Sharif University of Technology Department of Computer Engineering

1. Sharif University of Technology Department of Computer Engineering Side Channel Attacks through Acoustic Emanations Presented by: Amir Mahdi HosseiniMonazzah Mohammad TaghiTeymoori As: Course Seminar of Hardware Security and Trust Ord. 1393

2. Table of Contents Introduction Conc. … Preliminaries Keyboard … Simulation … • Introduction • Preliminaries • How FFT helps us! • How Neural Network helps us! • Keyboard Acoustic Emanations • Simulation System Setup and Results • Conclusion and Future Work 1 Side Channel Attacks through Acoustic Emanations

3. Electromagnetic Emanations Introduction Conc. … Preliminaries Keyboard … Simulation … • Attacks on the security of computer systems • Electromagnetic Emanations 2 Side Channel Attacks through Acoustic Emanations

4. Optical Emanation Introduction Conc. … Preliminaries Keyboard … Simulation … • Attacks on the security of computer systems • Optical Emanation 3 Side Channel Attacks through Acoustic Emanations

5. Acoustic Emanation Introduction Conc. … Preliminaries Keyboard … Simulation … • Attacks on the security of computer systems • Acoustic Emanation • Like the mentioned attacks, works on the pattern of (acoustic) signals • This attack is inexpensive and non-invasive! • Only need a simple microphone. • Example attacks already implemented on • Dot matrix printers • Keyboard 4 Side Channel Attacks through Acoustic Emanations

6. How FFT Helps Us! Introduction Conc. … Preliminaries Keyboard … Simulation … • Fourier analysis converts time (or space) to frequency and vice versa. • FFT rapidly computes such transformations 5 Side Channel Attacks through Acoustic Emanations

7. How FFT Helps Us! (Cont.) Introduction Conc. … Preliminaries Keyboard … Simulation … • The raw sound produced by key clicks is not a good input • We need to extract relevant features of sound 6 Side Channel Attacks through Acoustic Emanations

8. How Neural Net. Helps Us! Introduction Conc. … Preliminaries Keyboard … Simulation … • Artificial neural network is a computational model capable of pattern recognition. • Classifies feature space • Data: set of value pairs: (xt, yt), yt=g(xt); • Objective: neural network represents the input / output transformation (a function) F • Learning: learning means using a set of observations to find F which solves the task in some optimal sense 7 Side Channel Attacks through Acoustic Emanations

9. How Neural Net. Helps Us! (Cont.) Introduction Conc. … Preliminaries Keyboard … Simulation … x1 x2 x3 … xn-1 xn w1 Output w2 Inputs y w3 . wn-1 . wn . 8 Side Channel Attacks through Acoustic Emanations

10. Attack Properties Introduction Conc. … Preliminaries Keyboard … Simulation … • Based on the hypothesis that the sound of clicks might differ slightly from key to key • Although the clicks of different keys sound similar to the human ear • The network can be trained on one person and then used to eavesdrop on another person typing on the same keyboard 9 Side Channel Attacks through Acoustic Emanations

11. Attack Properties (Cont.) Introduction Conc. … Preliminaries Keyboard … Simulation … • It is possible to train the network on one keyboard and then use it to attack another keyboard of the same type • There is a reduction in the quality of recognition • The clicks sound different because the keys are positioned at different positions on the keyboard plate 10 Side Channel Attacks through Acoustic Emanations

12. Signals Structure Introduction Conc. … Preliminaries Keyboard … Simulation … • The click lasts for approximately 100 ms • Peak of pushingthe key • Silence • Peak of releasingthe key 11 Side Channel Attacks through Acoustic Emanations

13. Flow of Experiment Introduction Conc. … Preliminaries Keyboard … Simulation … Recording the sound of pressed key Test the neural network with random input Extract the push pick information Success No Yes Calculating the FFT of push pick Create more accurate information Neural network trained successfully Importing the information to neural network Train the neural network with various redundant information 12 Side Channel Attacks through Acoustic Emanations

14. Motivational Example Introduction Conc. … Preliminaries Keyboard … Simulation … • Capturing the voice of pressing ‘h’ key • Capturing the voice of pressing ‘z’ key h z 13 Side Channel Attacks through Acoustic Emanations

15. Motivational Example Introduction Conc. … Preliminaries Keyboard … Simulation … • Calculating the FFT of ‘h’ and ‘z’ signals Silence h z Push Peak Release Peak 14 Side Channel Attacks through Acoustic Emanations

16. Motivational Example (Cont.) Introduction Conc. … Preliminaries Keyboard … Simulation … • Constructing the neural network and train it! • Error Prob.=8.87e-9 MATLAB Code: … X=[XzXh]; T=[0 1]; net = newpr(X, T, 20); net = train(net, X, T); … 15 Side Channel Attacks through Acoustic Emanations

17. System Setup Introduction Conc. … Preliminaries Keyboard … Simulation … • Main Paper • Java NNS neural network simulator • Simple PC microphone for short distances • up to 1 meter • Parabolic microphone for eavesdropping from a distance • IBM keyboard S/N 0953260, P/N 32P5100 16 Side Channel Attacks through Acoustic Emanations

18. System Setup (Cont.) Introduction Conc. … Preliminaries Keyboard … Simulation … • This Study • MATLAB neural network simulator • Simple PC microphone for short distances • up to 1 meter • A4TECH keyboard model KR-85 17 Side Channel Attacks through Acoustic Emanations

19. Results Introduction Conc. … Preliminaries Keyboard … Simulation … No Mistake! Alice: Bob: Victor: Constant Force: Variable Force: 18 Side Channel Attacks through Acoustic Emanations

20. Summary Introduction Conc. … Preliminaries Keyboard … Simulation … • We explored acoustic emanations of keyboard • Like input devices to recognize the content being typed • In the paper the attack was also applied to • Notebook keyboards • Telephone pads • ATM pads 19 Side Channel Attacks through Acoustic Emanations

21. Summary (Cont.) Introduction Conc. … Preliminaries Keyboard … Simulation … • A sound-free (non-mechanical) keyboard is an obvious countermeasure for the attack • However, it is neither comfortable for users nor cheap! 20 Side Channel Attacks through Acoustic Emanations

22. Future Work Introduction Conc. … Preliminaries Keyboard … Simulation … • Main Idea: • Improving the accuracy of the results by using the combination of keyboard acoustic emanations and predictive text algorithms. Generating the Text Result Recording Acoustic Emanation of Keyboard Activating the Eavesdropping System Training Neural Network Processing the Results with Predictive Text Algorithms 21 Side Channel Attacks through Acoustic Emanations

23. Thanks for your attention 22 Side Channel Attacks through Acoustic Emanations

24. References Introduction Conc. … Preliminaries Keyboard … Simulation … • Asonov, Dmitri, and Rakesh Agrawal. "Keyboard acoustic emanations." In IEEE Symposium on Security and Privacy, vol. 2004, pp. 3-11. 2004. • Backes, Michael, Markus Dürmuth, Sebastian Gerling, Manfred Pinkal, and Caroline Sporleder. "Acoustic Side-Channel Attacks on Printers." In USENIX Security Symposium, pp. 307-322. 2010. • Kuhn, Markus G. "Optical time-domain eavesdropping risks of CRT displays." In Security and Privacy, 2002. Proceedings. 2002 IEEE Symposium on, pp. 3-18. IEEE, 2002. • Vuagnoux, Martin, and Sylvain Pasini. "Compromising Electromagnetic Emanations of Wired and Wireless Keyboards." In USENIX Security Symposium, pp. 1-16. 2009. 23 Side Channel Attacks through Acoustic Emanations