How to snoop on passwords with this one weird trick (involving public Wi-Fi signals)
- Reference: 1694601915
- News link: https://www.theregister.co.uk/2023/09/13/wifi_beamforming_side_channel_attack/
- Source link:
The technique is made possible thanks to beamforming feedback information (BFI), which consists of data about wireless signal characteristics that turns out to be useful for ensuring a strong network connection and for applications like [1]Wi-Fi sensing .
[2]Beamforming is a technique that directs radio waves towards the device intended to receive them, instead of transmitting them omni-directionally. It was standardized within Wi-Fi 802.11ac – perhaps without sufficient concern about security because the BFI it generates travels unprotected in cleartext on public networks.
[3]
That's not good on non-password-protected, publicly accessible networks, as might be encountered at a cafe, shopping mall, or airport. If you only care about private, password-protected networks, the rest of this article is literally academic for you.
[4]
[5]
Also because this relies on public, unprotected Wi-Fi, one assumes the target of the snooping isn't sending any sensitive information, such as their passwords, over the network in cleartext: that would be a lot easier to capture than screwing around with BFI frames. It's assumed the target is using HTTPS/TLS and/or a VPN to protect their network traffic, but doing so over public Wi-Fi.
In a [6]preprint paper titled "Password-Stealing without Hacking: Wi-Fi Enabled Practical Keystroke Eavesdropping," authors Jingyang Hu, Hongbo Wang, Tianyue Zheng, Jingzhi Hu, Zhe Chen, Hongbo Jiang, and Jun Luo describe how they came up with a way to infer numerical passwords by capturing BFI and analyzing the results. Their work has been accepted into the ACM SIGSAC Conference on Computer and Communications Security, to be held in November in Denmark.
[7]
"We propose [8]WiKI-Eve to eavesdrop keystrokes on smartphones without the need for hacking," the computer scientists, who have ties to Hunan University and Fudan University in China, and Nanyang Technological University in Singapore, explained.
"WiKI-Eve exploits a new feature, BFI (beamforming feedback information), offered by latest Wi-Fi hardware: since BFI is transmitted from a smartphone to an AP [access point] in cleartext, it can be overheard (hence eavesdropped) by any other Wi-Fi devices switching to monitor mode."
[9]
Illustration from the paper showing how finger movements can disrupt signals, and thus be sensed via BFI. Credit: Hu et al
KI is capitalized here to indicate "keystroke inference" – inferring what keystroke occurred from the BFI data. As a surveillance target moves their finger around their phone or tablet to type out things, like a password or passcode, the diffraction pattern of the wireless network's radio signals between the device and the base station is disturbed enough that it shows up in the BFI, which can be eavesdropped and used to infer which keys are being tapped on screen, it is claimed.
Basically, by recording the BFIs in Wi-Fi frames when the victim – Bob – is typing his password, a nearby spy – Eve – can collect time series data of BFI samples that can be correlated to the typed password using a deep-learning model.
Will this research result in actual practical attacks? We're willing to bet no, but still: it's a pretty fun technique, and one Reg readers may find interesting.
[10]Warning: Your wireless networks may leak data thanks to Wi-Fi spec ambiguity
[11]Tech industry quietly patches FragAttacks Wi-Fi flaws that leak data, weaken security
[12]With ICMP magic, you can snoop on vulnerable HiSilicon, Qualcomm-powered Wi-Fi
[13]Let there be light ... based wireless networks: LiFi spec OK'd as Wi-Fi complement
Side-channel attacks aimed at learning Wi-Fi passwords have are not new, the boffins say, noting that these have involved acoustic measurements, indirect vision (reading passwords from eye movements), and motion sensors, among other techniques. But these have practical limitations and remain largely academic exercises, it's claimed.
One side channel that doesn't have these obstacles to practical use is Wi-Fi CSI (channel state information), which the researchers say can also be used to infer passwords through signal measurements.
[14]
CSI exploitation is described in a 2015 [15]paper [PDF], "Keystroke Recognition using WiFi Signals," and in a [16]2016 paper that describes the WindTalker attack, "When CSI Meets Public WiFi: Inferring Your Mobile Phone Password via WiFi Signals," among others.
The eggheads in China and Singapore say that evolving Wi-Fi technology has meant that CSI eavesdropping isn't particularly easy as it may require hacking or special hardware. BFI, they assert, is easier and has advantages in terms of being less sensitive to channel variation that make it hard to infer keystrokes.
The technique isn't perfect and has limitations. The authors claim, "WiKI-Eve achieves 88 percent accuracy for identifying single numerical keys, and a top-100 accuracy of 85.0 percent for inferring a 6-digit numerical password."
Note the term "numerical." The focus of the research was on numeric passwords, because alphanumeric passwords are more complicated and are thus more difficult to decipher from BFI signals.
