Side Channel Attacks through Acoustic Emanations Sharif University of Technology Department of Computer Engineering Side Channel Attacks through Acoustic Emanations Presented by: Amir Mahdi Hosseini Monazzah Mohammad Taghi Teymoori As: Course Seminar of Hardware Security and Trust Ord. 1393

Table of Contents Introduction Preliminaries How FFT helps us! How Neural Network helps us! Keyboard Acoustic Emanations Simulation System Setup and Results Conclusion and Future Work Introduction Preliminaries Keyboard … Simulation … Conc. … 1 Side Channel Attacks through Acoustic Emanations

Electromagnetic Emanations Attacks on the security of computer systems Electromagnetic Emanations Introduction Preliminaries Keyboard … Simulation … Conc. … 2 Side Channel Attacks through Acoustic Emanations

Optical Emanation Attacks on the security of computer systems Introduction Preliminaries Keyboard … Simulation … Conc. … 3 Side Channel Attacks through Acoustic Emanations

Acoustic Emanation Attacks on the security of computer systems Like the mentioned attacks, works on the pattern of (acoustic) signals This attack is inexpensive and non-invasive! Only need a simple microphone. Example attacks already implemented on Dot matrix printers Keyboard Introduction Preliminaries Keyboard … Simulation … Conc. … 4 Side Channel Attacks through Acoustic Emanations

How FFT Helps Us! Fourier analysis converts time (or space) to frequency and vice versa. FFT rapidly computes such transformations Introduction Preliminaries Keyboard … Simulation … Conc. … 5 Side Channel Attacks through Acoustic Emanations

How FFT Helps Us! (Cont.) The raw sound produced by key clicks is not a good input We need to extract relevant features of sound Introduction Preliminaries Keyboard … Simulation … Conc. … 6 Side Channel Attacks through Acoustic Emanations

How Neural Net. Helps Us! Artificial neural network is a computational model capable of pattern recognition. Classifies feature space Data: set of value pairs: (xt, yt), yt=g(xt); Objective: neural network represents the input / output transformation (a function) F Learning: learning means using a set of observations to find F which solves the task in some optimal sense Introduction Preliminaries Keyboard … Simulation … Conc. … 7 Side Channel Attacks through Acoustic Emanations

How Neural Net. Helps Us! (Cont.) Inputs Output w2 w1 w3 wn wn-1 x1 x2 x3 … xn-1 xn y Introduction Preliminaries Keyboard … Simulation … Conc. … 8 Side Channel Attacks through Acoustic Emanations

Attack Properties Based on the hypothesis that the sound of clicks might differ slightly from key to key Although the clicks of different keys sound similar to the human ear The network can be trained on one person and then used to eavesdrop on another person typing on the same keyboard Introduction Preliminaries Keyboard … Simulation … Conc. … 9 Side Channel Attacks through Acoustic Emanations

Attack Properties (Cont.) It is possible to train the network on one keyboard and then use it to attack another keyboard of the same type There is a reduction in the quality of recognition The clicks sound different because the keys are positioned at different positions on the keyboard plate Introduction Preliminaries Keyboard … Simulation … Conc. … 10 Side Channel Attacks through Acoustic Emanations

Signals Structure The click lasts for approximately 100 ms Peak of pushing the key Silence Peak of releasing the key Introduction Preliminaries Keyboard … Simulation … Conc. … 11 Side Channel Attacks through Acoustic Emanations

Flow of Experiment Recording the sound of pressed key Extract the push pick information Calculating the FFT of push pick Importing the information to neural network Train the neural network with various redundant information Test the neural network with random input Success Neural network trained successfully Create more accurate information No Yes Introduction Preliminaries Keyboard … Simulation … Conc. … 12 Side Channel Attacks through Acoustic Emanations

Motivational Example Capturing the voice of pressing ‘h’ key Capturing the voice of pressing ‘z’ key h z Introduction Preliminaries Keyboard … Simulation … Conc. … 13 Side Channel Attacks through Acoustic Emanations

Motivational Example Calculating the FFT of ‘h’ and ‘z’ signals h z Push Peak Silence Release Peak Introduction Preliminaries Keyboard … Simulation … Conc. … 14 Side Channel Attacks through Acoustic Emanations

Motivational Example (Cont.) Constructing the neural network and train it! Error Prob.=8.87e-9 MATLAB Code: … X=[Xz Xh]; T=[0 1]; net = newpr(X, T, 20); net = train(net, X, T); Introduction Preliminaries Keyboard … Simulation … Conc. … 15 Side Channel Attacks through Acoustic Emanations

System Setup Main Paper Java NNS neural network simulator Simple PC microphone for short distances up to 1 meter Parabolic microphone for eavesdropping from a distance IBM keyboard S/N 0953260, P/N 32P5100 Introduction Preliminaries Keyboard … Simulation … Conc. … 16 Side Channel Attacks through Acoustic Emanations

System Setup (Cont.) This Study MATLAB neural network simulator Simple PC microphone for short distances up to 1 meter A4TECH keyboard model KR-85 Introduction Preliminaries Keyboard … Simulation … Conc. … 17 Side Channel Attacks through Acoustic Emanations

Results No Mistake! 18 Alice: 17 20 Constant Force: 13 20 Bob: 15 20 Introduction Preliminaries Keyboard … Simulation … Conc. … Constant Force: 13 20 Variable Force: 17 20 Alice: 17 20 Bob: 15 20 Victor: 18 20 18 Side Channel Attacks through Acoustic Emanations

Summary We explored acoustic emanations of keyboard Like input devices to recognize the content being typed In the paper the attack was also applied to Notebook keyboards Telephone pads ATM pads Introduction Preliminaries Keyboard … Simulation … Conc. … 19 Side Channel Attacks through Acoustic Emanations

Summary (Cont.) A sound-free (non-mechanical) keyboard is an obvious countermeasure for the attack However, it is neither comfortable for users nor cheap! Introduction Preliminaries Keyboard … Simulation … Conc. … 20 Side Channel Attacks through Acoustic Emanations

Future Work Main Idea: Improving the accuracy of the results by using the combination of keyboard acoustic emanations and predictive text algorithms. Introduction Preliminaries Keyboard … Simulation … Conc. … Recording Acoustic Emanation of Keyboard Training Neural Network Activating the Eavesdropping System Processing the Results with Predictive Text Algorithms Generating the Text Result 21 Side Channel Attacks through Acoustic Emanations

Thanks for your attention 22 Side Channel Attacks through Acoustic Emanations

References Asonov, Dmitri, and Rakesh Agrawal. "Keyboard acoustic emanations." In IEEE Symposium on Security and Privacy, vol. 2004, pp. 3-11. 2004. Backes, Michael, Markus Dürmuth, Sebastian Gerling, Manfred Pinkal, and Caroline Sporleder. "Acoustic Side-Channel Attacks on Printers." In USENIX Security Symposium, pp. 307-322. 2010. Kuhn, Markus G. "Optical time-domain eavesdropping risks of CRT displays." In Security and Privacy, 2002. Proceedings. 2002 IEEE Symposium on, pp. 3-18. IEEE, 2002. Vuagnoux, Martin, and Sylvain Pasini. "Compromising Electromagnetic Emanations of Wired and Wireless Keyboards." In USENIX Security Symposium, pp. 1-16. 2009. Introduction Preliminaries Keyboard … Simulation … Conc. … 23 Side Channel Attacks through Acoustic Emanations