Researchers Sniff Keystrokes From Thin Air, Wires

narramissic writes "Two separate research teams have found that the electromagnetic radiation that is generated when a computer keyboard is tapped is actually pretty easy to capture and decode. Using an oscilloscope and an inexpensive wireless antenna, the Ecole Polytechnique team was able to pick up keystrokes from virtually any keyboard, including laptops — with 95 percent accuracy over a distance of up to 20 meters. Using similar techniques, Inverse Path researchers Andrea Barisani and Daniele Bianco picked out keyboard signals from keyboard ground cables. On PS/2 keyboards, 'the data cable is so close to the ground cable, the emanations from the data cable leak onto the ground cable, which acts as an antenna,' Barisani said. That ground wire passes through the PC and into the building's power wires, where the researchers can pick up the signals using a computer, an oscilloscope and about $500 worth of other equipment. Barisani and Bianco will present their findings at the CanSecWest hacking conference next week in Vancouver. The Ecole Polytechnique team has submitted their research for peer review and hopes to publish it very soon."

Comments

needs another tag

[Anonymous Coward]

This needs a Van Eck tag, for Stephenson's Cryptonomicon bit.

Re:needs another tag

[luder]

From wikipedia:

"Van Eck phreaking is the process of eavesdropping on the contents of a CRT display by detecting its electromagnetic emissions".

Also worth checking: open-source Van Eck phreaking implementation.

Much ado about nothing?

[Tumbleweed]

Sounds like a TEMPEST in a teapot to me.

Re:Much ado about nothing?

[Prof.Phreak]

Yes, and wasn't there a declassified NSA thing about just this late last year?

Re:Much ado about nothing?

[nicolas.kassis]

They were talking about listening to the noise the keys are making through a computers microphone. This is worse. This is saying that someone can sniff you keystrokes through power lines.

Good news, tinfoil hat crowd!

[Anonymous Coward]

Tinfoil keyboards! Accessorize, baby!

As a reminder

[geekoid]

Publishing is one of the first steps in peer review.

Thank you.

Mouse

[Dan East]

This is exactly why I do all my typing with my mouse on an on-screen virtual keyboard. It's much faster too.

On a serious note, it is ironic that literally broadcasting a bluetooth signal over-the-air between a wireless keyboard and computer is apparently more secure than a hardwired keyboard.

Re:Mouse

[fuzzyfuzzyfungus]

The nice thing about standardized wireless links is that they are so painfully insecure that people have a hard(er) time maintaining a false sense of security about them, which leads to more care.

One might also note that the PS/2 port is electrically compatible with the old AT keyboard that debuted in 1984, on a system with a 6MHz 8086. Not exactly an era where the computational cost of encrypting local busses was even remotely sensible.

Re:Guess what

[Jmanamj]

They could still do it through wireless. The keys emit a signal that can be picked up no matter what connection the keyboard has to the computer.

For all you paranoid conspiracy theorists out there that are busy shitting bricks, I will be developing a USB based jamming device that will saturate the area with dummy signals. Please send $100 via brown paper bag on doorstep courier.

thin air: the new menace

[girlintraining]

I couldn't help but think of drugs when I read the headline: Researchers sniffing lines of keystrokes, complaining about how thin the air has gotten since when they were young. By god, back then the electrons were so thick they had to use thick 8 gauge wiring to make anything work. Why, these days, the electrons have been used and re-used so much that we can use 24ga wiring for communications. Hey, are you gonna finish that line of qwertyuiop?

Re:thin air: the new menace

[andrewd18]

Clearly we need to get rid of this "air" problem. If there's no medium to sniff the keystrokes from, our children will be safe. WON'T SOMEONE THINK OF THE CHILDREN?

Van Eck phreaking?

[gandhi_2]

I remember talk about this in the 80's. Van Eck Phreaking

Re:Guess what

[Chabo]

Real data thieves don't even bother with a keystroke sniffer: they know the sound of each key, so they only have to hear your password being typed to know it.

LOL, yeah

[Giant Electronic Bra]

You beat me to it. DOD has had a whole system (TEMPEST) for classifying this kind of EM emissions from secured systems at least since the mid 1980's. Nothing new about it at all. I recall working for a particular defense contractor where we had an entire 'black area' of the plant that was TEMPEST rated. Independent filtered power, EMF shielding everywhere, etc. It was pretty expensive to set up too.

Re:LOL, yeah

[inKubus]

Yeah, the university I worked at did some government work and actually used a mechanically isolated power system. Basically they had a big motor (or several, actually) and it was directly connected to a generator (with a flywheel I think). This meant a totally independent power loop as inside the building, and the flywheel smoothed out any spikes. Obviously not highly efficient, but a good way to decouple for security and safety purposes.

Re:Guess what

[fuzzyfuzzyfungus]

I can't hear you sonny, type louder!

I knew this day would come

[loconet]

I knew it. Many others have been discussing the potentials for this type of eavesdropping for many years. Ha! and they laughed at me when I started protecting my stuff...

In other news

[UnknowingFool]

Stock prices for Alcoa shot up as stores reported a sudden shortage of aluminum foil. The Alcoa spokesman was at a loss to explain the sudden shortage.

Re:Guess what

[belmolis]

A surefire way to get around keyboard monitoring is not to use one. It is admittedly rather tedious, but if you have good cause to be concerned about security, you can use an on-screen keyboard. As far as I know, they can't obtain the necessary information by monitoring your mouse signals.

Martus, a package aimed at human rights workers who need to keep their activities secret from hostile governments, includes an on-screen keyboard.

Re:Guess what

[internerdj]

So listening to mp3s on my computer is a security protection rather than a security risk? Hold on. I have to go complain to IT.

FUD

[sgt scrub]

This is a plot by GUI users to spread fear uncertainty and doubt upon cli applications. May CLI live forever!

Re:Guess what

[Culture20]

A surefire way to get around keyboard monitoring is not to use one. It is admittedly rather tedious, but if you have good cause to be concerned about security, you can use an on-screen keyboard.

Tempest.

In future ITSO announcements:
Your pass-group must contain one of each of the following:

1. 20 character passphrase
2. keyfob fingerprint reader
3. rentinal scan
4. one spoken word (which may not be any of: [cut dear don't everything eye God I my no off out take thumb told you])
5. MRI scan of you imagining your "happy place"

Re:Guess what

[Linker3000]

Keyboardless? Try this... http://www.theonion.com/content/video/apple_introduces_revolutionary