Wireless Training-Free Keystroke Inference Attack and Defense

Abstract

Existing research work has identified a new class of attacks that can eavesdrop on the keystrokes in a non-invasive way without infecting the target computer to install malware. The common idea is that pressing a key of a keyboard can cause a unique and subtle environmental change, which can be captured and analyzed by the eavesdropper to learn the keystrokes. For these attacks, however, a training phase must be accomplished to establish the relationship between an observed environmental change and the action of pressing a specific key. This significantly limits the impact and practicality of these attacks. In this paper, we discover that it is possible to design keystroke eavesdropping attacks without requiring the training phase. We create this attack based on the channel state information extracted from the wireless signal. To eavesdrop on keystrokes, we establish a mapping between typing each letter and its respective environmental change by exploiting the correlation among observed changes and known structures of dictionary words. To defend against this attack, we propose a reactive jamming mechanism that launches the jamming only during the typing period. Experimental results on software-defined radio platforms validate the impact of the attack and the performance of the defense.

References

1. [1] Fang S., Markwood I., Liu Y., Zhao S., Lu Z., and Zhu H., “No training hurdles: Fast training-agnostic attacks to infer your typing,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., Oct. 2018, pp. 1747–1760.
2. [2] Chen B., Yenamandra V., and Srinivasan K., “Tracking keystrokes using wireless signals,” in Proc. 13th Annu. Int. Conf. Mobile Syst., Appl., Services, May 2015, pp. 31–44.
3. [3] Ali K., Liu A. X., Wang W., and Shahzad M., “Keystroke recognition using WiFi signals,” in Proc. 21st Annu. Int. Conf. Mobile Comput. Netw., Sep. 2015, pp. 90–102.
4. [4] Li M.et al., “When CSI meets public WiFi: Inferring your mobile phone password via WiFi signals,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., Oct. 2016, pp. 1068–1079.
5. [5] Marquardt P., Verma A., Carter H., and Traynor P., “(sp)iPhone: Decoding vibrations from nearby keyboards using mobile phone accelerometers,” in Proc. 18th ACM Conf. Comput. Commun. Secur. (CCS), 2011, pp. 551–562.
6. [6] Owusu E., Han J., Das S., Perrig A., and Zhang J., “ACCessory: Password inference using accelerometers on smartphones,” in Proc. 12th Workshop Mobile Comput. Syst. Appl. (HotMobile), 2012, pp. 9:1–9:6.
7. [7] Asonov D. and Agrawal R., “Keyboard acoustic emanations,” in Proc. IEEE Symp. Secur. Privacy, May 2004, pp. 3–11.
8. [8] Zhuang L., Zhou F., and Tygar J. D., “Keyboard acoustic emanations revisited,” in Proc. 12th ACM Conf. Comput. Commun. Secur. (CCS), 2005, pp. 373–382.
9. [9] Wang J., Zhao K., Zhang X., and Peng C., “Ubiquitous keyboard for small mobile devices: Harnessing multipath fading for fine-grained keystroke localization,” in Proc. 12th Annu. Int. Conf. Mobile Syst., Appl., Services, Jun. 2014, pp. 14–27.
10. [10] Song D. X., Wagner D., and Tian X., “Timing analysis of keystrokes and timing attacks on SSH,” in Proc. 10th Conf. USENIX Secur. Symp. (SSYM), vol. 10, 2001, pp. 1–17.
11. [11] Ristenpart T., Tromer E., Shacham H., and Savage S., “Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds,” in Proc. 16th ACM Conf. Comput. Commun. Secur. (CCS), 2009, pp. 199–212.
