Slashdot Mirror
iPhone Keylogger Can Snoop On Desktop Typing
An anonymous reader writes "Researchers at Georgia Tech demonstrate that a mobile phone located near a keyboard can use its accelerometers to recover text typed by a target. 'The technique works through probability and by detecting pairs of keystrokes, rather than individual keys (which still is too difficult to accomplish reliably, Traynor said). It models “keyboard events” in pairs, then determines whether the pair of keys pressed is on the left versus right side of the keyboard, and whether they are close together or far apart. After the system has determined these characteristics for each pair of keys depressed, it compares the results against a preloaded dictionary, each word of which has been broken down along similar measurements (i.e., are the letters left/right, near/far on a standard QWERTY keyboard).'"
I don't think you even RTFS
Specifically, the summary says nothing about it being iphone specific, only that it requires accelerometers which are in a lot of phones and even many laptops.
... to switch to Dvorak.
-- Insert witty one-liner here. --
Given that one still needs physical access (sort of) to the keyboard to be sniffed, I don't see any real world application for a dictionary dependent keylogger. Especially since someone else's $martphone is not something that stays perfectly aligned to your keyboard forever. Anyway, nice job.
scumbag slashdotter - only reads headline, proclaims apple sucks.
SWYPE
And for bonus: I type much faster with swype than trying to hunt/peck on my keyboard.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Seriously, I want to check this out... To see if it really works, and to see how I can change my typing slightly to prevent it from working. App Store or it didn't happen!
So they put "iPhone" in the heading just to attract attention, as opposed to a generic term like "smartphone"?
to select passwords that cannot be found in a dictionary.
...it didn't happen. What are they going to claim next, that it can determine what pr0n I'm look at by the fap noises?
"Why do you keep pressing the shift keys randomly?"
"Just bEing CArefUl of keyLogGers."
The ideal distance is too close to my keyboard. Usually if I'm leaving my phone on my desk I put it to the right of my designated "mouse area" which is generally a foot or more from the keyboard. I'm a computer technician so I don't just sit at one computer all day too. Plus most of our customers seem to follow the same policy. They kind of put their phone on the corner of their desk so they don't bump it as their hands move around the keyboard and mouse. If my phone is that close to my keyboard I'm likely not at my computer and I just threw it their with my keys and wallet.
TFA does mention that the test was done on the article, probably due to the popularity of the phone, but it pretty much states flat out that any modern smartphone from the last 2 years would suffice if it has the required hardware.
this is one of the articles I wish had a video showing its real life performance.
I really doubt accelerometer data would be enough to determine what I typed.
typing pretty fast may throw it off, or just having to backspace a few times.
not saying its worthless, but I doubt it be good for much. especially if you want to catch secure passwords that are not in a dictionary.
probably ok for easy passwords, but there may be an easier way then first compromising an iphone to have a good guess of what the password was.
Tripe.
Way too much is required for this to be used to steal passwords. Needs to be far too close to the keyboard for one, and the article doesn't go into details regarding differences in keyboard and desk types.
Sound can almost give away keys pressed. the sound on the desk is likely to work better than pickup from the air since solids conduct sound. Add vibration and you've got plenty of data to extract from! I somehow doubt the acceleration is precise enough to come close to a microphone; I wonder if an image from the camera (if in focus) could in some cases indicate more vibration than the accelerometer...
SOUND ALONE could do it much better. use the microphone.
Democracy Now! - uncensored, anti-establishment news
Newer iPhones also come with a Teslameter, I wonder if the can detect em spikes when the keys make contact with their pads. Depending on the distance, again, and using the same or similar logic you could determine keystrokes that way as well I would think. I'll try it once I get my new iPhone, the old 3g doesn't have teslameter in it.
I don't think you even RTFS
I don't think you even read the headline.
The article says that the software requires a gyroscope in addition to the accelerometer to clear the data up enough for decoding, which laptops don't have. Additionally, I don't think the accelerometers built in to laptops are sensitive enough, they're meant for freefall detection as opposed to playing games.
Personally, I'd like to see someone make this work with a Wiimote next.
My sister opened a computer store in Hawaii. She sells C shells by the seashore.
if Intel agencies haven't had this for a while
Now you know why I won't buy one ever.For as little as I use a cellphone (Rural SE KY,NO cellphone will work here at my home)The iPhone is a waste of money
Geek Hillbilly
So with this technique, a password of "correct horse battery staple" would be detected, but "Tr0ub4dor" would not (http://xkcd.com/936/)...
