Slashdot Mirror
Researchers Sniff Keystrokes From Thin Air, Wires
narramissic writes "Two separate research teams have found that the electromagnetic radiation that is generated when a computer keyboard is tapped is actually pretty easy to capture and decode. Using an oscilloscope and an inexpensive wireless antenna, the Ecole Polytechnique team was able to pick up keystrokes from virtually any keyboard, including laptops — with 95 percent accuracy over a distance of up to 20 meters. Using similar techniques, Inverse Path researchers Andrea Barisani and Daniele Bianco picked out keyboard signals from keyboard ground cables. On PS/2 keyboards, 'the data cable is so close to the ground cable, the emanations from the data cable leak onto the ground cable, which acts as an antenna,' Barisani said. That ground wire passes through the PC and into the building's power wires, where the researchers can pick up the signals using a computer, an oscilloscope and about $500 worth of other equipment. Barisani and Bianco will present their findings at the CanSecWest hacking conference next week in Vancouver. The Ecole Polytechnique team has submitted their research for peer review and hopes to publish it very soon."
Upgrade to USB. Try to sniff that.
This needs a Van Eck tag, for Stephenson's Cryptonomicon bit.
Sounds like a TEMPEST in a teapot to me.
Tinfoil keyboards! Accessorize, baby!
I will have to type "I know you're eavesdropping" every few sentences.
http://xkcd.com/525/
Two separate research teams have found that the the electromagnetic radiation that is generated when a computer keyboard is tapped is actually pretty easy to capture and decode.
...We at the NSA have known this for years.
Publishing is one of the first steps in peer review.
Thank you.
The Kruger Dunning explains most post on
This is exactly why I do all my typing with my mouse on an on-screen virtual keyboard. It's much faster too.
On a serious note, it is ironic that literally broadcasting a bluetooth signal over-the-air between a wireless keyboard and computer is apparently more secure than a hardwired keyboard.
Better known as 318230.
I couldn't help but think of drugs when I read the headline: Researchers sniffing lines of keystrokes, complaining about how thin the air has gotten since when they were young. By god, back then the electrons were so thick they had to use thick 8 gauge wiring to make anything work. Why, these days, the electrons have been used and re-used so much that we can use 24ga wiring for communications. Hey, are you gonna finish that line of qwertyuiop?
#fuckbeta #iamslashdot #dicemustdie
I remember talk about this in the 80's. Van Eck Phreaking
THL phish sticks
Nifty wiki links:
Van Eck Phreaking
TEMPEST
Rainbow series
Change to Bluetooth. That'll fix 'em, by gum! Harrr! Can't fool ME that easily!
Wait... Oh, nevermind. The only solution is to shoot people with antennae. Damned criminals...
No, wait... No, wait... No, wait...
Hmm. This is interesting. Get back to you.
deleting the extra space after periods so i can stay relevant, yeah.
You beat me to it. DOD has had a whole system (TEMPEST) for classifying this kind of EM emissions from secured systems at least since the mid 1980's. Nothing new about it at all. I recall working for a particular defense contractor where we had an entire 'black area' of the plant that was TEMPEST rated. Independent filtered power, EMF shielding everywhere, etc. It was pretty expensive to set up too.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
I knew it. Many others have been discussing the potentials for this type of eavesdropping for many years. Ha! and they laughed at me when I started protecting my stuff...
[alk]
In 1981, my supervisor in the Air Force, based on training he had as a forward air controller in Vietnam, told me how easy it was to electronically snoop in on the keystrokes generated by electric typewriters. This was in response to my question about what the "secure typewriter" was that we were standing there looking at. So the whole concept was proven, in use, and being counter-acted, years before the Van Eck phreaking article was even published.
So I'm quite baffled by this "research" being presented well over 30 years after that.
There's significant legal use for keyboard sniffing. Parents watching children and employers watching employees on company computers are both legal in the US.
Google "Tempest." Some of this has been released, some not, but this is decades old.
Stock prices for Alcoa shot up as stores reported a sudden shortage of aluminum foil. The Alcoa spokesman was at a loss to explain the sudden shortage.
Well, there's spam egg sausage and spam, that's not got much spam in it.
By god, back then the electrons were so thick they had to use thick 8 gauge wiring to make anything work.
