Hack all the things

It’s TED season again so we’re being treated to a new round of videos from the conference. This one, sent to me by my friend and colleague Jack Chant, actually dates back to October. It’s from TEDxMidAtlantic, one of the many TEDx franchise conferences.

In it, Avi Rubin from Johns Hopkins University talks about the security implications of the increasing ubiquity of computerized and networked devices. He has a great collection of examples of attacks that computer security researchers have been able to apply to everything from car brake systems to pacemakers.

It’s a pretty entertaining tour through the world of things you really wouldn’t want to have hacked.

Many of the attacks Rubin talks about are based on the general field of machine learning. Though I’m far from an expert in the field, it was the topic of my masters thesis so I have a passing familiarity with it.

Rubin didn’t mention my favourite example of a machine learning hack: acoustic keylogging. That’s fancy words for figuring out what someone is typing by listening to their keyboard. It relies on the fact that the different keys on a keyboard will make subtly different sounds, and with enough data you can teach a computer to distinguish them.

In 2005, researchers in Berkeley created a system which analysed a 10 minute recording of someone typing English text, and formed a model that could figure out from the sound of a single keystroke which key was most likely to have created the sound. The system didn’t even need to be told what the original text was. It could figure that out on its own.

With just that 10 minutes of recording forming the basis of the model, their system was able to make reasonable guesses about random (non-English) typing, including passwords. It could identify 80% of 10 character passwords in fewer than 75 guesses. Maybe 75 sounds like a lot to you, but consider this: even assuming all of the passwords were composed entirely of lowercase letters (reducing the space of possible passwords as much as possible) it would take on average 50 trillion guesses to get one right without help.

Now imagine how well it would work if that mysterious flower delivery van that’s been across the street for over week had a directional microphone pointed at your computer the whole time. Time for a quieter keyboard maybe.

If you’re interested in the details, the paper that introduced me to this kind of attack was called Keyboard Acoustic Emanations Revisited (pdf), by Zhuang et al and it’s available in its entirety online for free.