Quick wafting zephyrs vex bold Jim
The article says that the software requires a gyroscope in addition to the accelerometer to clear the data up enough for decoding, which laptops don't have. Additionally, I don't think the accelerometers built in to laptops are sensitive enough, they're meant for freefall detection as opposed to playing games.
Personally, I'd like to see someone make this work with a Wiimote next.
Anyway, who would go through the trouble of making a keylogger that worked by reading a laptop's accelerometer when you can make a keylogger that worked by reading a laptop's keyboard.
Indeed. It isn't even the phone that is vulnerable. It is the keyboard.
People like you are why this site is shit these days.
Similar idea from 6 years ago, but using acoustics rather than vibrations
https://freedom-to-tinker.com/blog/felten/acoustic-snooping-typed-information
T-Mobile with UMA (aka WiFi Calling) will do you well. I live on a small Indian fishing village in NW Washington State. Crap cell coverage here too.
-- I have a private email server in my basement.
Seriously? I guess this is interesting, if you are interested in things that are not practical.
"Your phone tells me that it can't understand your typing, can I help you with that?"
if you left your phone on a desk next to a keyboard, it'll get stolen. (but seriously, it's not much of a security risk, you would do better, IMHO, recording the sound of the keys with the phone's mic)
There was an unknown error in the submission.
Interestingly enough, the picture shows a dude holding up an Android phone, and having an Android emulator running on the PC screen. I how much iPhone was actually used in the development, or if it was only put in the title to generate publicity.
Of course, nothing stops this from being done on an iPhone as well.
Of all the reasons not to buy an iphone, this is by far the stupidest most non-existant one.
Sorry if you think so,but I'm disabled and on a fixed income.The cost is not worth it.
Geek Hillbilly
My old logitech keyboard allows encryption of the information sent.
And this could be useful when you don't have access to the system - A pair of sensors left under a monitor, or behind it, could be enough to gather information from a classified and locked down computer.
Maybe because you'd need physical (or network exploitable) access to the target laptop in order to install a keylogger? Reading accelerometer data from your own laptop that you could have pre-configured and casually put down on victim's desk requires no direct access to victim's PC.
Apparently, the iPhone accelerometer is available via JavaScript ( http://stackoverflow.com/questions/1273964/is-there-access-to-the-iphone-accelerometer-using-javascript ), so displaying webpage on an iPhone sitting on your desk is enough to leak information. Fun times ahead!
Two Slashdot articles today about university researchers developing snooping technology - this, and the gizmo that sees through walls. Is it just me or is 99% of all academic research funded by the 'defense department' these days?
Sooo... "Need to eavesdrop on someone? There's an app for that." And I make this joke as an iPhone user who got the 4S the first week it was out, so please, no "Apple hater" accusations.
I suspect he was referring not to your remote status so much as the article...and I agree, not buying an iPhone because of this would be pretty stupid (if nothing else, most decent Android phones would be just as vulnerable). Based on everything my phone does, however, with a wifi connection, I would probably get one even if I didn't have reception at my house. But, we each chose for ourselves.
RTFA is Known to the State of California to cause cancer.
You don't come up with it using your imagination. No password you pull out of "head entropy" is random. Nor likely to be particularly secure.
You use a pair of dice and a scrabble dictionary, or dice and a printout of 2k (or some other number of selected words so you can use an integer number of dice rolls per word).
Or you take your 2k words, and chomp off 11 bits at a time from /dev/random to pick, for however long you want your password to be.
If you hand select the 2k words, you can make sure that there aren't any corner cases in there (there are way more than 2k words with 5-8 letters...)
There is no reason to EVER use complicated symbols, or even numbers and capitals if you don't feel like it. In almost every password generation scheme, there's a length that has whatever level of security you want. And some things are easier to remember, even if they're long.
The hidden problem is that you shouldn't let users pick their own passwords. Passwords should be generated automatically (dice roll can be considered automatic for the purposes. It doesn't have to be a computer program) from random sources.
Allowing users to even so much as pick something they think they'll remember easily from a list of passwords destroys confidence in your protocol by artificially limiting the number of actual possibilities to a mere subset of what you think it is.
Better to come up with a protocol in which every possible password in the password space is not too hard to remember, and always use a password generated entirely from randomness.
Can you be Even More Awesome?!