(sp)iPhone: decoding vibrations from nearby keyboards using mobile phone accelerometers

Authors:
Philip Marquardt;Arunabh Verma;Henry Carter;Patrick Traynor
Affiliations:
MIT Lincoln Laboratory, Lexington, MA, USA;Georgia Institute of Technology, Atlanta, GA, USA;Georgia Institute of Technology, Atlanta, GA, USA;Georgia Institute of Technology, Atlanta, GA, USA
Venue:
Proceedings of the 18th ACM conference on Computer and communications security
Year:
2011

Citing 17
Cited 15

Electromagnetic radiation from video display units: an eavesdropping risk?

Computers and Security
The threat of information theft by reception of electromagnetic radiation from RS-232 cables

Computers and Security
The scientist and engineer's guide to digital signal processing

The scientist and engineer's guide to digital signal processing
ElectroMagnetic Analysis (EMA): Measures and Counter-Measures for Smart Cards

E-SMART '01 Proceedings of the International Conference on Research in Smart Cards: Smart Card Programming and Security
The EM Side-Channel(s)

CHES '02 Revised Papers from the 4th International Workshop on Cryptographic Hardware and Embedded Systems
Optical Time-Domain Eavesdropping Risks of CRT Displays

SP '02 Proceedings of the 2002 IEEE Symposium on Security and Privacy
Mobile Phones as Computing Devices: The Viruses are Coming!

IEEE Pervasive Computing
Keyboard acoustic emanations revisited

Proceedings of the 12th ACM conference on Computer and communications security
Dictionary attacks using keyboard acoustic emanations

Proceedings of the 13th ACM conference on Computer and communications security
Compromising Reflections-or-How to Read LCD Monitors around the Corner

SP '08 Proceedings of the 2008 IEEE Symposium on Security and Privacy
Defending against sensor-sniffing attacks on mobile phones

Proceedings of the 1st ACM workshop on Networking, systems, and applications for mobile handhelds
Tempest in a Teapot: Compromising Reflections Revisited

SP '09 Proceedings of the 2009 30th IEEE Symposium on Security and Privacy
On lightweight mobile phone application certification

Proceedings of the 16th ACM conference on Computer and communications security
Compromising electromagnetic emanations of wired and wireless keyboards

SSYM'09 Proceedings of the 18th conference on USENIX security symposium
A methodology for empirical analysis of permission-based security models and its application to android

Proceedings of the 17th ACM conference on Computer and communications security
TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones

OSDI'10 Proceedings of the 9th USENIX conference on Operating systems design and implementation
Acoustic side-channel attacks on printers

USENIX Security'10 Proceedings of the 19th USENIX conference on Security

Don't Bump, Shake on It: the exploitation of a popular accelerometer-based smart phone exchange and its secure replacement

Proceedings of the 27th Annual Computer Security Applications Conference
ACCessory: password inference using accelerometers on smartphones

Proceedings of the Twelfth Workshop on Mobile Computing Systems & Applications
TapLogger: inferring user inputs on smartphone touchscreens using on-board motion sensors

Proceedings of the fifth ACM conference on Security and Privacy in Wireless and Mobile Networks
Bzzzt: when mobile phones feel at home

CHI '12 Extended Abstracts on Human Factors in Computing Systems
Tapprints: your finger taps have fingerprints

Proceedings of the 10th international conference on Mobile systems, applications, and services
Who wears me? bioimpedance as a passive biometric

HealthSec'12 Proceedings of the 3rd USENIX conference on Health Security and Privacy
Fingerprint attack against touch-enabled devices

Proceedings of the second ACM workshop on Security and privacy in smartphones and mobile devices
WYSWYE: shoulder surfing defense for recognition based graphical passwords

Proceedings of the 24th Australian Computer-Human Interaction Conference
Practicality of accelerometer side channels on smartphones

Proceedings of the 28th Annual Computer Security Applications Conference
MAST: triage for market-scale mobile malware analysis

Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks
Tap-Wave-Rub: lightweight malware prevention for smartphones using intuitive human gestures

Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks
Mobile security and privacy: the quest for the mighty access control

Proceedings of the 18th ACM symposium on Access control models and technologies
Sensing-enabled channels for hard-to-detect command and control of mobile devices

Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security
PIN skimmer: inferring PINs through the camera and microphone

Proceedings of the Third ACM workshop on Security and privacy in smartphones & mobile devices
ipShield: a framework for enforcing context-aware privacy

NSDI'14 Proceedings of the 11th USENIX Conference on Networked Systems Design and Implementation

Quantified Score

Hi-index	0.00

Visualization

Abstract

Mobile phones are increasingly equipped with a range of highly responsive sensors. From cameras and GPS receivers to three-axis accelerometers, applications running on these devices are able to experience rich interactions with their environment. Unfortunately, some applications may be able to use such sensors to monitor their surroundings in unintended ways. In this paper, we demonstrate that an application with access to accelerometer readings on a modern mobile phone can use such information to recover text entered on a nearby keyboard. Note that unlike previous emanation recovery papers, the accelerometers on such devices sample at near the Nyquist rate, making previous techniques unworkable. Our application instead detects and decodes keystrokes by measuring the relative physical position and distance between each vibration. We then match abstracted words against candidate dictionaries and record word recovery rates as high as 80%. In so doing, we demonstrate the potential to recover significant information from the vicinity of a mobile device without gaining access to resources generally considered to be the most likely sources of leakage (e.g., microphone, camera).