Swiss Researchers Sniff Password from Wired Keyboard

Now this is an interesting twist on an oldschool method of hacking, the monitoring of electromagnetic radiation.

You’d think it’d be easier to sniff the traffic from a wireless keyboard, but generally it’s not as they tend to be encrypted. Where as the electromagnetic radiation given off by a wired keyboard is not shielded or protected it any way.

All you need to do is have the equipment and the know-how to decipher it.

Swiss researchers have demonstrated a variety of ways to eavesdrop on the sensitive messages computer users type by monitoring their wired keyboards. At least 11 models using a wide range of connection types are vulnerable.

The researchers from the Security and Cryptography Laboratory at Ecole Polytechnique Federale de Lausanne are able to capture keystrokes by monitoring the electromagnetic radiation of PS/2, universal serial bus, or laptop keyboards. They’ve outline four separate attack methods, some that work at a distance of as much as 65 feet from the target.

In one video demonstration, researchers Martin Vuagnoux and Sylvain Pasini sniff out the the keystrokes typed into a standard keyboard using a large antenna that’s about 20 to 30 feet away in an adjacent room.

It appears to work on both the older PS/2 keyboards and new USB keyboards and even laptop keyboard from a distance of up to 65 feet! That’s easily far enough to jack the data from a carpark, adjacent office or nearby hotel room.

I’d imagine the equipment required is quite bulky though.

“We conclude that wired computer keyboards sold in the stores generate compromising emanations (mainly because of the cost pressures in the design),” they write here. “Hence they are not safe to transmit sensitive information.”

No doubt, electromagnetic eavesdropping dates back to the mid 1980s, if not earlier. But Vuagnoux says many of today’s keyboards have been adapted to prevent those attacks from working. The research shows that even these keyboards are vulnerable to electromagnetic sniffing.

The video demonstrations show a computer that reads input from antennas that monitor a specified frequency. In both cases, the computer was able to determine the keystrokes typed on keyboards connected to a laptop and power supply and LCD monitors were disconnected to prevent potential power transmissions or wireless communications. Vuagnous said in an email that the attacks would still work even if the power supplies and monitors were plugged in.

It seems the modifications made to keyboards to prevent this kind of sniffing has either been removed to save cost or was never tested properly in the first place.

So be careful! If what you are doing is super sensitive you might be better off using an on-screen keyboard.

Source: The Register

Posted in: Hardware Hacking, Password Cracking

Latest Posts:

SecLists - Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
DeepSound - Audio Steganography Tool DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files.
2019 High Severity Vulnerabilities What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization?
GoBuster - Directory/File & DNS Busting Tool in Go GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool.
BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.

8 Responses to Swiss Researchers Sniff Password from Wired Keyboard

  1. Degis October 22, 2008 at 11:35 am #

    Would not an “on-screen keyboard” be vulnerable from an Van Eck eavesdropper instead. But if the typing is showing up on screen, you’re always vulnerable to Van Eck I guess…

  2. navin October 22, 2008 at 1:49 pm #

    OMG…this is James Bondishly cool!!

    By the way, I don’t agree with Degis…Van Eck phreaking is almost nil coz of the fact tht most companies use methods to encode videos such tht its not disturbing the image on the screen, but is harder to reverse engineer the electro mag radiations into images!!

  3. CBRP1R8 October 22, 2008 at 2:04 pm #

    This is standard Tempest Security and has been known about and well documented since WW2. Electronics emenate a field, this can be monitored, period. From the teletype and mod28’s up to the 70’s to the mod 40’s in the 70-80’s and then the replacement of PC’s in the 90’s. Not really anything new, but now they concentrate on making the building tempest proof instead of the equipment, its much more effecient to have a SES or faraday cage or clean room whatever you want to call it then it is to try to proof all the equipment.

  4. Morgan Storey October 24, 2008 at 4:37 am #

    @CBRP1R8: Exactly, special film on the glass, absorbing metal in the walls, and you are done. Bad luck if you have a mobile etc though.
    One of the guys at work worked on a job a few years ago where they successfully captured data travelling over cat5 from about 20ft away and through the side of a building, that is pretty scary, but like you said if it really is needed faraday cage the whole building and be done with it.

  5. Pantagruel October 25, 2008 at 10:05 am #

    Eventhought the technique of data capturing through EM monitoring is indeed quite old school, it’s still a good story.

    Guess it’s time to swap the tin-foil hat for a Copper-foil version ;)
    and for those fond of home improvement, have a look at:,39024663,39121501,00.htm

    Wonder what designs they offer :)

  6. goodpeople October 27, 2008 at 9:17 am #

    Fun to read. More fun to eplore, but hardly a threat for the majority of people.

  7. Ingo October 29, 2008 at 11:57 am #

    Imagine using this to eavesdrop an ATM, or the alarm keypad in a house…

  8. Morgan Storey October 29, 2008 at 11:02 pm #

    Most of them are secured in someway, ATM’s by there very safe-like construction block a lot of RF, you can pick it up internall or if you are real close. These types of things have been known for a while see Terminator 2 :P
    Alarm Keypads maybe able to be picked up depending again on their design and construction.