Slashdot Log In
Compromising Wired Keyboards
Posted by
CmdrTaco
on Mon Oct 20, 2008 08:30 AM
from the not-a-lot-of-substance-here dept.
from the not-a-lot-of-substance-here dept.
Flavien writes "A team from the Security and Cryptography Laboratory (LASEC) in Lausanne, Switzerland, found 4 different ways to fully or partially recover keystrokes from wired keyboards at a distance up to 20 meters, even through walls. They tested 11 different wired keyboard models bought between 2001 and 2008 (PS/2, USB and laptop). They are all vulnerable to at least one of the 4 attacks. While more information on these attacks will be published soon, a short description with 2 videos is available."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
No comment.. (Score:5, Funny)
I won't type what I think about that...
Re: (Score:3, Funny)
Great - now I have to tinfoil my house as well as my head!
TEMPEST (Score:5, Informative)
This appears to be related to why TEMPEST [wikipedia.org] attacks work on monitors.
Re:TEMPEST (Score:5, Insightful)
Parent
Re: (Score:3, Interesting)
Re:TEMPEST (Score:5, Funny)
Oh great, now you've given them the idea.
One goatse was bad enough :(
Parent
Re:TEMPEST (Score:4, Funny)
On second thought...I need to go wash my mind out with bleach now.
Parent
Re: (Score:3, Interesting)
Re:TEMPEST (Score:4, Interesting)
...I could see a script that generates a random keyboard layout, a key-to-character chart would have to printed on the screen...
INGdirect [ingdirect.com] does this with their log in. Users have a numeric password, they can enter it by:
-using the mouse to click the number pad displayed on the screen, or
-typing the letters that are randomly assigned to the numbers on the screen
Parent
Re:TEMPEST (Score:5, Interesting)
Parent
Re:TEMPEST (Score:5, Insightful)
I don't see the big "News Flash" on this.
I think the big news flash on this is that they actually performed four different, real attacks on real, physical keyboards. Theory is one thing, someone actually saying "hey, we can really do this on the cheap now to 11 different keyboards sold at your local Best Buy; here's how..." is another. I don't think it's unreasonable to consider that "news for nerds."
Parent
Re:TEMPEST (Score:5, Funny)
When the first mass-transit-quality teleporter is installed in a major city, there will be a commenter on Slashdot, sneering at it: "This isn't news. They've been doing that at the quantum level for years."
Parent
Re:TEMPEST (Score:4, Funny)
The TEMPEST attack is nothing compared to the TEMPEST 2000 attack. Pew pew pew!
Parent
Dubious claim (Score:5, Funny)
Easier way to open the car... (Score:5, Funny)
Its much easier with a cricket ball. Just use it to break the window.
Parent
Re:Easier way to open the car... (Score:5, Funny)
Its much easier with a cricket ball. Just use it to break the window.
That may be how the Brits do it, but using a bowling ball generally meets with smashing success.
Parent
Re:Easier way to open the car... (Score:5, Funny)
Obviously, you'll have to turn the car upside-down if you're going to use a bowling ball. Some people would find that inconvenient.
Canadians seem to find it easy enough: they use curling stones. Maybe it's easier to flip a car on ice?
Parent
Re:Easier way to open the car... (Score:4, Funny)
Parent
Re: (Score:2)
Probably...something while technically possible, is not very feasible for practical use.
I really just posted to comment on your sig. I think there is a worse oxymoron: Military Intelligence
Hmm... (Score:4, Funny)
I might have to extend my tinfoil hat to some kind of head-mounted lead telephone box.
Re:Hmm... (Score:4, Funny)
Chief, don't you think we should use the Cone of Silence?
Parent
If it only works on Wired keyboards... (Score:5, Funny)
...why should I worry? I work for BoingBoing.
Time for a Faraday cage? (Score:5, Interesting)
Looks like a room or building size Faraday Cage [wikipedia.org] (a foil hat the size of your house!) might be the only defence...
Especially considering that you can also detect what is shown on monitors (again, by detecting the electromagnetic radiation), and so on screen "keyboards" operated with a mouse become not so useful.
It's not clear from the article whether they have have the keyboard before hand to be able to record which key-press outputs what radiation, or if they can use this (and by that I mean one of the four) technique on any old keyboard, including ones they haven't seen before.
Anyway, this shouldn't be too surprising to anyone, electronics emit electromagnetic radiation, which can be captured.
Re:Time for a Faraday cage? (Score:5, Insightful)
Being the only house on your block not radiating all sorts of data sounds like an excellent reason for the DHS to perform a no-knock raid with a legions of SWAT teams and an armored troop carrier or two.
Parent
Re:Time for a Faraday cage? (Score:5, Funny)
Which is why you move to Pennsylvania and live among the Amish. Also, your crazy hacker beard will look a little less crazy.
Parent
Re:Time for a Faraday cage? (Score:5, Funny)
The solution to this is simple. Have at least one computer outside the cage. If you have a teenage, even better. Cause nothing would drive those eavedroppers crazy than listening in on teenage conversations:
No way!
4sho!
LOLZ
idc. let's go w bff jill
Of course, this might be one of those cases where the solution is worse than the problem.
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Oh, wow, I don't know how it happened but you're both right, and I'm not even in a cube!
