1. Compromising Electromagnetic Emanations of Wired and Wireless Keyboards Presented By: Justin Rilling Written By: Martin Vuagnoux and Sylvain Pasini

2. Outline - Introduction - Paper Contributions - Experimental Setup - Description of Attacks - Results - Countermeasures - Comments - Questions

3. Introduction - This paper evaluates four types of keyboards (PS/2, USB, laptop, and wireless) - Defines four types of attacks. All the keyboards tested where vulnerable to at least one type of attack (One attack recovered 95% of keystrokes 20m from the keyboard through walls) - Tests electromagnetic vulnerability in different environmental scenarios (Low noise, office, adjacent office, and building)

4. Contribution - Determined the practical feasibility of eavesdropping on keystrokes - Used the “Full Spectrum Acquisition Method” to detect electromagnetic radiation that may be missed by traditional methods

5. Experimental Setup

6. Falling Edge Transition Technique (FETT) 000 1 00 1 00 1 1 Start Bit Scan Code 0x24 = ‘E’ Odd Parity Bit Stop Bit

7. Falling Edge Transition Technique (FETT) - Were able to detect the falling edges of the PS/2 data line - On average, can reduce the keystroke to 2.42 possible keys

8. The Generalized Transition Technique (GTT) - A band-pass (105-165MHz) filter is used to improve the SNR which allows the authors to extract the rising and falling edges of the data line Threshold Line 0 0 0 1 0 0 1 0 0 1 1

9. The Modulation Technique (MT) - They were also able to find frequency and amplitude modulated harmonics at 124MHz that correspond to the data and clock signals - This attack is able to fully recover all keystrokes - These types of electromagnetic waves are interesting because they carry further than those discussed in the previous two attacks

10. The Matrix Scan Technique (MST) Driver Detector … … … w s x e d c q a z

11. The Matrix Scan Technique (MST) - This attack worked on almost every keyboard - On average, could reduce the keystroke to 5.14 possible keys

12. Accuracy GTT - Able to recover all keystrokes correctly MT - Able to recover all keystrokes correctly FETT - Can reduce the keystroke to 2.42 possible keys on average MST - Can reduce the keystroke to 5.14 possible keys on average

13. Effectiveness on Various Types of Keyboards

14. Range of Attack Low Noise ScenarioOffice Scenario

15. Countermeasures - Shield keyboard, cable, motherboard and room - Encrypt bi-directional (PS/2) serial cable - Obfuscate scan matrix loop routine

16. Comments - Very thorough testing - Could improve the explanation of the building test scenario - Would have been interesting if they tested the outlined countermeasures

17. Questions ???