Swiss Researchers Sniff Password from Wired Keyboard

Now this is an interesting twist on an oldschool method of hacking, the monitoring of electromagnetic radiation.

You’d think it’d be easier to sniff the traffic from a wireless keyboard, but generally it’s not as they tend to be encrypted. Where as the electromagnetic radiation given off by a wired keyboard is not shielded or protected it any way.

All you need to do is have the equipment and the know-how to decipher it.

Swiss researchers have demonstrated a variety of ways to eavesdrop on the sensitive messages computer users type by monitoring their wired keyboards. At least 11 models using a wide range of connection types are vulnerable.

The researchers from the Security and Cryptography Laboratory at Ecole Polytechnique Federale de Lausanne are able to capture keystrokes by monitoring the electromagnetic radiation of PS/2, universal serial bus, or laptop keyboards. They’ve outline four separate attack methods, some that work at a distance of as much as 65 feet from the target.

In one video demonstration, researchers Martin Vuagnoux and Sylvain Pasini sniff out the the keystrokes typed into a standard keyboard using a large antenna that’s about 20 to 30 feet away in an adjacent room.

It appears to work on both the older PS/2 keyboards and new USB keyboards and even laptop keyboard from a distance of up to 65 feet! That’s easily far enough to jack the data from a carpark, adjacent office or nearby hotel room.

I’d imagine the equipment required is quite bulky though.

“We conclude that wired computer keyboards sold in the stores generate compromising emanations (mainly because of the cost pressures in the design),” they write here. “Hence they are not safe to transmit sensitive information.”

No doubt, electromagnetic eavesdropping dates back to the mid 1980s, if not earlier. But Vuagnoux says many of today’s keyboards have been adapted to prevent those attacks from working. The research shows that even these keyboards are vulnerable to electromagnetic sniffing.

The video demonstrations show a computer that reads input from antennas that monitor a specified frequency. In both cases, the computer was able to determine the keystrokes typed on keyboards connected to a laptop and power supply and LCD monitors were disconnected to prevent potential power transmissions or wireless communications. Vuagnous said in an email that the attacks would still work even if the power supplies and monitors were plugged in.

It seems the modifications made to keyboards to prevent this kind of sniffing has either been removed to save cost or was never tested properly in the first place.

So be careful! If what you are doing is super sensitive you might be better off using an on-screen keyboard.

Source: The Register

Posted in: Hardware Hacking, Password Cracking Tools

Latest Posts:

Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.
Second Order - Subdomain Takeover Scanner Tool Second Order – Subdomain Takeover Scanner Tool
Second Order Subdomain Takeover Scanner Tool scans web apps for second-order subdomain takeover by crawling the application and collecting URLs (and other data)
Binwalk - Firmware Security Analysis & Extraction Tool Binwalk – Firmware Security Analysis & Extraction Tool
Binwalk is a fast and easy to use Python-based firmware security analysis tool that allows for firmware analysis, reverse engineering & extracting of firmware.
zBang - Privileged Account Threat Detection Tool zBang – Privileged Account Threat Detection Tool
zBang is a risk assessment tool for Privileged Account Threat Detection on a scanned network, organizations & red teams can use it to identify attack vectors
Memhunter - Automated Memory Resident Malware Detection Memhunter – Automated Memory Resident Malware Detection
Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving threat hunter analysis process.

8 Responses to Swiss Researchers Sniff Password from Wired Keyboard

  1. Degis October 22, 2008 at 11:35 am #

    Would not an “on-screen keyboard” be vulnerable from an Van Eck eavesdropper instead. But if the typing is showing up on screen, you’re always vulnerable to Van Eck I guess…

  2. navin October 22, 2008 at 1:49 pm #

    OMG…this is James Bondishly cool!!

    By the way, I don’t agree with Degis…Van Eck phreaking is almost nil coz of the fact tht most companies use methods to encode videos such tht its not disturbing the image on the screen, but is harder to reverse engineer the electro mag radiations into images!!

  3. CBRP1R8 October 22, 2008 at 2:04 pm #

    This is standard Tempest Security and has been known about and well documented since WW2. Electronics emenate a field, this can be monitored, period. From the teletype and mod28’s up to the 70’s to the mod 40’s in the 70-80’s and then the replacement of PC’s in the 90’s. Not really anything new, but now they concentrate on making the building tempest proof instead of the equipment, its much more effecient to have a SES or faraday cage or clean room whatever you want to call it then it is to try to proof all the equipment.

  4. Morgan Storey October 24, 2008 at 4:37 am #

    @CBRP1R8: Exactly, special film on the glass, absorbing metal in the walls, and you are done. Bad luck if you have a mobile etc though.
    One of the guys at work worked on a job a few years ago where they successfully captured data travelling over cat5 from about 20ft away and through the side of a building, that is pretty scary, but like you said if it really is needed faraday cage the whole building and be done with it.

  5. Pantagruel October 25, 2008 at 10:05 am #

    Eventhought the technique of data capturing through EM monitoring is indeed quite old school, it’s still a good story.

    Guess it’s time to swap the tin-foil hat for a Copper-foil version ;)
    and for those fond of home improvement, have a look at:,39024663,39121501,00.htm

    Wonder what designs they offer :)

  6. goodpeople October 27, 2008 at 9:17 am #

    Fun to read. More fun to eplore, but hardly a threat for the majority of people.

  7. Ingo October 29, 2008 at 11:57 am #

    Imagine using this to eavesdrop an ATM, or the alarm keypad in a house…

  8. Morgan Storey October 29, 2008 at 11:02 pm #

    Most of them are secured in someway, ATM’s by there very safe-like construction block a lot of RF, you can pick it up internall or if you are real close. These types of things have been known for a while see Terminator 2 :P
    Alarm Keypads maybe able to be picked up depending again on their design and construction.