Stay in character(s)
When letters and numbers (but not special characters) are considered, WiKI-Eve manages to accurately classify 40 percent of keystrokes. But the technique, the researchers claim, outperforms other attacks such as WindTalker and WINK.
The distance of Bob, the victim, from the Wi-Fi access point also matters – average accuracy drops by about 23 percent when the distance increases from one meter to ten meters – though in this scenario Eve's distance from the access point doesn't matter.
"Consequently, Eve can eavesdrop stealthily from a long distance without compromising inference accuracy, clearly demonstrating the advantage of WiKI-Eve’s o-IKI method," the researchers argue.
As for defenses, try encryption: using a password-protected Wi-Fi network will wrap the BFI frames in encryption, as we understand it, preventing others nearby from eavesdropping on the data. Sticking to private, protected wireless networks is generally recommended anyway.
"Since WiKI-Eve achieves keystroke eavesdropping by overhearing Wi-Fi BFI, the most direct defense strategy is to encrypt data traffic, hence preventing attackers from obtaining BFI in cleartext," the researchers wrote. ®
Get our [17]Tech Resources
[1] https://www.theregister.com/2021/03/31/wifi_devices_monitoring/
[2] https://pubmed.ncbi.nlm.nih.gov/25152927/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZQHcpX@MRFec0upYotU5jgAAARU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZQHcpX@MRFec0upYotU5jgAAARU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZQHcpX@MRFec0upYotU5jgAAARU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://arxiv.org/abs/2309.03492
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZQHcpX@MRFec0upYotU5jgAAARU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://github.com/Nest-Fi/WiKI-Eve
[9] https://regmedia.co.uk/2023/09/13/screennshot_bfi_snooping.jpg
[10] https://www.theregister.com/2023/03/30/wifi_spec_ambiguity_leak/
[11] https://www.theregister.com/2021/05/12/krack_hack_wifi/
[12] https://www.theregister.com/2023/04/07/wifi_access_icmp/
[13] https://www.theregister.com/2023/07/14/lifi_spec_ieee_802_11bb_approved/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZQHcpX@MRFec0upYotU5jgAAARU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.sigmobile.org/mobicom/2015/papers/p90-aliA.pdf
[16] https://dl.acm.org/doi/10.1145/2976749.2978397
[17] https://whitepapers.theregister.com/
In one respect impressive in another..... they've got an 85% chance of correctly getting your pass code if it's numeric and if you're on an unencrypted connection and if you're close enough to the AP and of course they've got to know that you're typing is a pass code and not playing a game or typing a note or....
Or have I missed something?
Famous last words
Will this research result in actual practical attacks? We're willing to bet no...
These are the famous last words when somebody uses it in a practical setting, probably combined with other practises, and causes a world-wide panic.
Surely passwords usually get transmitted as a single packet when you tap the login button rather than as indivitual keystrokes? Which would make this technique useless?
And most of the time, you don't actually type them in, you load them in from your keychain / password manager?
This attack isn't listening for that packet. It's looking for interference in other packets caused by your fingers on the phone screen, then making an educated guess at where on the screen your finger is.
And most of the time, you don't actually type them in, you load them in from your keychain / password manager?
My first thought as well. If I am actually typing a password in an airport I am likely to be taking a lot more precautions. I will add "waving my phone about and moving around while doing it" to the list.
I guess that it does apply to the password for the password manager, though. Although that would require the hacker to then steal the phone as well in order to be able to use it.
So 85% accuracy..
.... probably in a very controlled and quiet lab.
Chuck in noise and different key layout (after all a iPhone keypad layout, is different to a Samsung, a Samsung different to Motorola, Motorola different to Huawei.Daves Huawei different to Bob's Huawei...and on and on. Throw in typos, corrections and autocomplete.
Add all this in your're going to be somewhere around 0%
Re: So 85% accuracy..
And me using Grafiti (it's in the Google Play store, for all you ex-Palm users) will probably confuse it greatly!
Re: So 85% accuracy..
Or Dvorak...
Re: So 85% accuracy..
So maybe try a password like M E R D E and then delete, delete, delete, delete, delete, S H I T - see how that gets recorded and if they think you are using a 14 character password.
Just another reason not to use unencrypted wifi.
In many countries it's now also illegal to provide unencrypted wifi services for customers. In your own home, of course, you can do whatever you want.
Mitigations
So it's detecting the movement of your finger to try to infer the password. Easy mitigations:
1. Use a password manager that's unlocked via fingerprint. At best, they can see what you typed into the search box to guess what you're trying to connect to.
2. Wave your finger around a bit more when entering passwords.
3. Don't use public wifi to connect to anything secure. Like we've been told for years.
So, this is a fancier version of what is acheived by using a microphone to listen to the noise of your target's keyboard, and using the differing keysounds to infer the keys pressed. I've got to say, I'm impressed.