Swiss Researchers Sniff Password from Wired Keyboard

Use Netsparker

Now this is an interesting twist on an oldschool method of hacking, the monitoring of electromagnetic radiation.

You’d think it’d be easier to sniff the traffic from a wireless keyboard, but generally it’s not as they tend to be encrypted. Where as the electromagnetic radiation given off by a wired keyboard is not shielded or protected it any way.

All you need to do is have the equipment and the know-how to decipher it.

Swiss researchers have demonstrated a variety of ways to eavesdrop on the sensitive messages computer users type by monitoring their wired keyboards. At least 11 models using a wide range of connection types are vulnerable.

The researchers from the Security and Cryptography Laboratory at Ecole Polytechnique Federale de Lausanne are able to capture keystrokes by monitoring the electromagnetic radiation of PS/2, universal serial bus, or laptop keyboards. They’ve outline four separate attack methods, some that work at a distance of as much as 65 feet from the target.

In one video demonstration, researchers Martin Vuagnoux and Sylvain Pasini sniff out the the keystrokes typed into a standard keyboard using a large antenna that’s about 20 to 30 feet away in an adjacent room.

It appears to work on both the older PS/2 keyboards and new USB keyboards and even laptop keyboard from a distance of up to 65 feet! That’s easily far enough to jack the data from a carpark, adjacent office or nearby hotel room.

I’d imagine the equipment required is quite bulky though.

“We conclude that wired computer keyboards sold in the stores generate compromising emanations (mainly because of the cost pressures in the design),” they write here. “Hence they are not safe to transmit sensitive information.”

No doubt, electromagnetic eavesdropping dates back to the mid 1980s, if not earlier. But Vuagnoux says many of today’s keyboards have been adapted to prevent those attacks from working. The research shows that even these keyboards are vulnerable to electromagnetic sniffing.

The video demonstrations show a computer that reads input from antennas that monitor a specified frequency. In both cases, the computer was able to determine the keystrokes typed on keyboards connected to a laptop and power supply and LCD monitors were disconnected to prevent potential power transmissions or wireless communications. Vuagnous said in an email that the attacks would still work even if the power supplies and monitors were plugged in.

It seems the modifications made to keyboards to prevent this kind of sniffing has either been removed to save cost or was never tested properly in the first place.

So be careful! If what you are doing is super sensitive you might be better off using an on-screen keyboard.

Source: The Register

Posted in: Hardware Hacking, Password Cracking

Latest Posts:

HTTP Security Considerations - An Introduction To HTTP Basics HTTP Security Considerations – An Introduction To HTTP Basics
HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.
Cangibrina - Admin Dashboard Finder Tool Cangibrina – Admin Dashboard Finder Tool
Cangibrina is a Python-based multi platform admin dashboard finder tool which aims to obtain the location of website dashboards by using brute-force, wordlists etc.
Enumall - Subdomain Discovery Using Recon-ng & AltDNS Enumall – Subdomain Discovery Using Recon-ng & AltDNS
Enumall is a Python-based tool that helps you do subdomain discovery using only one command by combining the abilities of Recon-ng and AltDNS.
RidRelay - SMB Relay Attack For Username Enumeration RidRelay – SMB Relay Attack For Username Enumeration
RidRelay is a Python-based tool to enumerate usernames on a domain where you have no credentials by using a SMB Relay Attack with low privileges.
NetBScanner - NetBIOS Network Scanner NetBScanner – NetBIOS Network Scanner
NetBScanner is a NetBIOS network scanner tool that scans all computers in the IP addresses range you choose, using the NetBIOS protocol.
Metta - Information Security Adversarial Simulation Tool Metta – Information Security Adversarial Simulation Tool
Metta is an information security preparedness tool in Python to help with adversarial simulation and assess security defense preparation and alerts.

8 Responses to Swiss Researchers Sniff Password from Wired Keyboard

  1. Degis October 22, 2008 at 11:35 am #

    Would not an “on-screen keyboard” be vulnerable from an Van Eck eavesdropper instead. But if the typing is showing up on screen, you’re always vulnerable to Van Eck I guess…

  2. navin October 22, 2008 at 1:49 pm #

    OMG…this is James Bondishly cool!!

    By the way, I don’t agree with Degis…Van Eck phreaking is almost nil coz of the fact tht most companies use methods to encode videos such tht its not disturbing the image on the screen, but is harder to reverse engineer the electro mag radiations into images!!

  3. CBRP1R8 October 22, 2008 at 2:04 pm #

    This is standard Tempest Security and has been known about and well documented since WW2. Electronics emenate a field, this can be monitored, period. From the teletype and mod28’s up to the 70’s to the mod 40’s in the 70-80’s and then the replacement of PC’s in the 90’s. Not really anything new, but now they concentrate on making the building tempest proof instead of the equipment, its much more effecient to have a SES or faraday cage or clean room whatever you want to call it then it is to try to proof all the equipment.

  4. Morgan Storey October 24, 2008 at 4:37 am #

    @CBRP1R8: Exactly, special film on the glass, absorbing metal in the walls, and you are done. Bad luck if you have a mobile etc though.
    One of the guys at work worked on a job a few years ago where they successfully captured data travelling over cat5 from about 20ft away and through the side of a building, that is pretty scary, but like you said if it really is needed faraday cage the whole building and be done with it.

  5. Pantagruel October 25, 2008 at 10:05 am #

    Eventhought the technique of data capturing through EM monitoring is indeed quite old school, it’s still a good story.

    Guess it’s time to swap the tin-foil hat for a Copper-foil version ;)
    and for those fond of home improvement, have a look at:,39024663,39121501,00.htm

    Wonder what designs they offer :)

  6. goodpeople October 27, 2008 at 9:17 am #

    Fun to read. More fun to eplore, but hardly a threat for the majority of people.

  7. Ingo October 29, 2008 at 11:57 am #

    Imagine using this to eavesdrop an ATM, or the alarm keypad in a house…

  8. Morgan Storey October 29, 2008 at 11:02 pm #

    Most of them are secured in someway, ATM’s by there very safe-like construction block a lot of RF, you can pick it up internall or if you are real close. These types of things have been known for a while see Terminator 2 :P
    Alarm Keypads maybe able to be picked up depending again on their design and construction.