Despite being dedicated to improving the lives of users, AI can also have a darker and darker side. Proving this is a new publication, which shows that AI can steal any password just by listening to how the user types on the keyboard.
There were 3 researchers from Cornell University discovered a way to steal data just by recording the audio of typing keys on a keyboard. This managed to train an AI to listen and identify each of the different keys.
For this, the 36 individual keys were pressed 25 times each, to feed this AI. The system does not work with any random keyboard and must be trained for what it is intended to attack, with letter, number or symbol references corresponding to each key.
This training can be done locally with a microphone or remotely using an app like Zoom to record the audio of keystrokes. With this, attackers are able to predict what was written with up to 95% accuracy. This only dropped to 93% when using Zoom to train the AI system.
In demonstrating this scenario, the team used a MacBook Pro to test the concept. This was the basis for the AI model to recognize which letter is associated with each key sound. There are subtle differences in the waveforms produced by the recording to recognize each keystroke with an astonishing degree of accuracy.
This type of potential attack is not without flaws. Investigators revealed that there are measures that can be taken to mitigate the accuracy of the system. It will be enough just to change the way the user writes. Touch writing reduced recognition accuracy from 64% to 40%. It would also be possible to use software to produce noise that confuses the AI.
This type of attack works very well with mechanical keyboards, but is not limited to mechanical keyboards. A membrane one still produces enough sound to train the AI model. The ideal protection solution seems to be the use of software, instead of switching to a (more) silent one.
2023-08-08 00:30:58
#steal #passwords #listening #type #keyboard
