Slashdot Mirror
Researchers Sniff Keystrokes From Thin Air, Wires
narramissic writes "Two separate research teams have found that the electromagnetic radiation that is generated when a computer keyboard is tapped is actually pretty easy to capture and decode. Using an oscilloscope and an inexpensive wireless antenna, the Ecole Polytechnique team was able to pick up keystrokes from virtually any keyboard, including laptops — with 95 percent accuracy over a distance of up to 20 meters. Using similar techniques, Inverse Path researchers Andrea Barisani and Daniele Bianco picked out keyboard signals from keyboard ground cables. On PS/2 keyboards, 'the data cable is so close to the ground cable, the emanations from the data cable leak onto the ground cable, which acts as an antenna,' Barisani said. That ground wire passes through the PC and into the building's power wires, where the researchers can pick up the signals using a computer, an oscilloscope and about $500 worth of other equipment. Barisani and Bianco will present their findings at the CanSecWest hacking conference next week in Vancouver. The Ecole Polytechnique team has submitted their research for peer review and hopes to publish it very soon."
This needs a Van Eck tag, for Stephenson's Cryptonomicon bit.
Sounds like a TEMPEST in a teapot to me.
Tinfoil keyboards! Accessorize, baby!
Publishing is one of the first steps in peer review.
Thank you.
The Kruger Dunning explains most post on
This is exactly why I do all my typing with my mouse on an on-screen virtual keyboard. It's much faster too.
On a serious note, it is ironic that literally broadcasting a bluetooth signal over-the-air between a wireless keyboard and computer is apparently more secure than a hardwired keyboard.
Better known as 318230.
They could still do it through wireless. The keys emit a signal that can be picked up no matter what connection the keyboard has to the computer.
For all you paranoid conspiracy theorists out there that are busy shitting bricks, I will be developing a USB based jamming device that will saturate the area with dummy signals. Please send $100 via brown paper bag on doorstep courier.
I couldn't help but think of drugs when I read the headline: Researchers sniffing lines of keystrokes, complaining about how thin the air has gotten since when they were young. By god, back then the electrons were so thick they had to use thick 8 gauge wiring to make anything work. Why, these days, the electrons have been used and re-used so much that we can use 24ga wiring for communications. Hey, are you gonna finish that line of qwertyuiop?
#fuckbeta #iamslashdot #dicemustdie
I remember talk about this in the 80's. Van Eck Phreaking
THL phish sticks
Real data thieves don't even bother with a keystroke sniffer: they know the sound of each key, so they only have to hear your password being typed to know it.
Convert FLACs to a portable format with FlacSquisher
Nifty wiki links:
Van Eck Phreaking
TEMPEST
Rainbow series
You beat me to it. DOD has had a whole system (TEMPEST) for classifying this kind of EM emissions from secured systems at least since the mid 1980's. Nothing new about it at all. I recall working for a particular defense contractor where we had an entire 'black area' of the plant that was TEMPEST rated. Independent filtered power, EMF shielding everywhere, etc. It was pretty expensive to set up too.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
I can't hear you sonny, type louder!
I knew it. Many others have been discussing the potentials for this type of eavesdropping for many years. Ha! and they laughed at me when I started protecting my stuff...
[alk]
Stock prices for Alcoa shot up as stores reported a sudden shortage of aluminum foil. The Alcoa spokesman was at a loss to explain the sudden shortage.
Well, there's spam egg sausage and spam, that's not got much spam in it.
By god, back then the electrons were so thick they had to use thick 8 gauge wiring to make anything work.
Some years ago I waked into a computer store to buy a hard drive. Along one of the walls was a series of glass displays containing a small selection of vintage computer equipment. One of the displays contained a gigantic object that looked like it would take two men to shift. It consisted of a really massive looking cast metal casing out of which protruded some disks, arms, some clumsy looking circuit boards and the thing was powered by a quite sizeable 220 volt electric motor of the type one is used to seeing attached to a really big fat lumber saw. I had to take a few steps back before I realised the thing was a (8 GB as it turned out) hard drive from the early 80s and not a piece of industrial machinery with it's panelling removed. I walked out of that place with a 20 Gb hard drive in my hand. Kind of makes one marvel over how far we have come in terms of miniaturisation.
Only to idiots, are orders laws.
-- Henning von Tresckow
As a lay man, I cannot see a genuine use of this technology without breaking the law.
As with ALL security research there's ALWAYS one legal use: Using the info and techniques to find ways to defend yourself against bad guys who use the techniques against you and to test that your defenses are adequate.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
A surefire way to get around keyboard monitoring is not to use one. It is admittedly rather tedious, but if you have good cause to be concerned about security, you can use an on-screen keyboard. As far as I know, they can't obtain the necessary information by monitoring your mouse signals.
Martus, a package aimed at human rights workers who need to keep their activities secret from hostile governments, includes an on-screen keyboard.
So listening to mp3s on my computer is a security protection rather than a security risk? Hold on. I have to go complain to IT.
This is a plot by GUI users to spread fear uncertainty and doubt upon cli applications. May CLI live forever!
Having to work for a living is the root of all evil.
A surefire way to get around keyboard monitoring is not to use one. It is admittedly rather tedious, but if you have good cause to be concerned about security, you can use an on-screen keyboard.
Tempest.
In future ITSO announcements:
Your pass-group must contain one of each of the following:
One second while I tune my antennas to your monitor frequency.
I may agree with what you say, but I will defend to the death your right to face the consequences of saying it.
Keyboardless? Try this... http://www.theonion.com/content/video/apple_introduces_revolutionary
AT&ROFLMAO
You are correct. See
http://blog.wired.com/27bstroke6/2008/04/nsa-releases-se.html
for a summary and see
http://www.nsa.gov/public_info/_files/cryptologic_spectrum/tempest.pdf
for the recently declassified document. The discovery of this problem is dated to 1943.
What makes, eg. bidding/negotiations some form of "evil plans"? Such methods certainly require secrecy on the part of BOTH parties.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant