Slashdot Mirror
iPhone Keylogger Can Snoop On Desktop Typing
An anonymous reader writes "Researchers at Georgia Tech demonstrate that a mobile phone located near a keyboard can use its accelerometers to recover text typed by a target. 'The technique works through probability and by detecting pairs of keystrokes, rather than individual keys (which still is too difficult to accomplish reliably, Traynor said). It models “keyboard events” in pairs, then determines whether the pair of keys pressed is on the left versus right side of the keyboard, and whether they are close together or far apart. After the system has determined these characteristics for each pair of keys depressed, it compares the results against a preloaded dictionary, each word of which has been broken down along similar measurements (i.e., are the letters left/right, near/far on a standard QWERTY keyboard).'"
I don't think you even RTFS
Specifically, the summary says nothing about it being iphone specific, only that it requires accelerometers which are in a lot of phones and even many laptops.
... to switch to Dvorak.
-- Insert witty one-liner here. --
to select passwords that cannot be found in a dictionary.
I ttryuiiiiiiiiiiiiiiiiiiiiiuytredf swsvbbbbbbyuiopoijnnbgg okmjn mjuy PLOKJHBGVC kjhygtrertyuuuuuuuuuuuuuhbjioooooiujhytrfdsaasd Translates into: I tried Swyping on my PC keyboard It didn't work to well, now did it? And would probably be just as detectable by an accelerometer.
If my comment didn't sound as good in your head as it did in mine, then I guess we all know who's to blame
"Why do you keep pressing the shift keys randomly?"
"Just bEing CArefUl of keyLogGers."
The ideal distance is too close to my keyboard. Usually if I'm leaving my phone on my desk I put it to the right of my designated "mouse area" which is generally a foot or more from the keyboard. I'm a computer technician so I don't just sit at one computer all day too. Plus most of our customers seem to follow the same policy. They kind of put their phone on the corner of their desk so they don't bump it as their hands move around the keyboard and mouse. If my phone is that close to my keyboard I'm likely not at my computer and I just threw it their with my keys and wallet.
Take a look at this comment, it may answer your question:
http://mobile.slashdot.org/comments.pl?sid=2482736&cid=37757330
^^ As long as this happens, there'll be lotsa iPhone stories.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
TFA does mention that the test was done on the article, probably due to the popularity of the phone, but it pretty much states flat out that any modern smartphone from the last 2 years would suffice if it has the required hardware.
Sound can almost give away keys pressed. the sound on the desk is likely to work better than pickup from the air since solids conduct sound. Add vibration and you've got plenty of data to extract from! I somehow doubt the acceleration is precise enough to come close to a microphone; I wonder if an image from the camera (if in focus) could in some cases indicate more vibration than the accelerometer...
SOUND ALONE could do it much better. use the microphone.
Democracy Now! - uncensored, anti-establishment news
You don't even need to read the headline to know that apple sucks.
Newer iPhones also come with a Teslameter, I wonder if the can detect em spikes when the keys make contact with their pads. Depending on the distance, again, and using the same or similar logic you could determine keystrokes that way as well I would think. I'll try it once I get my new iPhone, the old 3g doesn't have teslameter in it.
The article says that the software requires a gyroscope in addition to the accelerometer to clear the data up enough for decoding, which laptops don't have. Additionally, I don't think the accelerometers built in to laptops are sensitive enough, they're meant for freefall detection as opposed to playing games.
Personally, I'd like to see someone make this work with a Wiimote next.
My sister opened a computer store in Hawaii. She sells C shells by the seashore.
Or maybe it's because the iphone was the subject of the study and since the iphone4 is the most common smartphone (im pretty sure that's correct? if not i retract the statement) it would be the ideal choice as you would likely need the same chassis and hardware to get consistent results, so choosing the most common phone would be the logical thing to do. Given the methodology it looks like it could be equally applied to just about any smartphone though.
So with this technique, a password of "correct horse battery staple" would be detected, but "Tr0ub4dor" would not (http://xkcd.com/936/)...
Quick wafting zephyrs vex bold Jim
The article says that the software requires a gyroscope in addition to the accelerometer to clear the data up enough for decoding, which laptops don't have. Additionally, I don't think the accelerometers built in to laptops are sensitive enough, they're meant for freefall detection as opposed to playing games.
Personally, I'd like to see someone make this work with a Wiimote next.
