22 October 2008 | 17,599 views

Swiss Researchers Sniff Password from Wired Keyboard

Check For Vulnerabilities with Acunetix

Now this is an interesting twist on an oldschool method of hacking, the monitoring of electromagnetic radiation.

You’d think it’d be easier to sniff the traffic from a wireless keyboard, but generally it’s not as they tend to be encrypted. Where as the electromagnetic radiation given off by a wired keyboard is not shielded or protected it any way.

All you need to do is have the equipment and the know-how to decipher it.

Swiss researchers have demonstrated a variety of ways to eavesdrop on the sensitive messages computer users type by monitoring their wired keyboards. At least 11 models using a wide range of connection types are vulnerable.

The researchers from the Security and Cryptography Laboratory at Ecole Polytechnique Federale de Lausanne are able to capture keystrokes by monitoring the electromagnetic radiation of PS/2, universal serial bus, or laptop keyboards. They’ve outline four separate attack methods, some that work at a distance of as much as 65 feet from the target.

In one video demonstration, researchers Martin Vuagnoux and Sylvain Pasini sniff out the the keystrokes typed into a standard keyboard using a large antenna that’s about 20 to 30 feet away in an adjacent room.

It appears to work on both the older PS/2 keyboards and new USB keyboards and even laptop keyboard from a distance of up to 65 feet! That’s easily far enough to jack the data from a carpark, adjacent office or nearby hotel room.

I’d imagine the equipment required is quite bulky though.

“We conclude that wired computer keyboards sold in the stores generate compromising emanations (mainly because of the cost pressures in the design),” they write here. “Hence they are not safe to transmit sensitive information.”

No doubt, electromagnetic eavesdropping dates back to the mid 1980s, if not earlier. But Vuagnoux says many of today’s keyboards have been adapted to prevent those attacks from working. The research shows that even these keyboards are vulnerable to electromagnetic sniffing.

The video demonstrations show a computer that reads input from antennas that monitor a specified frequency. In both cases, the computer was able to determine the keystrokes typed on keyboards connected to a laptop and power supply and LCD monitors were disconnected to prevent potential power transmissions or wireless communications. Vuagnous said in an email that the attacks would still work even if the power supplies and monitors were plugged in.

It seems the modifications made to keyboards to prevent this kind of sniffing has either been removed to save cost or was never tested properly in the first place.

So be careful! If what you are doing is super sensitive you might be better off using an on-screen keyboard.

Source: The Register



Recent in Hardware Hacking:
- Hackers Recreate NSA Snooping Kit Using Off-the-shelf Parts
- SHODAN – Expose Online Devices (Wind Turbines, Power Plants & More!)
- 14-Year Olds Hack ATM With Default Password

Related Posts:
- yahoo password grabber
- RawCap – Free Command Line Packet/Network Sniffer For Windows (Raw Sockets)
- Open Source Keykeriki Captures Wireless Keyboard Traffic

Most Read in Hardware Hacking:
- Elevator/Lift Hacking !!!!! - 76,303 views
- Military Communications Hacking – Script Kiddy Style - 49,335 views
- Hackers Crack London Tube Oyster Card - 41,436 views

Low-cost VPS Hosting

8 Responses to “Swiss Researchers Sniff Password from Wired Keyboard”

  1. Degis 22 October 2008 at 11:35 am Permalink

    Would not an “on-screen keyboard” be vulnerable from an Van Eck eavesdropper instead. But if the typing is showing up on screen, you’re always vulnerable to Van Eck I guess…

  2. navin 22 October 2008 at 1:49 pm Permalink

    OMG…this is James Bondishly cool!!

    By the way, I don’t agree with Degis…Van Eck phreaking is almost nil coz of the fact tht most companies use methods to encode videos such tht its not disturbing the image on the screen, but is harder to reverse engineer the electro mag radiations into images!!

  3. CBRP1R8 22 October 2008 at 2:04 pm Permalink

    This is standard Tempest Security and has been known about and well documented since WW2. Electronics emenate a field, this can be monitored, period. From the teletype and mod28’s up to the 70’s to the mod 40’s in the 70-80’s and then the replacement of PC’s in the 90’s. Not really anything new, but now they concentrate on making the building tempest proof instead of the equipment, its much more effecient to have a SES or faraday cage or clean room whatever you want to call it then it is to try to proof all the equipment.

  4. Morgan Storey 24 October 2008 at 4:37 am Permalink

    @CBRP1R8: Exactly, special film on the glass, absorbing metal in the walls, and you are done. Bad luck if you have a mobile etc though.
    One of the guys at work worked on a job a few years ago where they successfully captured data travelling over cat5 from about 20ft away and through the side of a building, that is pretty scary, but like you said if it really is needed faraday cage the whole building and be done with it.

  5. Pantagruel 25 October 2008 at 10:05 am Permalink

    Eventhought the technique of data capturing through EM monitoring is indeed quite old school, it’s still a good story.

    Guess it’s time to swap the tin-foil hat for a Copper-foil version ;)
    and for those fond of home improvement, have a look at:

    networks.silicon.com/lans/0,39024663,39121501,00.htm

    Wonder what designs they offer :)

  6. goodpeople 27 October 2008 at 9:17 am Permalink

    Fun to read. More fun to eplore, but hardly a threat for the majority of people.

  7. Ingo 29 October 2008 at 11:57 am Permalink

    Imagine using this to eavesdrop an ATM, or the alarm keypad in a house…

  8. Morgan Storey 29 October 2008 at 11:02 pm Permalink

    Most of them are secured in someway, ATM’s by there very safe-like construction block a lot of RF, you can pick it up internall or if you are real close. These types of things have been known for a while see Terminator 2 :P
    Alarm Keypads maybe able to be picked up depending again on their design and construction.