12. [12] Zhang K. and Wang X., “Peeping tom in the neighborhood: Keystroke eavesdropping on multi-user systems,” in Proc. 18th Conf. USENIX Secur. Symp. (SSYM), 2009, pp. 17–32.
13. [13] Compagno A., Conti M., Lain D., and Tsudik G., “Don’t skype & type!: Acoustic eavesdropping in voice-over-IP,” in Proc. ACM Asia Conf. Comput. Commun. Secur., Apr. 2017, pp. 703–715.
14. [14] Zhang Z.et al., “WiPOS: A POS terminal password inference system based on wireless signals,” IEEE Internet Things J., vol. 7, no. 8, pp. 7506–7516, Aug. 2020.
15. [15] Katz J. and Lindell Y., Introduction to Modern Cryptography (Chapman & Hall/CRC Cryptography and Network Security Series). London, U.K.: Chapman & Hall, 2007.
16. [16] (2017). Statistical Distributions of English Text. [Online]. Available: http://www.data-compression.com/english.html
17. [17] Davies M.. (2017). Word Frequency Data From the Corpus of Contemporary American English (COCA). [Online]. Available: http://www.wordfrequency.info/free.asp
18. [18] Pu Q., Gupta S., Gollakota S., and Patel S., “Whole-home gesture recognition using wireless signals,” in Proc. 19th Annu. Int. Conf. Mobile Comput. Netw. (MobiCom), 2013, pp. 27–38.
19. [19] Fang S., Liu Y., Shen W., and Zhu H., “Where are you from: Confusing location distinction using virtual multipath camouflage,” in Proc. 20th Annu. Int. Conf. Mobile Comput. Netw., Sep. 2014, pp. 225–236.
20. [20] Adib F. and Katabi D., “See through walls with WiFi!” in Proc. ACM SIGCOMM Conf. SIGCOMM, Aug. 2013, pp. 75–86.
21. [21] Adib F., Hsu C.-Y., Mao H., Katabi D., and Durand F., “Capturing the human figure through a wall,” ACM Trans. Graph., vol. 34, no. 6, p. 219, Oct. 2015.
22. [22] Fang S., Markwood I., and Liu Y., “Manipulatable wireless key establishment,” in Proc. IEEE Conf. Commun. Netw. Secur. (CNS), Oct. 2017, pp. 1–9.
23. [23] Goldsmith A., Wireless Communications. New York, NY, USA: Cambridge Univ. Press, 2005.
24. [24] Wang G., Zou Y., Zhou Z., Wu K., and Ni L. M., “We can hear you with Wi-Fi!” in Proc. 20th Annu. Int. Conf. Mobile Comput. Netw., Sep. 2014, pp. 593–604.
25. [25] Salvador S. and Chan P., “Toward accurate dynamic time warping in linear time and space,” Intell. Data Anal., vol. 11, no. 5, pp. 561–580, 2007.
26. [26] Wang J. and Katabi D., “Dude, where’s my card?: RFID positioning that works with multipath and non-line of sight,” in Proc. ACM SIGCOMM Conf. (SIGCOMM), Aug. 2013, pp. 51–62.
27. [27] Kumar S., Hamed E., Katabi D., and Erran Li L., “LTE radio analytics made easy and accessible,” in Proc. ACM Conf. SIGCOMM, Aug. 2014, pp. 211–222.
28. [28] Fang S., Liu Y., and Ning P., “Wireless communications under broadband reactive jamming attacks,” IEEE Trans. Depend. Sec. Comput., vol. 13, no. 3, pp. 394–408, May/Jun. 2016.
29. [29] Parlin K., Alam M. M., and Moullec Y. L., “Jamming of UAV remote control systems using software defined radio,” in Proc. Int. Conf. Mil. Commun. Inf. Syst. (ICMCIS), May 2018, pp. 1–6.
30. [30] SparkFun Electronics. (2022). Sparkfun Transceiver Breakout nrf24l01+ (RP-SMA). [Online]. Available: https://www.sparkfun.com/products/705
31. [31] Ettus M., USRP User’s and Developer’s Guide. Santa Clara, CA, USA: Ettus Research LLC, 2005.
32. [32] Shlens J., “A tutorial on principal component analysis,” 2014, arXiv:1404.1100.
33. [33] Oppenheim A. V., Willsky A. S., and Nawab S. H., Signals & Systems, 2nd ed. Upper Saddle River, NJ, USA: Prentice-Hall, Inc., 1996.
