Acoustic cryptanalysis is a type ofside-channel attack that exploitssounds emitted by computers or other devices.
Most of the modern acoustic cryptanalysis focuses on the sounds produced bycomputer keyboards and internalcomputer components, but historically it has also been applied toimpact printers, andelectromechanical deciphering machines.
Victor Marchetti andJohn D. Marks eventually negotiated the declassification of CIA acoustic intercepts of the sounds of cleartext printing from encryption machines.[1] Technically this method of attack dates to the time ofFFT hardware being cheap enough to perform the task; in this case the late 1960s to mid-1970s. However, using other more primitive means such acoustical attacks were made in the mid-1950s.
In his bookSpycatcher, formerMI5 operativePeter Wright discusses use of an acoustic attack againstEgyptianHagelin cipher machines in 1956. The attack wascodenamed "ENGULF".[2]
In 2004, Dmitri Asonov and Rakesh Agrawal of theIBMAlmaden Research Center announced thatcomputer keyboards and keypads used ontelephones andautomated teller machines (ATMs) are vulnerable to attacks based on the sounds produced by different keys. Their attack employed aneural network to recognize the key being pressed. By analyzing recorded sounds, they were able to recover the text of data being entered. These techniques allow an attacker usingcovert listening devices to obtainpasswords,passphrases,personal identification numbers (PINs), and other information entered via keyboards. In 2005, a group of UC Berkeley researchers performed a number of practical experiments demonstrating the validity of this kind of threat.[3]
Also in 2004,Adi Shamir andEran Tromer demonstrated that it may be possible to conducttiming attacks against aCPU performing cryptographic operations by analyzing variations in acoustic emissions. Analyzed emissions wereultrasonic noise emanating fromcapacitors andinductors on computermotherboards, notelectromagnetic emissions or the human-audible humming of a cooling fan.[4] Shamir and Tromer, along with new collaborator Daniel Genkin and others, then went on to successfully implement the attack on a laptop running a version ofGnuPG (anRSA implementation), using either a mobile phone located close to the laptop, or a laboratory-grade microphone located up to 4 m away, and published their experimental results in December 2013.[5]
Acoustic emissions occur in coils and capacitors because of small movements when a current surge passes through them. Capacitors in particular change diameter slightly as their many layers experience electrostatic attraction/repulsion or piezoelectric size change.[6] A coil or capacitor which emits acoustic noise will, conversely, also be microphonic, and the high-end audio industry takes steps with coils[7] and capacitors[8] to reduce these microphonics (immissions) because they can muddy a hi-fi amplifier's sound.[citation needed]
In March 2015, it was made public that some inkjet printers using ultrasonic heads can be read back using high frequencyMEMS microphones to record the unique acoustic signals from each nozzle and using timing reconstruction with known printed data,[citation needed] that is, "confidential" in 12-point font.[clarification needed] Thermal printers can also be read using similar methods but with less fidelity as the signals from the bursting bubbles are weaker.[citation needed] The hack also involved implanting a microphone, chip storage IC and burst transmitter with long-life Li+ battery into doctored cartridges substituted for genuine ones sent by post to the target, typically a bank, then retrieved from the garbage using challenge-responseRFID chip.[citation needed] A similar work on reconstructing printouts made bydot-matrix printers was publicized in 2011.[9]
A new acoustic cryptanalysis technique discovered by a research team at Israel'sBen-Gurion University Cybersecurity Research Center allows data to be extracted using a computer's speakers and headphones.[citation needed]Forbes published a report stating that researchers found a way to see information being displayed, by using microphone, with 96.5% accuracy.[10]
In 2016, Genkin, Shamir, and Tromer published another paper that described a key extraction attack that relied on the acoustic emissions from laptop devices during the decryption process. They demonstrated the success of their attack with both a simple mobile phone and a more sensitive microphone.[11]
This kind of cryptanalysis can be defeated by generating sounds that are in the same spectrum and same form as keypresses. If sounds of actual keypresses are randomly replayed, it may be possible to totally defeat such kinds of attacks. It is advisable to use at least 5 different recorded variations (36 x 5 = 180 variations) for each keypress to get around the issue ofFFT fingerprinting.[12] Alternatively,white noise of a sufficient volume (which may be simpler to generate for playback) will also mask the acoustic emanations of individual keypresses.