Abstract:This paper demonstrates the feasibility of a side-channel attack to infer keystrokes on touch screen leveraging an off-the-shelf smartphone. Although there exist some studies on keystroke eavesdropping attacks on touch screen, they are mainly direct eavesdropping attacks, i.e., require the device of victims compromised to provide side-channel information for the adversary, which are hardly launched in practical scenarios. In this work, we show the practicability of an indirect eavesdropping attack, KeyListener, which infers keystrokes on QWERTY keyboards of touch screen leveraging audio devices on a smartphone. We investigate the attenuation of acoustic signals, and find that a user’s keystroke fingers can be localized through the attenuation of acoustic signals received by the microphones in the smartphone. We then utilize the attenuation of acoustic signals to localize each keystroke, and further analyze errors induced by ambient noises. To improve the accuracy of keystroke localization, KeyListener further tracks finger movements during inputs through phase change and Doppler effect to reduce errors of acoustic signal attenuation-based keystroke localization. In addition, a binary tree-based search approach is employed to infer keystrokes in a context-aware manner. The proposed keystroke eavesdropping attack is robust to various environments without the assistance of additional infrastructures. Extensive experiments demonstrate that the accuracy of keystroke inference in top-5 candidates can approach 90% with a top-5 error rate of around 6%, which is a strong indication of the possible user privacy leakage of inputs on QWERTY keyboard.

ScreenInformer: Whispering Secret Information Via an LCD Screen

ScreenID: Enhancing QRCode Security by Fingerprinting Screens

ScreenID: Enhancing QRCode Security by Utilizing Screen Dimming Feature

Your Noise, My Signal: Exploiting Switching Noise for Stealthy Data Exfiltration from Desktop Computers

CapSpeaker: Injecting Voices to Microphones Via Capacitors

OutletSpy

Key Listener: Inferring Keystrokes on QWERTY Keyboard of Touch Screen Through Acoustic Signals

CapSpeaker: Injecting Commands to Voice Assistants Via Capacitors

MagView++: Data Exfiltration Via CPU Magnetic Signals under Video Decoding

Mmear: Push the Limit of COTS Mmwave Eavesdropping on Headphones

Black Hole of Sound: Constructing an Anti-eavesdropping Area Using Ultrasound

Mid: Tracing Screen Photos Via Moiré Patterns

Hard Drive of Hearing: Disks That Eavesdrop with a Synthesized Microphone

AIRCODE: Hidden Screen-Camera Communication on an Invisible and Inaudible Dual Channel

An Eavesdropping System Based on Magnetic Side-Channel Signals Leaked by Speakers

Synesthesia: Detecting Screen Content via Remote Acoustic Side Channels

Side Eye: Characterizing the Limits of POV Acoustic Eavesdropping from Smartphone Cameras with Rolling Shutters and Movable Lenses

Messages Behind the Sound: Real-Time Hidden Acoustic Signal Capture with Smartphones

Ultracomm: High-Speed And Inaudible Acoustic Communication

Hearing your touch: A new acoustic side channel on smartphones

PIXHELL Attack: Leaking Sensitive Information from Air-Gap Computers via `Singing Pixels'