A team of researchers from Georgia Tech’s School of Computer Science has announced that they’ve found a way to capture keyboard information through the accelerometer of a nearby iPhone. According to their findings, the technique was accurate 80% of the time. This isn’t the first time an iPhone’s accelerometer has been used to capture keystrokes, but it is the first time a keyboard has been captured through a neighboring phone.
Instead of directly monitoring keystrokes, like a keylogger installed on a target’s computer, this method senses the vibrations of each keystroke via the iPhone’s accelerometer. To accurately discern what is being typed, the software compares pairs of keystrokes. It sorts these based on which side of the keyboard the stroke occurred, and how close the keyboard stokes were to each other. This might not seem useful, but when the software compares this data against a dictionary, the program is able to glean the typed words with alarming accuracy.
Innovations Report provides this illustrative example of how the software interprets keystrokes.
[...] take the word “canoe,” which when typed breaks down into four keystroke pairs: “C-A, A-N, N-O and O-E.” Those pairs then translate into the detection system’s code as follows: Left-Left-Near, Left-Right-Far, Right-Right-Far and Right-Left-Far, or LLN-LRF-RRF-RLF. This code is then compared to the preloaded dictionary and yields “canoe” as the statistically probable typed word. Working with dictionaries comprising about 58,000 words, the system reached word-recovery rates as high as 80 percent.
Previous research showed that similar observations could be made using a phone’s built-in microphone. However, the accelerometer vibrates far fewer times per second, meaning that the information is more useful in discerning keystrokes. While purely theoretical, the researchers point out that there are few security restrictions on the use of accelerometers, unlike microphones which often require a user’s permission for use.
Of course, there are some serious limitations to using accelerometers for surveillance purposes. Firstly, because the technique uses pairs of keystrokes, it can only decode words three letters or longer. Second, the phone must be within three inches of the target keyboard. Too far away, and the accelerometers cannot acquire useful data. However, the researchers believe that simply asking for a user’s permission before acquiring sensitive accelerometer data — like that needed for the finer control of a game — would be be better.
(Innovations Report, via Wired, image via Jeff Kraus)
