Swiss Researchers Sniff Password from Wired Keyboard

Now this is an interesting twist on an oldschool method of hacking, the monitoring of electromagnetic radiation.

You’d think it’d be easier to sniff the traffic from a wireless keyboard, but generally it’s not as they tend to be encrypted. Where as the electromagnetic radiation given off by a wired keyboard is not shielded or protected it any way.

All you need to do is have the equipment and the know-how to decipher it.

Swiss researchers have demonstrated a variety of ways to eavesdrop on the sensitive messages computer users type by monitoring their wired keyboards. At least 11 models using a wide range of connection types are vulnerable.

The researchers from the Security and Cryptography Laboratory at Ecole Polytechnique Federale de Lausanne are able to capture keystrokes by monitoring the electromagnetic radiation of PS/2, universal serial bus, or laptop keyboards. They’ve outline four separate attack methods, some that work at a distance of as much as 65 feet from the target.

In one video demonstration, researchers Martin Vuagnoux and Sylvain Pasini sniff out the the keystrokes typed into a standard keyboard using a large antenna that’s about 20 to 30 feet away in an adjacent room.

It appears to work on both the older PS/2 keyboards and new USB keyboards and even laptop keyboard from a distance of up to 65 feet! That’s easily far enough to jack the data from a carpark, adjacent office or nearby hotel room.

I’d imagine the equipment required is quite bulky though.

“We conclude that wired computer keyboards sold in the stores generate compromising emanations (mainly because of the cost pressures in the design),” they write here. “Hence they are not safe to transmit sensitive information.”

No doubt, electromagnetic eavesdropping dates back to the mid 1980s, if not earlier. But Vuagnoux says many of today’s keyboards have been adapted to prevent those attacks from working. The research shows that even these keyboards are vulnerable to electromagnetic sniffing.

The video demonstrations show a computer that reads input from antennas that monitor a specified frequency. In both cases, the computer was able to determine the keystrokes typed on keyboards connected to a laptop and power supply and LCD monitors were disconnected to prevent potential power transmissions or wireless communications. Vuagnous said in an email that the attacks would still work even if the power supplies and monitors were plugged in.

It seems the modifications made to keyboards to prevent this kind of sniffing has either been removed to save cost or was never tested properly in the first place.

So be careful! If what you are doing is super sensitive you might be better off using an on-screen keyboard.

Source: The Register

Posted in: Hardware Hacking, Password Cracking

Latest Posts:

dSploit APK Download - Hacking & Security Toolkit For Android dSploit APK Download – Hacking & Security Toolkit For Android
dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities.
Scallion - GPU Based Onion Hash Generator Scallion – GPU Based Onion Hash Generator
Scallion is a GPU-driven Onion Hash Generator written in C#, it lets you create vanity GPG keys and .onion addresses (for Tor's hidden services).
WiFi-Dumper - Dump WiFi Profiles and Cleartext Passwords WiFi-Dumper – Dump WiFi Profiles and Cleartext Passwords
WiFi-Dumper is an open-source Python-based tool to dump WiFi profiles and cleartext passwords of the connected access points on a Windows machine.
truffleHog - Search Git for High Entropy Strings with Commit History truffleHog – Search Git for High Entropy Strings with Commit History
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
AIEngine - AI-driven Network Intrusion Detection System AIEngine – AI-driven Network Intrusion Detection System
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with many capabilities.
Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.

8 Responses to Swiss Researchers Sniff Password from Wired Keyboard

  1. Degis October 22, 2008 at 11:35 am #

    Would not an “on-screen keyboard” be vulnerable from an Van Eck eavesdropper instead. But if the typing is showing up on screen, you’re always vulnerable to Van Eck I guess…

  2. navin October 22, 2008 at 1:49 pm #

    OMG…this is James Bondishly cool!!

    By the way, I don’t agree with Degis…Van Eck phreaking is almost nil coz of the fact tht most companies use methods to encode videos such tht its not disturbing the image on the screen, but is harder to reverse engineer the electro mag radiations into images!!

  3. CBRP1R8 October 22, 2008 at 2:04 pm #

    This is standard Tempest Security and has been known about and well documented since WW2. Electronics emenate a field, this can be monitored, period. From the teletype and mod28’s up to the 70’s to the mod 40’s in the 70-80’s and then the replacement of PC’s in the 90’s. Not really anything new, but now they concentrate on making the building tempest proof instead of the equipment, its much more effecient to have a SES or faraday cage or clean room whatever you want to call it then it is to try to proof all the equipment.

  4. Morgan Storey October 24, 2008 at 4:37 am #

    @CBRP1R8: Exactly, special film on the glass, absorbing metal in the walls, and you are done. Bad luck if you have a mobile etc though.
    One of the guys at work worked on a job a few years ago where they successfully captured data travelling over cat5 from about 20ft away and through the side of a building, that is pretty scary, but like you said if it really is needed faraday cage the whole building and be done with it.

  5. Pantagruel October 25, 2008 at 10:05 am #

    Eventhought the technique of data capturing through EM monitoring is indeed quite old school, it’s still a good story.

    Guess it’s time to swap the tin-foil hat for a Copper-foil version ;)
    and for those fond of home improvement, have a look at:,39024663,39121501,00.htm

    Wonder what designs they offer :)

  6. goodpeople October 27, 2008 at 9:17 am #

    Fun to read. More fun to eplore, but hardly a threat for the majority of people.

  7. Ingo October 29, 2008 at 11:57 am #

    Imagine using this to eavesdrop an ATM, or the alarm keypad in a house…

  8. Morgan Storey October 29, 2008 at 11:02 pm #

    Most of them are secured in someway, ATM’s by there very safe-like construction block a lot of RF, you can pick it up internall or if you are real close. These types of things have been known for a while see Terminator 2 :P
    Alarm Keypads maybe able to be picked up depending again on their design and construction.