The realm of Zoom calls, once perceived as relatively benign, has been rattled by a startling revelation. British researchers have unveiled a vulnerability that enables nearby hackers to intercept and identify keystrokes during Zoom sessions, as reported in Science X Network.
Acoustic Side-Channel Attacks
This attack technique adds to the arsenal of data exploitation methods rooted in the physical properties of targeted devices. Side-channel attacks, an avenue through which this intrusion occurs, can tap into keystrokes originating from keyboards, ATMs, or smartphones.
They're also capable of detecting vibrations emitted by diverse computer components, each having its distinctive acoustic signature.
This method of intrusion extends to encompass the capability of capturing electromagnetic signals emitted by screens or detecting vibrations emanating from a simple lightbulb situated near a digital device. Subsequently, this information can be intercepted, subjected to analysis, and potentially deciphered, thereby exposing sensitive data.
The research undertaken by Joshua Harrison, Ehsan Toreini, and Marhyam Mehrnezhad sounds alert as it emphasizes the interplay between state-of-the-art audio-video technologies and machine learning. This amalgamation, they contend, intensifies the risk directed at keyboards.
Utilizing a MacBook Pro and an iPhone, the team hailing from Durham University embarked on a study centered around recording the auditory patterns of keyboard typing.
These recorded sounds were then subjected to an algorithmic procedure that demonstrated an elevated accuracy in distinguishing individual keystrokes.
The iPhone-recorded sounds achieved a striking 95% degree of precision, while those captured during Zoom conferences demonstrated an accuracy of 93%.
The researchers voiced their concerns about the ease with which they could decode conversations, underlining the need for heightened security measures.
In a paper expounding their findings, the researchers said, "Our results prove the practicality of these side channel attacks via off-the-shelf equipment and algorithms. The ubiquity of keyboard acoustic emanations makes them not only a readily available attack vector but also prompts victims to underestimate [and therefore not try to hide] their output."
The significance of the study lies in shedding light on a relatively overlooked aspect of digital security. While people are inclined to shield their screens when entering passwords or sensitive data, they often neglect to consider the sounds their keystrokes emit.
The researchers caution that with today's microphones and portable recording devices becoming increasingly sensitive and accessible, the susceptibility to interception is even more pronounced.
The research team, however, noted that several of the decryption errors were attributed to misidentifying the acoustics of keys adjacent to the intended ones. This concern could potentially be alleviated through the integration of machine learning algorithms.
How to Counteract These Attacks
To counteract these acoustic side-channel attacks, the researchers have outlined several protective measures:
1. Alter typing techniques, adopting touch-typing methods that engage all fingers and increase acoustic variance. Introduce false keystrokes randomly, disrupting the algorithms' ability to predict actual input.
2. Opt for random passwords with mixed case changes, exploiting the relative lack of detection for the shift key's release peak.
3. Leverage biometric login features, such as facial or fingerprint recognition.
The findings of the research team were published in arXiv.
Related Article : Intel Processors Now Subject to Side-Channel Attacks; Attackers Can Steal Data from CPU
