Keyboard Clicks Now Pose A Threat

by CXOtoday Staff    Sep 16, 2005

A new security threat revealed by computer scientists at the University of California, Berkeley, may be enough to drive some people away from their computer keyboards and back to pen and paper.

The researchers show that a simple audio recording of those keyboard clicks can betray the text you just entered, from passwords to secret love notes. “Acoustical spying” using an audio recording of the sounds generated by typing on a computer keyboard is a potential security threat identified by UC Berkeley researchers.

The researchers were able to take several 10-minute sound recordings of users typing at a keyboard, feed the audio into a computer, and use an algorithm to recover up to 96 percent of the characters entered.

Each keystroke makes a relatively distinct sound, however subtle, when hit. Typical users type about 300 characters per minute, leaving enough time for a computer to isolate the sounds of individual keystrokes and categorize the letters based upon the statistical characteristics of English text. For example, the letters “th” will occur together more frequently than “tj,” and the word “yet” is far more common than “yrg.”

“Using statistical learning theory, the computer can categorize the sounds of each key as it’s struck and develop a good first guess with an accuracy of 60 percent for characters, and 20 percent for words,” said Li Zhuang, a UC Berkeley Ph.D. student in computer science and lead author of the study.

“We then use spelling and grammar checks to refine the results, which increased the character accuracy to 70 percent and the word accuracy to 50 percent. The text is somewhat readable at this point,” added Zhuang.

Once the system is trained, recovering the text became more straightforward, even if the text was a password and not an English word. After just 20 attempts, the researchers were able to retrieve 90 percent of five-character passwords, 77 percent of eight-character passwords and 69 percent of 10-character passwords.

There are limitations to the technique, however. The researchers pointed out that they did not use the Shift, Control, Backspace or Caps Lock keys for their experiments, but describe approaches for training a program to account for those keystrokes as well. The ability to account for use of a computer mouse will be more challenging, the researchers said.

Nevertheless, the findings highlight a security hole that could be exploited and should be investigated, the researchers said.