skip to main content
10.1145/3576915.3623088acmconferencesArticle/Chapter ViewAbstractPublication PagesccsConference Proceedingsconference-collections
research-article
Open access

Password-Stealing without Hacking: Wi-Fi Enabled Practical Keystroke Eavesdropping

Published: 21 November 2023 Publication History

Abstract

The contact-free sensing nature of Wi-Fi has been leveraged to achieve privacy breaches, yet existing attacks relying on Wi-Fi CSI (channel state information) demand hacking Wi-Fi hardware to obtain desired CSIs. Since such hacking has proven prohibitively hard due to compact hardware, its feasibility in keeping up with fast-developing Wi-Fi technology becomes very questionable. To this end, we propose WiKI-Eve to eavesdrop keystrokes on smartphones without the need for hacking. WiKI-Eve exploits a new feature, BFI (beamforming feedback information), offered by latest Wi-Fi hardware: since BFI is transmitted from a smartphone to an AP in clear-text, it can be overheard (hence eavesdropped) by any other Wi-Fi devices switching to monitor mode. As existing keystroke inference methods offer very limited generalizability, WiKI-Eve further innovates in an adversarial learning scheme to enable its inference generalizable towards unseen scenarios. We implement WiKI-Eve and conduct extensive evaluation on it; the results demonstrate that WiKI-Eve achieves 88.9% inference accuracy for individual keystrokes and up to 65.8% top-10 accuracy for stealing passwords of mobile applications (e.g., WeChat).

