[Infowarrior] - Keystroke 'sounds' can be interpreted

[Richard Forno]

(So does this mean we can consider iTunes to be a security tool now?  *g*   --rick)

Loose clicks sink ships

Computer security: The sounds of individual keystrokes can be distinguished, making it possible to eavesdrop on computer users

Jun 10th 2010

http://www.economist.com/node/16295574

CLATTERING keyboards may seem the white noise of the modern age, but they betray more information than unwary typists realise. Simply by analysing audio recordings of keyboard clatter, computer scientists can now reconstruct an accurate transcript of what was typed—including passwords. And in contrast with many types of computer espionage, the process is simple, requiring only a cheap microphone and a desktop computer.

Such snooping is possible because each key produces a characteristic click, shaped by its position on the keyboard, the vigour and hand position of the typist, and the type of keyboard used. But past attempts to decipher keyboard sounds were only modestly successful, requiring a training session in which the computer matched a known transcript to an audio recording of each key being struck. Thus schooled, the software could still identify only 80% of the characters in a different transcript of the same typist on the same machine. Furthermore, each new  typist or keyboard required a fresh transcript and training session, limiting the method’s appeal to would-be hackers.

Now, in a blow to acoustic security, Doug Tygar and his colleagues at the University of California, Berkeley, have published details of an approach that reaches 96% accuracy, even without a labelled training transcript. The new approach employs methods developed for speech-recognition software to group together all the similar-sounding keystrokes in a recording, generating an alphabet of clicks. The software tentatively assigns each click a letter based on its frequency, then tests the message created by this assignment using statistical models of the English language. For example, certain letters or words are more likely to occur together—if an unknown keystroke follows a “t”, it is much more likely to be an “h” than an “x”. Similarly, the words “for example” make likelier bedfellows than “fur example”. In a final refinement, the researchers employed a method many students would do well to deploy on term papers: automated spellchecking.

By repeatedly revising unlikely or incorrect letter assignments, Dr Tygar’s software extracts sense from sonic chaos. That said, the method does have one limitation: in order to apply the language model, at least five minutes of the recorded typing had to be in standard English (though in principle any systematic language or alphabet would work). But once those requirements are met, the program can decode anything from epic prose to randomised, ten-character passwords.

This sort of acoustic analysis might sound like the exclusive province of spies and spooks, but according to Dr Tygar, such attacks are not as esoteric as you might expect. He says it is quite simple to find the instructions needed to build a parabolic or laser microphone on the internet. You could just point one from outside towards an office window to make a recording. And as he points out, would-be eavesdroppers might not even need their own recording equipment, as laptop computers increasingly come equipped with built-in microphones that could be hijacked.

To protect against these sonic incursions, Dr Tygar suggests a simple remedy: turn up the radio. His computers were less successful at parsing recordings made in noisy rooms. Ultimately, though, more sophisticated recording gear could overcome even background noise, rendering any typed text vulnerable. Dr Tygar therefore recommends that typed passwords be phased out, to be replaced with biometric scans or multiple types of authorisation that combine a password with some form of silent verification (clicking on a pre-chosen picture in a selection of images, for example). Loose lips may still sink ships, but his research demonstrates that an indiscreet keystroke could do just as much damage.

The Economist Technology Quarterly | Technology Quarterly