Comment by TechBro8615
2 years ago
Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...
2 years ago
Finally, a real security weakness to cite when making fun of people for their mechanical keyboard. Time to start recording the audio of Zoom calls with some particularly loud typers...
I used to work in an office space with an independent contractor whose schtick was that he was a genius. The affectations around his genius-ness included casually bringing up Mensa meetings, dropping magazines like Foreign Affairs and academic journals around the office, and his fucking keyboard.
The keyboard had custom switches that were very loud. And he typed fast - it was like living on a gun range. Everyone in the office probably would have chipped in for a hitman, but alas, the CTO, whose office had a solid door, was “inspired” that the mechanical feedback helped fuel inspiration in boy wonder.
Had we thought of the security risks of the keyboard, I would have brought good scotch to the infosec dude while expressing my concerns.
Somewhat tangential: clicky switches, like Cherry Blues, tend to click twice for each stroke. I think this leads to people assuming there are twice as many strokes going on. Tactile switches tend to only click once (when they bottom out). So, fancy keyboards can make people sound faster than they are.
I don't think that's quite right. Many switches including tactiles will make a sound when the switch tops out, from the stem hitting the housing.
As far as I know, Cherry blues only click once and the second sound you hear on a keypress is just the topping out sound.
https://cdn-blog.adafruit.com/uploads/2016/09/Blue.gif
1 reply →
Add a guy that bottoms out the keys and you will have an additional "click".
> it was like living on a gun range
Thanks for this metaphor. I know off at least one guy, to which this metaphor could be applied as well.
Not inspired enough to hire him properly apparently...
Mechanical keyboard user here. Most of us use mechanical keyboards because they're a lot more fun to type on. That's it. Because if you're not having fun, what's the point?
I don't know, typing?
Else, something like Mai Tais on the beach sounds more fun, maybe it's just me...
but mai tais on beach don't get you money, and if you are going to type on something, its better to make sure its comfortable for you.
8 replies →
Mai tais on the beach don't let you signal what a cool hacker you are. When the point of a thing is signaling, normal arguments don't apply.
Not according to the article.. Microphones are sensitive enough to mount the attack on quieter keyboards.
Microphones are surprisingly sensitive. I can listen to music in my closed-back headset at a regular volume. My desk mic can pick this up. Without boosting the audio it's barely audible that there's music, but after adding some gain you get almost the full song profile (and background noise).
I can even pick out some of my breathing from the recording.
If I turn on noise suppression and noise gate it's fine.
I was two rooms away from someone playing music on a smart Google device. I could very barely hear that music was playing at all and only just barely made out it was a song I had been interested in but kept missing. I pulled out my S22+ and used Shazam. somehow it was able to pick it up easily.
What we clearly need are louder keyboards - which overload the mic so as to render keystrokes indistinguishable.
Adding a gain knob to my keyboard, be right back.
5 replies →
I've wanted to integrate a cap gun into a keyboard, basically a an old fashioned roll of paper caps and solenoid to whack 'em, triggered by exclamation points.
Some old IBM keyboards (beamsprings, the predecessor to the Model F, which preceded the Model M) had solenoids inside to make them louder and sound more like typewriters. I wonder if such a setup would defeat this attack, or if it would still be possible to discern the actual keypress alongside the solenoid.
4 replies →
Or auto-mute upon key press.
2 replies →
I'll just have to add significantly more background clickity clacks as obfuscation.
My thought was to run psyops all the time.
"Just need to type in my password." He says a little too loudly to nobody. Then just type in the honeypot password and login with the real one that you entered with a virtual keyboard a few minutes ago.
Meanwhile you've got a prerecorded keyboard going concurrently that decodes to "I know what you're trying to do. Clever but not clever enough."
And I guess you might as well have a special keyboard that you only use for typing in passwords while you're at it.
It’s so fascinating to watch this play out live. Once again, an ambitious kid can implement software hacks that are very funny when used for a joke, but also have massive real-world implications.
I fear that "in the name of security" is going to ruin everything.
Good luck with my mech steno keyboard.