Re: (Score:3, Informative)
The + on the 120VAC is extraneous.
Re:Time for a Faraday cage? (Score:5, Interesting)
This is actually easier to do than you might imagine. My old house was essentially a Faraday Cage. You could NOT get a wireless signal more then 1 foot outside it. Why? Aluminum Siding. Add in aluminum powder tinted windows (triple layer UV and thermal glass) and the only leakage was straight up through the roof.
So you could get an OK cell-phone signal on the second floor (2 bars), but almost nothing on the first floor. Walk out the front door, 4 bars. Same with WiFi. Full strength "g" signal anywhere inside, walk outside and the connection drops.
My current home has asbestos siding (bleah!) that does nothing to attenuate the Wifi signal, so I actually had to encrypt my wireless for the first time ever when I moved. I can pick up my wireless signal about 2 doors away now, and it's the same wireless device I used in my old house, located in a roughly similar spot (close to the center of the house, in the basement, on a shelf near the basement rafters)
If I could I'd re-side in Aluminum again, but the costs to re-side an asbestos tile sided house are astronomical, and many places simply won't do it.
Regardless, if you really want to attenuate any wireless signals going into or out of your home, slap on some aluminum siding. You'll kill those pesky wireless signals, AND make your house look really nice at the same time.
Parent
Cryptonomicomics (Score:5, Insightful)
Oh no, we will have to learn to type code by tapping on a single key and read the results in the flickering of the hard drive light.
When they can manage the same trick in a noisy office environment with dozens of keyboards and monitors in use, then I'll worry.
Re: (Score:3, Interesting)
Re:Cryptonomicomics (Score:5, Insightful)
Most modems back in the '80s just ran either RD, TD, or (RD|TD) through the LED. It was cheap and easy and gave you a good activity signal. Nobody cared about people sniffing the data through the LED, and really hardly anyone is ever going to be in a situation where they're even potentially exposed. And for virtually all the rest, this is hardly the low hanging fruit... if you can get close enough to read the LED, you're close enough to see what the target is doing any number of easier ways.
Parent
Re: (Score:3, Funny)
Or you could always get a second keyboard and a monkey. Combined together, they should generate enough random data to disguise what you are typing.
Not too bad (Score:2)
laptops only? (Score:3, Insightful)
Re:laptops only? (Score:5, Informative)
I understood that the disconnecting of the charger was because of that the "victim" laptop computer and the "attacker" desktop computer were connected to the same electrical mains network of the building.
By disconnecting the laptop charger it was proven that the keyboard signal was truly intercepted from over-the-air electromagnetic radiation, as the laptop was "independent" and not connected to anything. There was not any chance that the signal could have leaked or transmitted any other way.
Parent
Re: (Score:3, Informative)
I think they only removed the power supply and monitor because sniffing monitor and power supply emissions are known attacks. They wanted to demonstrate that it really was the keyboard they were sniffing. I guess we'll have to wait for the paper to see how well it works when the other emissions you get from a complete system are pr
Encryption (Score:2)
Re: (Score:3, Funny)
I see you shelled out for the decoder monkey.
Nothing new (Score:5, Interesting)
Re:Nothing new (Score:5, Informative)
It's called van Eck phreaking, and it's been applied to monitors for a while now, but no-one's really talked about sniffing from the keyboard.
Parent
But did they test with a Model M? (Score:5, Funny)
As everyone should know, the IBM Model M is the One True Keyboard. Surely all of the steel plating inside that thing must be good for something! If all else fails, the relentless clicking while they listen to your bugged cube or house should drive them completely insane.
Even if it doesn't prevent snooping, you could still use the thing as a self-defense weapon when Mysterious Men From the Shadows come to capture you.
SirWired
Re:But did they test with a Model M? (Score:5, Funny)
Parent
MI5 & Intelligence Agencies (Score:3, Interesting)
MI5 have had this for years. I mean at the range talked about in the article they can also get a good picture quality from your monitor too. This problem has been known about since the 1980s and is the reason why the security services use magnetic shielding either in an entire building or just in private rooms (such as those that exist in every British Embassy internationally).
EM leaks have no real solution at this stage except to shield like crazy. There is potential for some kind of white noise generator but different pieces of electronics would require one tuned to them and the levels required would make a blanket device expensive, or overly large.
I wouldn't worry about people listening in to your keyclicks at home just yet. Perhaps if you work a big corp and there is money on the line. Corporate espionage is big business arguably even bigger than legitimate government work.
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
CRT monitors used to leak a lot of EM. Is it still working with LCD screens ? I doubt it
http://www.cl.cam.ac.uk/~mgk25/pet2004-fpd.pdf
Shenanigans? (Score:5, Interesting)
If the eavesdropper is in a polling state it should continue looking for more keypresses, unless something there are some smoke and mirrors going on. Also, if you listen there's no termination sent --no keypresses heard on camera.
Strange program.... (Score:3)
Sure - it *could* have an exit condition where it quits if it hasn't seen a keystroke in n seconds. But, on the second video, it doesn't time out while the camera goes to the other room - but it does time out while the camera comes back. And besides - who would create their program that way? Just have it decode anything received in an infinite loop - far easier to use.
Re: (Score:3, Interesting)
On the other hand, all the extra blinkenlights would create more interference, reducing the effectiveness of this attack.