Don’t Skype & Type! Acoustic Eavesdropping in Voice-Over-IP Alberto Compagno Mauro Conti Sapienza University of Rome University of Padua
[email protected] [email protected] Daniele Lain Gene Tsudik University of Padua University of California, Irvine
[email protected] [email protected] ABSTRACT vate and sensitive information, such as photos, passwords, Acoustic emanations of computer keyboards represent a se- and messages. Protecting such sensitive data by encryp- rious privacy issue. As demonstrated in prior work, physical tion is a common approach to prevent unauthorized access properties of keystroke sounds might reveal what a user is and disclosure. However, there is no protection if data is typing. However, previous attacks assumed relatively strong leaked before encryption. In fact, eavesdropping on physical adversary models that are not very practical in many real- signals, such as acoustic or electromagnetic emanations, is world settings. Such strong models assume: (i) adversary's one way to recover either: (1) clear-text data before encryp- physical proximity to the victim, (ii) precise profiling of the tion, e.g., during its input or visualization, or (2) encryption victim's typing style and keyboard, and/or (iii) significant keys, e.g., during data encryption and decryption. Indeed, amount of victim's typed information (and its corresponding the history of eavesdropping on physical signals dates back sounds) available to the adversary. to 1943, when a Bell engineer discovered that an oscilloscope This paper presents and explores a new keyboard acous- can retrieve the plain-text from electromagnetic emanations tic eavesdropping attack that involves Voice-over-IP (VoIP), of a Bell Telephone model 131-B2 { a mixing device used by called Skype & Type (S&T), while avoiding prior strong ad- the US Army to encrypt communications [9].