i_know_youre_listening

 

Image from: xkcd

The famous cryptographer Adi Shamir and his colleagues published a scientific paper titled "RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis"

Many computers emit high frequency sound during operation, because of the vibrations in some electronic components (capacitors) caused due to microscopic variations in the voltage of the CPU during different workload on it. In theory, these sound vibrations can be analyzed in order to obtain information about the running application software, including cryptographic calculations. In 2004 year, Shamir and his colleagues have shown that different RSA keys cause different sound patterns, but back then it could not be understood how to extract individual bits keys. The main problem was that the sound equipment was unable to record sound with a high sampling frequency: 20 Khz only for conventional microphones and a few hundred kilohertz for ultrasonic microphones. This is many orders of magnitude low than several GHz, which is operated in modern computers.

Now they have demonstrated it with a software that extracts the full 4096-bit keys with GnuPG computers of various models after an hour of listening, if the computer all the time performs decryption. Conducted successful demonstration of such an attack using a smartphone, which lay 30 cm from the computer.

audio2

When using the directional microphone can attack from a distance of up to 4 metres.

Img3

If miniature hidden microphones are used, the maximum distance is about 1 meter. All equipment on the photos, in addition to microphones, can be hidden under a desk or in another discrete location.

At large scale, it seriously pose a threat and perhaps having organizational severs in fully shielded rooms would prevent it.

Photos from the paper.