Sharif University of Technology

Department of Computer Engineering

Side Channel Attacks through Acoustic Emanations

Presented by:

Amir Mahdi Hosseini Monazzah

Mohammad Taghi Teymoori

As:

Course Seminar of Hardware Security and Trust

Ord. 1393

Table of Contents

IntroductionPreliminaries

How FFT helps us!How Neural Network helps us!

Keyboard Acoustic EmanationsSimulation System Setup and ResultsConclusion and Future Work

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

1 Side Channel Attacks through Acoustic Emanations

Electromagnetic Emanations

Attacks on the security of computer systemsElectromagnetic Emanations

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

2 Side Channel Attacks through Acoustic Emanations

Optical Emanation

Attacks on the security of computer systemsOptical Emanation

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

3 Side Channel Attacks through Acoustic Emanations

Acoustic Emanation

Attacks on the security of computer systemsAcoustic Emanation

Like the mentioned attacks, works on the pattern of (acoustic) signals

This attack is inexpensive and non-invasive!Only need a simple microphone.

Example attacks already implemented onDot matrix printersKeyboard

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

4 Side Channel Attacks through Acoustic Emanations

How FFT Helps Us!

Fourier analysis converts time (or space) to frequency and vice versa.

FFT rapidly computes such transformations

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

5 Side Channel Attacks through Acoustic Emanations

How FFT Helps Us! (Cont.)

The raw sound produced by key clicks is not a good input

We need to extract relevant features of sound

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

6 Side Channel Attacks through Acoustic Emanations

How Neural Net. Helps Us!

Artificial neural network is a computational model capable of pattern recognition.

Classifies feature space

Data: set of value pairs: (xt, yt), yt=g(xt);

Objective: neural network represents the input / output transformation (a function) F

Learning: learning means using a set of observations to find F which solves the task in some optimal sense

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

7 Side Channel Attacks through Acoustic Emanations

How Neural Net. Helps Us! (Cont.)

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

8 Side Channel Attacks through Acoustic Emanations

.

Inputs

Outputw2

w1

w3

wn

wn-1.

x1

x2

x3

…

xn-1

xn

y)(;

1

zHyxwzn

iii

.

Attack Properties

Based on the hypothesis that the sound of clicks might differ slightly from key to keyAlthough the clicks of different keys sound similar

to the human ear

The network can be trained on one person and then used to eavesdrop on another person typing on the same keyboard

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

9 Side Channel Attacks through Acoustic Emanations

Attack Properties (Cont.)

It is possible to train the network on one keyboard and then use it to attack another keyboard of the same typeThere is a reduction in the quality of recognition

The clicks sound different because the keys are positioned at different positions on the keyboard plate

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

10 Side Channel Attacks through Acoustic Emanations

Signals Structure

The click lasts for approximately 100 msPeak of pushing the keySilencePeak of releasing the key

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

11 Side Channel Attacks through Acoustic Emanations

Flow of Experiment

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

12 Side Channel Attacks through Acoustic Emanations

Recording the sound of pressed key

Extract the push pick information

Calculating the FFT of push pick

Importing the information to neural network

Train the neural network with various redundant information

Test the neural network with random input

Success

Neural network trained

successfully

Create more accurate

information

No Yes

Motivational Example

Capturing the voice of pressing ‘h’ keyCapturing the voice of pressing ‘z’ key

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

13 Side Channel Attacks through Acoustic Emanations

h

z

Motivational Example

Calculating the FFT of ‘h’ and ‘z’ signals

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

14 Side Channel Attacks through Acoustic Emanations

h z

Push Peak

Silence

Release Peak

Motivational Example (Cont.)

Constructing the neural network and train it!

Error Prob.=8.87e-9

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

15 Side Channel Attacks through Acoustic Emanations

MATLAB Code:…X=[Xz Xh];T=[0 1];net = newpr(X, T, 20);net = train(net, X, T);…

System Setup

Main PaperJava NNS neural network simulatorSimple PC microphone for short distances

up to 1 meter

Parabolic microphone for eavesdropping from a distance

IBM keyboard S/N 0953260, P/N 32P5100

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

16 Side Channel Attacks through Acoustic Emanations

System Setup (Cont.)

This StudyMATLAB neural network simulatorSimple PC microphone for short distances

up to 1 meter

A4TECH keyboard model KR-85

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

17 Side Channel Attacks through Acoustic Emanations

Results

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

18 Side Channel Attacks through Acoustic Emanations

No Mistake

!

Constant Force :Variable Force :

Alice :Bob :

Victor :

Summary

We explored acoustic emanations of keyboardLike input devices to recognize the content being

typed

In the paper the attack was also applied toNotebook keyboardsTelephone padsATM pads

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

19 Side Channel Attacks through Acoustic Emanations

Summary (Cont.)

A sound-free (non-mechanical) keyboard is an obvious countermeasure for the attackHowever, it is neither comfortable for users nor

cheap!

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

20 Side Channel Attacks through Acoustic Emanations

Future Work

Main Idea:Improving the accuracy of the results by using the

combination of keyboard acoustic emanations and predictive text algorithms.

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

21 Side Channel Attacks through Acoustic Emanations

Recording Acoustic

Emanation of Keyboard

Training Neural

Network

Activating the Eavesdropping

System

Processing the Results with

Predictive Text Algorithms

Generating the Text Result

22 Side Channel Attacks through Acoustic Emanations

Thanks for your attention

References

1. Asonov, Dmitri, and Rakesh Agrawal. "Keyboard acoustic emanations." In IEEE Symposium on Security and Privacy, vol. 2004, pp. 3-11. 2004.

2. Backes, Michael, Markus Dürmuth, Sebastian Gerling, Manfred Pinkal, and Caroline Sporleder. "Acoustic Side-Channel Attacks on Printers." In USENIX Security Symposium, pp. 307-322. 2010.

3. Kuhn, Markus G. "Optical time-domain eavesdropping risks of CRT displays." In Security and Privacy, 2002. Proceedings. 2002 IEEE Symposium on, pp. 3-18. IEEE, 2002.

4. Vuagnoux, Martin, and Sylvain Pasini. "Compromising Electromagnetic Emanations of Wired and Wireless Keyboards." In USENIX Security Symposium, pp. 1-16. 2009.

Introd

uction

Prelim

inaries

Keyb

oard…

S

imu

lation…

C

onc

… .

23 Side Channel Attacks through Acoustic Emanations