Keystroke Detection by Exploiting Unintended RF Emission from Repaired USB Keyboards

Abstract

Electronic devices and cables inadvertently emit RF emissions as a byproduct of signal processing and/or transmission. Labeled as electromagnetic emanations, they form an EM side-channel for data leakage. Previously, it was believed that such leakage could be contained within a facility since they are weak signals with a short transmission range. However, in the preliminary version of this work [1], we found that the traditional cable repairing process forms a tiny monopole antenna that helps emanations transmit over a long range. Experimentation with three types of cables revealed that emanations from repaired cables remain detectable even at >4 m and can penetrate a 14 cm thick concrete wall. In this extended version, we show that such emanation can be exploited at a long distance for information extraction by detecting keystrokes typed on a repaired USB keyboard. By collecting data for 70 different keystrokes at different distances from the target in 3 diverse environments (open space, a corridor outside an office room, and outside a building) and developing an efficient detection algorithm, ~100% keystroke detection accuracy has been achieved up to 12 m distance, which is the highest reported accuracy at such a long range for USB keyboards in the literature. The effect of two experimental factors, interference and human-body coupling, has been investigated thoroughly. Along with exploring the vulnerability, multi-layer external metal shielding during the repairing process as a possible remedy has been explored. This work exposes a new attack surface caused by hardware modification, its exploitation, and potential countermeasures.