Comment on Boffins convert typing sounds into text with 95% accuracy
Pons_Aelius@kbin.social 9 months agoBecause of different placement on the keyboard and different finger pressure, each key press has a slightly different sound.
The telling thing in this story is this
with 95 percent accuracy in some cases.
For some people (those with a very consistent typing style on a known keyboard) they were right 95% of the time.
In the real world this type of thing is basically useless as you would need a decent sample of the person typing on a known keyboard for it to work.
To go from keystroke sounds to actual letters, the eggheads recorded a person typing on a 16-inch 2021 MacBook Pro using a phone placed 17cm away and processed the sounds to get signatures of the keystrokes.
So to do this you need to have physical access to the person (to place a microphone nearby) and know what type of device they are typing on and for it to be a device that you have already analysed the sound profile of.
You don’t need physical access, just some malware that has access to the microphone
We would hope researchers “discovering” this wouldn’t have a production ready product as their proof of concept. So there is room from improvement but military contractors would love to invest in this
You don’t need physical access, just some malware
Which you still need to have previously installed...
If the person has allowed malware to be installed just install a keylogger (which gives you 100% accuracy every time) rather than jump through more hoops with this.
Different devices
I would have an easier time infecting someone‘s personal phone than a company machine
You would, would you?
Well, I must be talking to a leet hacker then.
Ok, install malware on my phone.
So basically if they know what type of hardware you’re using, and have training on that type of hardware, then it works. It can’t just be literally any keyboard, right?
That makes more sense.
agent_flounder@lemmy.world 9 months ago
The article says
Hm. Sounds like “some cases” are hunt and peck typists or very slow touch typists.
I don’t know if training for each victim’s typing is really needed. I get the impression they were identifying unique sounds and converting that to the correct letters. I only skimmed and I didn’t quite understand the description of the mechanisms. Something about deep learning and convolution or…? I think they also said they didn’t use a language model so I could be wrong.
Pons_Aelius@kbin.social 9 months ago
The problems is that even with up to 95% accuracy that still means the with a password length of 10 there is a 50/50 chance that one character is wrong.
A password with one character wrong is just as useless as randomly typing.
This is an interesting academic exercise but there are much better and easier ways to gain access to passwords and systems.
The world is not a bond movie.
Deploying social engineering is much easier than this sort of attack.
warrenson@lemmy.nz 9 months ago
“Hearing” the same password twice drastically increases the accuracy, however, social engineering is indeed the most effective and efficient attack method.
0xD@infosec.pub 9 months ago
If the password is not random, as they seldomly are, you can just guess the last, or even the last few characters of they are not correct.
prole@sh.itjust.works 9 months ago
Have you never seen a Bond movie? Yeah they always have a gadget or two, but the rest is basically him social engineering his way through the film.
agent_flounder@lemmy.world 9 months ago
I was thinking of this attack in terms of grabbing emails, documents, stuff like that. Or snippets thereof.
prole@sh.itjust.works 9 months ago
I imagine it probably also uses an algorithm to attempt to “guess” the next letter (or the full word itself, like your phone keyboard does) based on existing words. Then maybe an LLM can determine which of the potential words are the most likely being typed based on the context.
I dunno if that makes any sense, but that’s how I pictured it working in my brain movies.