Some years ago I waked into a computer store to buy a hard drive. Along one of the walls was a series of glass displays containing a small selection of vintage computer equipment. One of the displays contained a gigantic object that looked like it would take two men to shift. It consisted of a really massive looking cast metal casing out of which protruded some disks, arms, some clumsy looking circuit boards and the thing was powered by a quite sizeable 220 volt electric motor of the type one is used to seeing attached to a really big fat lumber saw. I had to take a few steps back before I realised the thing was a (8 GB as it turned out) hard drive from the early 80s and not a piece of industrial machinery with it's panelling removed. I walked out of that place with a 20 Gb hard drive in my hand. Kind of makes one marvel over how far we have come in terms of miniaturisation.
Only to idiots, are orders laws.
-- Henning von Tresckow
As a lay man, I cannot see a genuine use of this technology without breaking the law.
As with ALL security research there's ALWAYS one legal use: Using the info and techniques to find ways to defend yourself against bad guys who use the techniques against you and to test that your defenses are adequate.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Better get a tinfoil hat for your keyboard too.
I say don't drink and drive, you might spill your drink. Before you get behind the wheel just stop and think.
This is a plot by GUI users to spread fear uncertainty and doubt upon cli applications. May CLI live forever!
Having to work for a living is the root of all evil.
USN has been doing it for years so has the german MAD
remember security is an illusion
regards
John Jones
Change to an Dvorak keyboard or even an foreign language keyboard "challenge" this.
However the way I type, they will have fun with all of those backspaces...
How thin is the air, up there where you're at, that you somehow believe that they wouldn't be allowed to present? Why is that "tough"
Since when does the Canadian government ask whether there is a "genuine use of [a] technology without breaking the law" before they pre-emptively restrict free speech? I'm pretty sure that they don't--go wikipedia it, yourself, and come back and tell me if I'm wrong, OK?
So where did you get this idea that somebody could stop their presentation/publishing?
* You may be confused by certain past cases (such as the RIAA/MPAA watermarking contest) wherein researchers are threatened with lawsuits by other private parties on contractual or copyright-related grounds. Zero application, here--these researchers aren't involved with any 2nd parties who have the legal standing and desire to bring such a tort.
* You may also be confused by the DMCA, or its counterparts in other countries, which criminalize the distribution of devices or methods that circumvent copyright protection mechanisms, like DVD's CSS encryption. Again, zero application, because this has nothing to do with copyright law.
* Is it possible that you were thinking of how governments will classify research that has national security implications, such as work on nuclear weapons or cryptography, muzzling the researchers with threats of criminal prosecution? Again, not an issue here--Faraday's law of induction isn't what you'd call a national secret.
So... Seriously: Am I missing something, here? Why DO you think these researchers would be stopped from presenting? And who do you think would do it, and how?
Look up "TEMPEST", e.g. in http://en.wikipedia.org/wiki/TEMPEST - this isn't merely "old news", this is "so ancient it dates before I was born", and I am old enough to have used punch cards.
This is why some computer rooms will never contain wireless peripherals or wireless networks or Internet connections; but will have an intimidating sign on the door, and combined biometric/keypad entry, and Faraday cages built into their walls, and a self destruct mechanism, and fences around them, and 24/7 armed guards, and a hot line to a fast-response team on a separate near-by base.
For everyone else, well, when you buy tinfoil rolls, remember to buy enough for your hat _and_ your peripherals cables :-)
You are correct. See
http://blog.wired.com/27bstroke6/2008/04/nsa-releases-se.html
for a summary and see
http://www.nsa.gov/public_info/_files/cryptologic_spectrum/tempest.pdf
for the recently declassified document. The discovery of this problem is dated to 1943.
Would this work with ATM keypads?
How exactly can this be new or newsworthy?
I saw a demonstration 20 years ago almost to the day where guys from the swedish equivalent of NSA captured keystrokes from a Mac Plus at 300 meters distance (I was working in military research at the time).
As a consequence we built a room paneled entirly in copper, with copper chicken wire across the windows and baffled air vents.
Opto-couplers for the phone lines and stabilizers for the power and we were emission free. The whole TEMPEST package.
(Elegance is not an option)