34. [34] Rothauser E. H., Chapman W. D., Guttman N., Silbiger H. R., Hecker M. H. L., Urbanek G. E., Nordby K. S., and Weinstock M., “IEEE recommended practice for speech quality measurements,” IEEE Trans. Audio Electroacoust., vol. AU-17, no. 3, pp. 227–246, Sep. 1969.
35. [35] (2017). London Attack: Assailant Shot Dead After 4 Killed Near Parliament. [Online]. Available: http://www.cnn.com/2017/03/22/europe/U.K.-parliament-firearms-incident/index.html
36. [36] Salzman P. J., The Linux Kernel Module Programming Guide. Paramount, CA, USA: CreateSpace, 2009.
37. [37] (2017). 2012 Yahoo! Voices Hack. [Online]. Available: https://en.wikipedia.org/wiki/2012_Yahoo!_Voices_hack
38. [38] Zhou M.et al., “Stealing your Android patterns via acoustic signals,” IEEE Trans. Mobile Comput., vol. 20, no. 4, pp. 1656–1671, Apr. 2021.
39. [39] Zhu T., Ma Q., Zhang S., and Liu Y., “Context-free attacks using keyboard acoustic emanations,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., Nov. 2014, pp. 453–464.
40. [40] Liu J., Wang Y., Kar G., Chen Y., Yang J., and Gruteser M., “Snooping keystrokes with mm-level audio ranging on a single phone,” in Proc. 21st Annu. Int. Conf. Mobile Comput. Netw., Sep. 2015, pp. 142–154.
41. [41] Yu J., Lu L., Chen Y., Zhu Y., and Kong L., “An indirect eavesdropping attack of keystrokes on touch screen through acoustic sensing,” IEEE Trans. Mobile Comput., vol. 20, no. 2, pp. 337–351, Feb. 2021.
42. [42] Berger Y., Wool A., and Yeredor A., “Dictionary attacks using keyboard acoustic emanations,” in Proc. 13th ACM Conf. Comput. Commun. Secur. (CCS), 2006, pp. 245–254.
43. [43] Ling K., Liu Y., Sun K., Wang W., Xie L., and Gu Q., “SpiderMon: Towards using cell towers as illuminating sources for keystroke monitoring,” in Proc. IEEE INFOCOM Conf. Comput. Commun., Jul. 2020, pp. 666–675.
44. [44] Balzarotti D., Cova M., and Vigna G., “ClearShot: Eavesdropping on keyboard input from video,” in Proc. IEEE Symp. Secur. Privacy (SP), May 2008, pp. 170–183.
45. [45] Shukla D., Kumar R., Serwadda A., and Phoha V. V., “Beware, your hands reveal your secrets!” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., Nov. 2014, pp. 904–917.
46. [46] Yue Q., Ling Z., Yu W., Liu B., and Fu X., “Blind recognition of text input on mobile devices via natural language processing,” in Proc. Workshop Privacy-Aware Mobile Comput., Jun. 2015, pp. 19–24.
47. [47] Chen Y., Li T., Zhang R., Zhang Y., and Hedgpeth T., “EyeTell: Video-assisted touchscreen keystroke inference from eye movements,” in Proc. IEEE Symp. Secur. Privacy (SP), May 2018, pp. 144–160.
48. [48] Sun J., Jin X., Chen Y., Zhang J., Zhang R., and Zhang Y., “VISIBLE: Video-assisted keystroke inference from tablet backside motion,” in Proc. Netw. Distrib. Syst. Secur. Symp., 2016, pp. 1–15.
49. [49] Yue Q., Ling Z., Fu X., Liu B., Ren K., and Zhao W., “Blind recognition of touched keys on mobile devices,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., Nov. 2014, pp. 1403–1414.
50. [50] Orebaugh A., “An instant messaging intrusion detection system framework: Using character frequency analysis for authorship identification and validation,” in Proc. 40th Annu. Int. Carnahan Conf. Secur. Technol., Oct. 2006, pp. 160–172.
51. [51] Mason J., Watkins K., Eisner J., and Stubblefield A., “A natural language approach to automated cryptanalysis of two-time pads,” in Proc. 13th ACM Conf. Comput. Commun. Secur. (CCS), 2006, pp. 235–244.

Index Terms

• Networks

  • Network types

    • Mobile networks

    • Wireless access networks

• Security and privacy

  • Systems security