References

[1]
Kamran Ali, Alex X. Liu, Wei Wang, and Muhammad Shahzad. 2015. Keystroke Recognition using WiFi Signals. In Proc. of the 21st ACM MobiCom. 90--102.
[2]
Apple Inc. 2023. Buy iPhone 13. https://www.apple.com/sg/shop/buy-iphone/iphone-13. Online; accessed 12 February 2023.
[3]
Shaojie Bai, J. Zico Kolter, and Vladlen Koltun. 2018. An Empirical Evaluation of Generic Convolutional and Recurrent Networks for Sequence Modeling. arXiv preprint arXiv:1803.01271 (2018).
[4]
The World Bank. 2023. Mobile ID. https://id4d.worldbank.org/guide/mobile-id. Online; accessed 25 March 2023.
[5]
Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wortman Vaughan. 2010. A Theory of Learning from Different Domains. Machine Learning, Vol. 79 (2010), 151--175.
[6]
Raheem Beyah and Aravind Venkataraman. 2011. Rogue-access-point Detection: Challenges, Solutions, and Future Directions. IEEE Security & Privacy, Vol. 9, 5 (2011), 56--61.
[7]
Jessey Bullock and Jeff T. Parker. 2017. Wireshark for Security Professionals: Using Wireshark and the Metasploit Framework. John Wiley & Sons.
[8]
Liang Cai and Hao Chen. 2011. TouchLogger: Inferring Keystrokes on Touch Screen from Smartphone Motion. In Proc. of the 6th USENIX Security HotSec. 1--9.
[9]
Matteo Cardaioli, Stefano Cecconello, Mauro Conti, Simone Milani, Stjepan Picek, and Eugen Saraci. 2022. Hand Me Your PIN! Inferring ATM PINs of Users Typing with a Covered Hand. In Proc. of the 31st USENIX Security. 1687--1704.
[10]
Yimin Chen, Tao Li, Rui Zhang, Yanchao Zhang, and Terri Hedgpeth. 2018. EyeTell: Video-assisted Touchscreen Keystroke Inference from Eye Movements. In Proc. of the 39th IEEE S & P. 144--160.
[11]
Zhe Chen, Tianyue Zheng, Chao Hu, Hangcheng Cao, Yanbing Yang, Hongbo Jiang, and Jun Luo. 2023. ISACoT: Integrating Sensing with Data Traffic for Ubiquitous IoT Devices. IEEE Communications Magazine, Vol. 61, 5 (2023), 98--104.
[12]
Inc. Cisco Systems. 2023. Cisco Wireless Controller Configuration Guide, Release 8.4. https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-4/config-guide/b_cg84/wireless_intrusion_detection_system.html#rogue-ap-classification. Online; accessed 25 March 2023.
[13]
JPMorgan Chase & Co. 2023. Mobile Banking Features with Chase Mobile App. https://www.chase.com/digital/mobile-banking. Online; accessed 25 March 2023.
[14]
Intel Corporation. 2008. Intel Ultimate N WiFi Link 5300. https://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/ultimate-n-wifi-link-5300-brief.pdf. Online; accessed 28 March 2023.
[15]
Intel Corporation. 2023. Intel® Wi-Fi 6 AX201. https://www.intel.sg/content/www/xa/en/products/sku/130293/intel-wifi-6-ax201-gig/specifications.html. Online; accessed 25 March 2023.
[16]
Rob Cover. 2015. Digital Identities: Creating and Communicating the Online Self. Academic Press.
[17]
Patrick Cronin, Xing Gao, Chengmo Yang, and Haining Wang. 2021. Charger-Surfing: Exploiting a Power Line Side-Channel for Smartphone Information Leakage. In Proc. of the 30th USENIX Security. 681--698.
[18]
Song Fang, Ian Markwood, Yao Liu, Shangqing Zhao, Zhuo Lu, and Haojin Zhu. 2018. No Training Hurdles: Fast Training-agnostic Attacks to Infer Your Typing. In Proc. of the 25th ACM CCS. 1747--1760.
[19]
Yaroslav Ganin and Victor Lempitsky. 2015. Unsupervised Domain Adaptation by Backpropagation. In Proc. of the 32nd ACM ICML. 1180--1189.
[20]
Matthew S. Gast. 2013. 802.11ac A Survival Guide: Wi-Fi at Gigabit and Beyond. O'Reilly Media, Inc.
[21]
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative Adversarial Nets. In Proc. of 28th NeurIPS. 2672--2680.
[22]
Google LLC. 2023. Pixel 6a. https://store.google.com/product/pixel_6a?hl=en-GB. Online; accessed 10 April 2023.
[23]
Christopher Hadnagy. 2010. Social Engineering: The Art of Human Hacking. John Wiley & Sons.
[24]
Daniel Halperin, Wenjun Hu, Anmol Sheth, and David Wetherall. 2011. Tool Release: Gathering 802.11n Traces with Channel State Information. ACM SIGCOMM Comput. Commun. Rev., Vol. 41, 1 (2011), 53.
[25]
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2015. Spatial Pyramid Pooling in Deep Convolutional Networks for Visual Recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence, Vol. 37, 9 (2015), 1904--1916.
[26]
Jingzhi Hu, Tianyue Zheng, Zhe Chen, Hongbo Wang, and Jun Luo. 2023. MUSE-Fi: Contactless MUti-person SEnsing Exploiting Near-field Wi-Fi Channel Variation. In Proc. of the 29th ACM MobiCom. 1--15.
[27]
Huawei Device Co., Ltd. 2023. HUAWEI P40 Pro. https://consumer.huawei.com/en/phones/p40-pro/. Online; accessed 10 April 2023.
[28]
Acer Inc. 2023. Acer TravelMate Laptops for Business. https://www.acer.com/sg-en/laptops/travelmate. Online; accessed 25 March 2023.
[29]
Zhiping Jiang, Tom H Luan, Xincheng Ren, Dongtao Lv, Han Hao, Jing Wang, Kun Zhao, Wei Xi, Yueshen Xu, and Rui Li. 2021. Eliminating the Barriers: Demystifying wi-fi Baseband Design and Introducing the Picoscenes Wi-Fi sensing Platform. IEEE Internet of Things Journal, Vol. 9, 6 (2021), 4476--4496.
