egg sausage and spam, that's not got much spam in it.
By god, back then the electrons were so thick they had to use thick 8 gauge wiring to make anything work.
Some years ago I waked into a computer store to buy a hard drive. Along one of the walls was a series of glass displays containing a small selection of vintage computer equipment. One of the displays contained a gigantic object that looked like it would take two men to shift. It consisted of a really massive looking cast metal casing out of which protruded some disks, arms, some clumsy looking circuit boards and the thing was powered by a quite sizeable 220 volt electric motor of the type one is used to seeing attached to a really big fat lumber saw. I had to take a few steps back before I realised the thing was a (8 GB as it turned out) hard drive from the early 80s and not a piece of industrial machinery with it's panelling removed. I walked out of that place with a 20 Gb hard drive in my hand. Kind of makes one marvel over how far we have come in terms of miniaturisation.
Only to idiots, are orders laws.
-- Henning von Tresckow
There is nothing new here, now move along...
http://www.google.com/search?hl=en&q=TEMPEST+EMI
As a lay man, I cannot see a genuine use of this technology without breaking the law.
As with ALL security research there's ALWAYS one legal use: Using the info and techniques to find ways to defend yourself against bad guys who use the techniques against you and to test that your defenses are adequate.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Guess I'll have to use the caps lock LED as my secure interface except Doh! it puts out signals that can be sniffed as well.
So how long until we see this misused on CSI as a technique to somehow find the killer? "And then we'll use his online handle to get his IP address and trace that to his house..." Ugh.
A casual stroll through the lunatic asylum shows that faith does not prove anything. - Neitzsche
Thats it, I'm building a Faraday cage around my house. Try sniffing my emissions through THAT. Try hacking my wifi through THAT.
This is a plot by GUI users to spread fear uncertainty and doubt upon cli applications. May CLI live forever!
Having to work for a living is the root of all evil.
Old news is old, can I haz sauce nao?
Simple solution: have a dummy PS/2 keyboard feeding something like 100 random keystrokes per second into /dev/null. Problem solved.
I can't even get a good wifi signal near my home router; try to sniff what you want, not worried
USN has been doing it for years so has the german MAD
remember security is an illusion
regards
John Jones
Change to an Dvorak keyboard or even an foreign language keyboard "challenge" this.
However the way I type, they will have fun with all of those backspaces...
If a bunch of people start bailing for the restroom at Starbucks holding their mouths I have pretty much figured out who is logging my keystrokes.
My original submission was "Security and Cryptography Laboratory at the Swiss Ecole Polytechnique Federale de Lausanne (EPFL) doctoral students demonstrated four successfull techniques for sniffing keystrokes off various keyboards, including laptops, by analysing the electromagnetic signals produced by every key press. Not entirely new concept, but these guys were able to get data from 20m away. Time for Tempest Grade keyboards?!"
I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.
DOG KNOB!
But then if you are required to comply with certain specifications by contract with DOD, it doesn't actually matter WHAT the rules are. You either comply or you get kicked off the contract.
Besides, there is a lot more to that kind of thing than just EMSEC. Those black areas are highly secure, physically, electronically, etc. Nobody goes in or out with anything on them, no electronics of any kind go in or out, no network links, no phones, no nothing.
There are of course various levels to these things, but you will NOT find classified data scattered around on systems outside a secured area.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
Look up "TEMPEST", e.g. in http://en.wikipedia.org/wiki/TEMPEST - this isn't merely "old news", this is "so ancient it dates before I was born", and I am old enough to have used punch cards.
This is why some computer rooms will never contain wireless peripherals or wireless networks or Internet connections; but will have an intimidating sign on the door, and combined biometric/keypad entry, and Faraday cages built into their walls, and a self destruct mechanism, and fences around them, and 24/7 armed guards, and a hot line to a fast-response team on a separate near-by base.
For everyone else, well, when you buy tinfoil rolls, remember to buy enough for your hat _and_ your peripherals cables :-)
So does this work with laptop keyboards as well?
Gee, I don't know...
the the Ecole Polytechnique team was able to pick up keystrokes from virtually any keyboard, including laptops
Are there any lengths they won't go to in order to protect our privacy? http://www.youtube.com/watch?v=9BnLbv6QYcA
brief question: what is the safest way to login to my email account and check email, in the internet cafe? Assuming that the cafe is run by the mafia.
as title, no additional text
LOL! Soon we'll have to have keyboards and mice with SSL connectivity. Hold on a second .... I have to update my mouse and keyboard cert. They just expired :D
Using a parallel keyboard cable would make it a lot harder to decode (that is if the main emitter is the cable).
And I would have made a big deal of it if I thought it was a big deal. Any person who has played with the RF spectrum has ultimately noticed this. I think I'm going to have to tell everyone about my useless discoveries now that I found out they are a big deal if I make them appear to be. Kudos to morons
We have known about this for decades, these "researches" have just wasted a lot of time.
This behavior of the keyboard cable acting as an antenna transmitting all the keystrokes that can be intercepted via radio is not new at all. I knew of work on Tempest certified terminals in the late 1970's where this was considered a major security issue and an area where some really innovative work was done to redress.
Sometimes, real fast is almost as good as real-time.
Time to wrap tin-foil around my keyboard.
