Never let them hear you type.

[Q.E.D]

In doing some searching for the GQ question about the oldest audio recording available online, I came across this interesting article. Seems another thing the truly paranoid have to worry about now:

A new security threat revealed by computer scientists at the University of California, Berkeley, may be enough to drive some people away from their computer keyboards and back to pen and paper. The researchers show that a simple audio recording of those keyboard clicks can betray the text you just entered, from passwords to secret love notes.

Even scarier:

Once the system is trained, recovering the text became more straightforward, even if the text was a password and not an English word. After just 20 attempts, the researchers were able to retrieve 90 percent of five-character passwords, 77 percent of eight-character passwords and 69 percent of 10-character passwords.

And it was all done with a $10 microphone like the ones you can buy in any computer or electronics retailer. Type softly, folks.

[engineer_comp_geek]

If someone is in my office to set up a mic they can just read my password off of the yellow sticky note stuck on the bottom of my monitor (insert grumbling and complaining about letter/number/long passwords required by IT here).

Still, kinda scary.

[Spatial_Rift_47]

That’s nothing. If you read Neal Stephenson’s <i>Cryptonomicon</i>, you find out about something called Van Eck Phreaking, wherein the interested party reads the magnetic field coming from the cable connecting the motherboard to the monitor, thereby getting not just keystrokes but the actual image itself – everything that’s on the target computer’s screen can be read this way. It’s sort of like tapping the phone line between monitor and CPU, and it’s a completely passive scan, so it has no effect on the computer on which it’s spying. I’m a bit hazy on the details as it’s been a while since I read the novel.

[Q.E.D]

@Spatial Rift 47

I’m a bit hazy on the details as it’s been a while since I read the novel.

There is actually REAL technology that can do this. It essentially reads the RF emanations from the monitor screen using highly directional antennas to reconstruct the image. Read this PDF technical paper on the subject: Optical Time-Domain Eavesdropping Risks of CRT Displays.

[theLaughingMan]

Damn, beat out while looking for a good web site that covers the info. This is a website about the governments response to ‘Van Eck Phreaking.’

My problem is this, like the above, one could do this but why? Unless it’s really, really, really important, it just sounds paranoid to be worried about this kind of stuff. If you’ve got information that you don’t want people see via Van Eck or Audio Keylogging, you need to secure your hardware better.

[Cicero]

I had a telephone hook up today so I sneaked home to call in from home. I am careful not to type at the time (no mute button at home) to ensure they aren’t convinced that my mind is elsewhere. All worked well until the mongrel cat came in and started meowing for food. Cats with a guts ache have no mute button either.

[Smeghead]

Expect to see this as a major plot point in all the network crime dramas next year.

[Misnomer]

Ok, so, anyone know where I can get a silent keyboard?

[Greenback]

Ask and you shall receive

[Misnomer]

I love this board!

[gotpasswords]

Speaking as a security geek, I’m not overly concerned about this. The rest of the security community’s also pretty blase’ about it.

It’s kinda-sorta a variant on Tempest emissions. This time, the emissions are noise, rather than electromagnetic, but if someone’s close enough to be able to hear your typing, they’re close enough to plug in a keylogger or otherwise physically mess with the computer.

However, as a proof-of-concept, it’s fascinating.

[Mama_Tiger]

Here’s another silent keyboard:

From our good friends at Think Geek

I actually own this one – it rolls up into a 5’x5’ box and is absolutely silent when being used. (I got it for space-saving when traveling, not for silence, but why look a gift horse in the mouth?)

There are ways to get around anything the Evil Folks dream up. Muwahaha…

[DMark]

If you wear a tin foil hat while you type, they cannot hear the keyboard.
Also, my passwords are either 1111, or 2222, or 3333…so it would have to be one very clever spy to figure out which one I am using that month!

I feel totally secure.

(For these and other tips, please refer to the Homeland Security manual, page 372)

[chappachula]

“keylogging” has been possible for 50 years. The CIA and KGB used microphones in embassy walls to pick up the click of typewriter keys hitting the platen( for the kids-- that’s the round part of the typewriter that the sheet of paper is /was rolled around ).
But it probably cost more than $10.

Sorry, no cite. I just remember being surprised to read it in a newspaper report about the US Embassy in Moscow, which was discovered in 1975(?) to be bugged.It seemed like really exotic high-tech at the time.

[chappachula]

@DMark

Also, my passwords are either 1111, or 2222, or 3333…

gee, why didnt I think of that. …My password is usually abcdef.
I guess you’re just smarter than me…

[Spatial_Rift_47]

@Q.E.D.

There is actually REAL technology that can do this. It essentially reads the RF emanations from the monitor screen using highly directional antennas to reconstruct the image. Read this PDF technical paper on the subject: Optical Time-Domain Eavesdropping Risks of CRT Displays.

Oh, I knew it was real. It’s just that the novel was my only source of info on the subject.

@chappachula

@DMark

Also, my passwords are either 1111, or 2222, or 3333…

gee, why didnt I think of that. …My password is usually abcdef.
I guess you’re just smarter than me…

Ha! My passwords are 12345. Just like on my luggage, and my planet shield. [/geek]

[Q.E.D]

@gotpasswords

Speaking as a security geek, I’m not overly concerned about this. The rest of the security community’s also pretty blase’ about it.

Oh, I completely agree. I just posted it because…well, you said it:

@gotpasswords

However, as a proof-of-concept, it’s fascinating.

Definitely!

[Dr.Rieux]

@Smeghead

Expect to see this as a major plot point in all the network crime dramas next year.

Coming soon to CBS: CSI: Palo Alto.

[TokyoBayer]

From the article

“Background noise definitely made it harder to recover accurate text, but the differences became smaller after several rounds of feedback,” said Tygar. “Given enough tries, the computer algorithm will eventually come up with a pretty good estimate of the text that was typed.”

The researchers noted that sophisticated Karaoke systems already exist that can separate voice and music, so it may be possible to separate out music from the taps and clicks on a keyboard

I guess you could play a background noice of 1,000 monkeys trying to type Shakespeare, and it may protect you if it didn’t drive you nuts first.

[gotpasswords]

Or the Tom Tom Club’s Wordy Rappinghood.