Open thread for December 17-23, 2013

Paul Crowley

If it's worth saying, but not worth its own post (even in Discussion), then it goes here.

Eh... if an attacker has the level of physical access to the CPU that's required to plant a microphone, you have worse problems than acoustic attacks.

In the example the used a mobile phone. Going from having owned a microphone to being able to know a key on a computer is a significant step.

Additionally there are other way to get audio access. Heating pipes conduct sound waves if the attacker has a good microphone.

Glass of windows vibrates in a way that can be detected from a distance.

14Pentashagon12y

For personal devices the attacker may have access to the microphone inside the device via flash/java/javascript/an app, etc.

10JoshuaZ12y

That might have been true a few years ago, but they point out that that's not as true anymore. For example, they suggest one practical application of this technique might be to put your own server in a colocation facility, stick a microphone in it and slurp up as many keys as you can. They also were able to get a version of the technique to work 4 meters away, which is far enough that this becomes somewhat different from having direct physical access. They also point out that laser microphones could also be used with this method.