A research team at Georgia Tech has discovered how to do exactly that, using a smartphone accelerometer -- the internal device that detects when and how the phone is tilted -- to sense keyboard vibrations and decipher complete sentences with up to 80 percent accuracy. The procedure is not easy, they say, but is definitely possible with the latest generations of smartphones.
"We first tried our experiments with an iPhone 3GS, and the results were difficult to read," said Patrick Traynor, assistant professor in Georgia Tech's School of Computer Science. "But then we tried an iPhone 4, which has an added gyroscope to clean up the accelerometer noise, and the results were much better. We believe that most smartphones made in the past two years are sophisticated enough to launch this attack."
Previously, Traynor said, researchers have accomplished similar results using microphones, but a microphone is a much more sensitive instrument than an accelerometer. A typical smartphone's microphone samples vibration roughly 44,000 times per second, while even newer phones' accelerometers sample just 100 times per second -- two full orders of magnitude less often. Plus, manufacturers have installed security around a phone's microphone; the phone's operating system is programmed to ask users whether to give new applications access to most built-in sensors, including the microphone. Accelerometers typically are not protected in this way.
The technique works through probability and by detecting pairs of keystrokes, rather than individual keys (which still is too difficult to accomplish reliably, Traynor said). It models "keyboard events" in pairs, then determines whether the pair of keys pressed is on the left versus right side of the keyboard, and whether they are close together or far apart. After the system has determined these characteristics for each pair of keys depressed, it compares the results against a preloaded dictionary, each word of which has been broken down along similar measurements (i.e., are the letters left/right, near/far on a standard QWERTY keyboard). Finally, the technique only works reliably on words of three or more letters.
For example, take the word "canoe," which when typed breaks down into four keystroke pairs: "C-A, A-N, N-O and O-E." Those pairs then translate into the detection system's code as follows: Left-Left-Near, Left-Right-Far, Right-Right-Far and Right-Left-Far, or LLN-LRF-RRF-RLF. This code is then compared to the preloaded dictionary and yields "canoe" as the statistically probable typed word. Working with dictionaries comprising about 58,000 words, the system reached word-recovery rates as high as 80 percent.
"The way we see this attack working is that you, the phone's owner, would request or be asked to download an innocuous-looking application, which doesn't ask you for the use of any suspicious phone sensors," said Henry Carter, a PhD student in computer science and one of the study's co-authors. "Then the keyboard-detection malware is turned on, and the next time you place your phone next to the keyboard and start typing, it starts listening."
Mitigation strategies for this vulnerability are pretty simple and straightforward, Traynor said. First, since the study found an effective range of just three inches from a keyboard, phone users can simply leave their phones in their purses or pockets, or just move them further away from the keyboard. But a fix that puts less onus on users is to add a layer of security for phone accelerometers.
"The sampling rate for accelerometers is already pretty low, and if you cut it in half, you start to approach theoretical limitations that prevent eavesdropping. The malware simply does not have the data to work with," Traynor said. "But most phone applications can still function even with that lower accelerometer rate. So manufacturers could set that as the default rate, and if someone downloads an application like a game that needs the higher sampling rate, that would prompt a permission question to the user to reset the accelerometer."
In the meantime, Traynor said, users shouldn't be paranoid that hackers are tracking their keystrokes through their iPhones.
"The likelihood of someone falling victim to an attack like this right now is pretty low," he said. "This was really hard to do. But could people do it if they really wanted to? We think yes."
The finding is reported in the paper, "(sp)iPhone: Decoding Vibrations From Nearby Keyboards Using Mobile Phone Accelerometers," and will be presented on Oct. 20, at the 18th ACM Conference on Computer and Communications Security in Chicago. In addition to Carter, Traynor's coauthors include Georgia Tech graduate student Arunabh Verman and Philip Marquardt of the MIT Lincoln Laboratory.
Recommend this story on Facebook, Twitter,
and Google +1:
Other bookmarking and sharing tools:
Story Source:
The above story is reprinted from materials provided by Georgia Institute of Technology.
Note: ScienceDaily reserves the right to edit materials for content and length. For further information, please contact the source cited above.
Note: If no author is given, the source is cited instead.
Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.
SpyPhone Patrick Traynor shows off the "SpiPhone" app he created to tap keystrokes with phone accelerometers. Georgia Tech 
A DIY UAV That Hacks Wi-Fi Networks, Cracks Passwords, and Poses as a Cell Phone Tower
Your iPhone Keeps a Secret Log of Everywhere You Go, Security Experts Find
Last Shuttle Mission Will Carry iPhones to the Space StationTagsTechnology, Rebecca Boyle, accelerometer, iphone, keystrokes, malware, smartphones, spying, spyware, typingUsing a dictionary of about 58,000 words, the researchers were able to decipher typing with about 80 percent accuracy. 
Midoman 10/19/11 at 11:39 am 
Q 10/19/11 at 12:42 pm 
Archive Gallery: Classic Thrill Rides and Carnival Attractions
Gallery: The X Prize Oil Cleanup Challenge
Gallery: Inside a Knife Factory+ More Photo Galleries 
Novel Barrier Materials or Formulations for Paper PackagingAward: $20,000 USD
Reducing Metal–Metal FrictionAward: $10,000 USDLearn morePowered by Innocentive 
Name Address 1 City State STATE Alabama Alaska Arizona Arkansas California Colorado Connecticut Delaware DC Florida Georgia Hawaii Idaho Illinois Indiana Iowa Kansas Kentucky Louisiana Maine Maryland Massachusetts Michigan Minnesota Mississippi Missouri Montana Nebraska Nevada New Hampshire New Jersey New Mexico New York N. Carolina N. Dakota Ohio Oklahoma Oregon Pennsylvania Rhode Island S. Carolina S. Dakota Tennessee Texas Utah Vermont Virginia Washington W. Virginia Wisconsin Wyoming Zip Code Email Today on PopSci.com 
Archive Gallery: Steve Jobs in the Pages of Popular Science, Over Three Decades575701071
Futuristic Predictions From the Past That Steve Jobs Fulfilled575381072
Can Animals Really Be Gay?574881073
Video: Solar Sinter Project Turns the Desert's Free Abundance of Sand and Sun into 3-D-Printed Glass 551421074
Five Reasons You Should Care About the New Ozone Hole Over the Arctic574171075
Archive Gallery: PopSci's Most Gigantic Portable Gadgets573651076
Inside the Factory: How a Chef's Knife Is Made571741077
Scientist in a Strange Land568431079
What Is the Point of the Female Orgasm?5711610710
Archive Gallery: Mail Order Kits, From the Back Pages of PopSci5719710711
Baffling CERN Results Show Neutrinos Moving Faster Than the Speed of Light5720010712 Footer Menu Subscribe to the Print EditionSubscribe to the Digital EditionRenew SubscriptionCustomer ServiceSite MapAbout UsContact UsAdvertisingPrivacy PolicyTerms of UseAbuseRSS FeedsPS Showcase