You are correct. See
http://blog.wired.com/27bstroke6/2008/04/nsa-releases-se.html
for a summary and see
http://www.nsa.gov/public_info/_files/cryptologic_spectrum/tempest.pdf
for the recently declassified document. The discovery of this problem is dated to 1943.
If they can figure out exactly what key you're pressing from up to 20 meters away, forget stealing passwords. They should build wireless keyboards.
(comment typed within 15 feet of my computer)
Guess that keyboard-less touchscreen trend isn't so stupid after all.
I can see what you're typing by video taping the movement of your fingers from a distance anyhow.
http://hardware.slashdot.org/article.pl?sid=08/10/20/1248234
The summary is fairly vague.
There are several "Ãcole Polytechnique". There is one in France (http://www.polytechnique.edu/), one in Switzerland (Ãcole Polytechnique Fédérale de Lausanne -- http://www.epfl.ch) and one in Canada (Ãcole Polytechnique de Montréal -- http://www.polymtl.ca).
The one publishing the paper is the EPFL in Switzerland.
Luck for me I'm getting the MacBook Wheel
Those who ignore history ... are doomed to post the same damn topics on /. every 6 months.
So I don't have this problem.
It's also nice because I don't like to wear hats indoors.
aren't they great? i hate antennas with wires.
I remember my college professors doing this from the Quad during the open houses every year while I was in college. I went to Syracuse University from 94-98, and got a BS in Electrical Engineering. This is cool, don't get me wrong, but far from news; or maybe I'm just a geek. Hmm, well this is /., and I am trying to prove how uncool these guys are...
- Mike
Once you've lost your temper, you've lost the argument - Me
Worked at a secret facility once 15 years ago now that was electrically isolated from the main power grid, had iron sheets on all the walls, the floors and the ceiling. To get in or out we had to go through an electronic "air lock" one at a time so that the inside was never open to the outside at any time.
They told us that special vans could read every key press and see what was on every screen in a house from down the street and this was back then.
Would this work with ATM keypads?
...this is why you use keyfiles. Generate them from /dev/urandom, esp. on Macs which use yarrow. Dunno about Ubuntu.
``Tension, apprehension & dissension have begun!'' - Duffy Wyg&, in Alfred Bester's _The Demolished Man_
The demonstration given by Martin Vuagnoux and Sylvain Pasini from the LASEC/EPFL has already been slashdotted (see http://hardware.slashdot.org/article.pl?sid=08/10/20/1248234&from=rss) in october 2008. You can see the videos of the experiment on http://lasecwww.epfl.ch/keyboard
How exactly can this be new or newsworthy?
I saw a demonstration 20 years ago almost to the day where guys from the swedish equivalent of NSA captured keystrokes from a Mac Plus at 300 meters distance (I was working in military research at the time).
As a consequence we built a room paneled entirly in copper, with copper chicken wire across the windows and baffled air vents.
Opto-couplers for the phone lines and stabilizers for the power and we were emission free. The whole TEMPEST package.
(Elegance is not an option)
D skf q hskjrù Iurlqb oqxrsjv Kmd!! q$qx V(
:)
Translation : I use a custom Dvorak layout. Sniff away
given that being at the centre of a 20m circle means an area of over 1000 sqm, how many computers are there in such space, say in an office, and how can you make sure which precise keyboard are you "listening" to ??
Can I put a spell on those who can't spell?
Your wheels are loose and they're losing their grip, good you're there.
I used this technique to sniff Anonymous Coward's password and now I can post using his account!
They could still do it through wireless. The keys emit a signal that can be picked up no matter what connection the keyboard has to the computer.
Well, keyboard design is such that keys are arranged in a matrix, so they have to be scanned row (or column) a time. Indeed, wire harness that goes from controller under the keys are capable of emitting EM radiation quite well. The way to combat this is to change the scanning from sequential to random and to further step down the currents of the scan. The former would require changing the keyboard controller firmware, but the latter could perhaps be done by hardhacking - cutting traces that lead to keyboard matrix connector on controller PCB and adding series resistors in line.
Ground wire pickup could possibly be cured by adding ubiquitous powerline RFI filters on VCC and GND lines near computer case.
I am too lazy to try this on my own (I don't feel threatened), but if the researchers are reading this, they know what they intercepted and could explore if this proposed countermeasures work.
If they're able to reach 95% accuracy at 20 meters for any keyboard, including laptop keyboards, I guess my IBM Model M's (yup, four of them ;) can be detected from 200 meters :(
Slashdot writes about keyboard sniffer. IT world guy catches up half a year later, and writes article about, ehm, "new" keyboard sniffing techniques. Slashdot writes about guy writing about old news. What will happen in 6 months?
luckily, i type in dvorak, so they'll never be able to pull my ra;;,soh out of thin air!
track7.org has all kinds of interesting stuff!
But the key signals they're picking out of the air don't include the layout. For bonus paranoia points (and since fairly elementary pattern recognition can be applied to this issue), use a rotation of 3 or more keyboard layouts changing at random intervals with a very minor on-screen notification. Now they need to be rocking TEMPEST, which has a much shorter range than this technique according to TFA.
(Extra tinfoil points for reprogramming your keyboard's microcontroller to rotate the key codes away from the default for your model. Extra extra points for using a new schema whose usage pattern would be reasonably close to the expected.)
Stuff.
Rather old news