Anyway, who would go through the trouble of making a keylogger that worked by reading a laptop's accelerometer when you can make a keylogger that worked by reading a laptop's keyboard.
Where can I download SWYPE for my desktop?
Did you even read the summary? Or the headline?
Indeed. It isn't even the phone that is vulnerable. It is the keyboard.
Similar idea from 6 years ago, but using acoustics rather than vibrations
https://freedom-to-tinker.com/blog/felten/acoustic-snooping-typed-information
T-Mobile with UMA (aka WiFi Calling) will do you well. I live on a small Indian fishing village in NW Washington State. Crap cell coverage here too.
-- I have a private email server in my basement.
lol!!
You sir, made my day.
I bet the GP poster is fat and ugly and stinks like shit. He probably has delusions of adequacy though.
if you left your phone on a desk next to a keyboard, it'll get stolen. (but seriously, it's not much of a security risk, you would do better, IMHO, recording the sound of the keys with the phone's mic)
There was an unknown error in the submission.
Of all the reasons not to buy an iphone, this is by far the stupidest most non-existant one.
Sorry if you think so,but I'm disabled and on a fixed income.The cost is not worth it.
Geek Hillbilly
My old logitech keyboard allows encryption of the information sent.
And this could be useful when you don't have access to the system - A pair of sensors left under a monitor, or behind it, could be enough to gather information from a classified and locked down computer.
Maybe because you'd need physical (or network exploitable) access to the target laptop in order to install a keylogger? Reading accelerometer data from your own laptop that you could have pre-configured and casually put down on victim's desk requires no direct access to victim's PC.
word up.
Two Slashdot articles today about university researchers developing snooping technology - this, and the gizmo that sees through walls. Is it just me or is 99% of all academic research funded by the 'defense department' these days?
yes. and yes. My point remains, just because you don't get it doesn't diminish it at all.
Swype doesn't have sudden jolts to which one tie to keystroke taps on a virtual keyboard. It is fluid motion and is, in itself "guessing" by the complete pattern which word you're attempting to type. Good luck pairing two key taps together using SWYPE. How does software that depends on sudden jolts work with fluid motion?
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
The researchers place a phone with custom software near a desktop keyboard. The custom software records vibrations from the desktop keyboard using the phone's accelerometers. Using statistical analysis, they can decode the vibrations to figure out what was typed on the desktop keyboard. They wouldn't have to use a phone--it's just a cheap, convenient source of commodity accelerometers. They could just as easily put custom hardware (with accelerometers) on the desktop and sniff in exactly the same manner.
They aren't sniffing what you type on the phone. They're using the phone to sniff what you type on your desktop keyboard. The type of keyboard you use on the phone is completely irrelevant.
Sooo... "Need to eavesdrop on someone? There's an app for that." And I make this joke as an iPhone user who got the 4S the first week it was out, so please, no "Apple hater" accusations.
I suspect he was referring not to your remote status so much as the article...and I agree, not buying an iPhone because of this would be pretty stupid (if nothing else, most decent Android phones would be just as vulnerable). Based on everything my phone does, however, with a wifi connection, I would probably get one even if I didn't have reception at my house. But, we each chose for ourselves.
RTFA is Known to the State of California to cause cancer.
You don't come up with it using your imagination. No password you pull out of "head entropy" is random. Nor likely to be particularly secure.
You use a pair of dice and a scrabble dictionary, or dice and a printout of 2k (or some other number of selected words so you can use an integer number of dice rolls per word).
Or you take your 2k words, and chomp off 11 bits at a time from /dev/random to pick, for however long you want your password to be.
If you hand select the 2k words, you can make sure that there aren't any corner cases in there (there are way more than 2k words with 5-8 letters...)
There is no reason to EVER use complicated symbols, or even numbers and capitals if you don't feel like it. In almost every password generation scheme, there's a length that has whatever level of security you want. And some things are easier to remember, even if they're long.
The hidden problem is that you shouldn't let users pick their own passwords. Passwords should be generated automatically (dice roll can be considered automatic for the purposes. It doesn't have to be a computer program) from random sources.
Allowing users to even so much as pick something they think they'll remember easily from a list of passwords destroys confidence in your protocol by artificially limiting the number of actual possibilities to a mere subset of what you think it is.
Better to come up with a protocol in which every possible password in the password space is not too hard to remember, and always use a password generated entirely from randomness.
Can you be Even More Awesome?!