[30]
Wenqiang Jin, Srinivasan Murali, Huadi Zhu, and Ming Li. 2021. Periscope: A Keystroke Inference Attack Using Human Coupled Electromagnetic Emanations. In Proc. of the 28th ACM CCS. 700--714.
[31]
John Frank Charles Kingman. 1992. Poisson Processes. Vol. 3. Clarendon Press.
[32]
Serkan Kiranyaz, Turker Ince, Osama Abdeljaber, Onur Avci, and Moncef Gabbouj. 2019. 1-D Convolutional Neural Networks for Signal Processing Applications. In Proc. of the 44th IEEE ICASSP. 8360--8364.
[33]
Mengyuan Li, Yan Meng, Junyi Liu, Haojin Zhu, Xiaohui Liang, Yao Liu, and Na Ruan. 2016. When CSI Meets Public WiFi: Inferring Your Mobile Phone Password via WiFi Signals. In Proc. of the 23rd ACM CCS. 1068--1079.
[34]
Kang Ling, Yuntang Liu, Ke Sun, Wei Wang, Lei Xie, and Qing Gu. 2020. SpiderMon: Towards Using Cell Towers as Illuminating Sources for Keystroke Monitoring. In Proc. of the 39th IEEE INFOCOM. 666--675.
[35]
Jian Liu, Yan Wang, Gorkem Kar, Yingying Chen, Jie Yang, and Marco Gruteser. 2015a. Snooping Keystrokes with mm-level Audio Ranging on a Single Phone. In Proc. of the 21st ACM MobiCom. 142--154.
[36]
Xiangyu Liu, Zhe Zhou, Wenrui Diao, Zhou Li, and Kehuan Zhang. 2015b. When Good Becomes Evil: Keystroke Inference with Smartwatch. In Proc. of the 22nd ACM CCS. 1273--1285.
[37]
Ziwei Liu, Feng Lin, Chao Wang, Yijie Shen, Zhongjie Ba, Li Lu, Wenyao Xu, and Kui Ren. 2023. CamRadar: Hidden Camera Detection Leveraging Amplitude-modulated Sensor Images Embedded in Electromagnetic Emanations. Proc. of the 23rd ACM UbiComp, Vol. 6, 4 (2023), 1--25.
[38]
Li Lu, Jiadi Yu, Yingying Chen, Yanmin Zhu, Xiangyu Xu, Guangtao Xue, and Minglu Li. 2019. KeyListener: Inferring Keystrokes on QWERTY Keyboard of Touch Screen through Acoustic Signals. In Proc. of the 38th IEEE INFOCOM. 775--783.
[39]
Jun Luo, Hangcheng Cao, Hongbo Jiang, Yanbing Yang, and Zhe Chen. 2024. tiny MIMOCrypt: Multi-User Privacy-Preserving Wi-Fi Sensing via MIMO Encryption. In Proc. of the 45th IEEE S&P. 1--19.
[40]
Laurens van der Maaten and Geoffrey Hinton. 2008. Visualizing Data Using t-SNE. Journal of Machine Learning Research, Vol. 9, Nov (2008), 2579--2605.
[41]
Federico Maggi, Alberto Volpatto, Simone Gasparini, Giacomo Boracchi, and Stefano Zanero. 2011. A Fast Eavesdropping Attack against Touchscreens. In Prof. of the 7th IAS. IEEE, 320--325.
[42]
Philip Marquardt, Arunabh Verma, Henry Carter, and Patrick Traynor. 2011. (sp)iPhone: Decoding Vibrations from Nearby Keyboards using Mobile Phone Accelerometers. In Proc. of the 18th ACM CCS. 551--562.
[43]
John V. Monaco. 2018. SoK: Keylogging Side Channels. In Proc. of the 39th IEEE S&P. 211--228.
[44]
Ramon Nitzberg. 1972. Constant-false-alarm-rate Signal Processors for Several Types of Interference. IEEE Trans. Aerospace Electron. Systems 1 (1972), 27--34.
[45]
OnePlus. 2023. OnePlus 10T 5G. https://www.oneplus.com/sg/10t. Online; accessed 10 April 2023.
[46]
Angela Orebaugh, Gilbert Ramirez, and Jay Beale. 2006. Wireshark & Ethereal Network Protocol Analyzer Toolkit. Elsevier.
[47]
Sinno Jialin Pan, Ivor W. Tsang, James T. Kwok, and Qiang Yang. 2010. Domain Adaptation via Transfer Component Analysis. IEEE Transactions on Neural Networks, Vol. 22, 2 (2010), 199--210.
[48]
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. 2019. PyTorch: An Imperative Style, High-Performance Deep Learning Library. arXiv preprint arXiv:1912.01703 (2019).
[49]
Sriram Sami, Sean Rui Xiang Tan, Bangjie Sun, and Jun Han. 2021. LAPD: Hidden Spy Camera Detection Using Smartphone Time-of-flight Sensors. In Proc. of the 19th ACM SenSys. 288--301.
[50]
Samsung. 2023. Samsung Galaxy S20 Series. https://www.samsung.com/sg/news/local/galaxy-s20-launch/. Online; accessed 10 April 2023.
[51]
Matthias Schulz, Daniel Wegemer, and Matthias Hollick. 2017. Nexmon: The C-based Firmware Patching Framework. https://nexmon.org
[52]
Diksha Shukla, Rajesh Kumar, Abdul Serwadda, and Vir V. Phoha. 2014. Beware, Your Hands Reveal Your Secrets!. In Proc. of the 21st ACM CCS. 904--917.
[53]
Paul Staat, Simon Mulzer, Stefan Roth, Veelasha Moonsamy, Markus Heinrichs, Rainer Kronberger, Aydin Sezgin, and Christof Paar. 2022. IRShield: A Countermeasure Against Adversarial Physical-layer Wireless Sensing. In Proc. of the 43rd IEEE S & P. 1705--1721.
[54]
statista. 2023. Average Number of Characters for a Password in the United States in 2021. https://www.statista.com/statistics/1305713/average-character-length-of-a-password-us/. Online; accessed 25 March 2023.
[55]
Gilbert W. Stewart. 1993. On the Early History of the Singular Value Decomposition. SIAM Rev., Vol. 35, 4 (1993), 551--566.
[56]
Jingchao Sun, Xiaocong Jin, Yimin Chen, Jinxue Zhang, Yanchao Zhang, and Rui Zhang. 2016. Visible: Video-assisted Keystroke Inference From Tablet Backside Motion. In Proc. of the 23rd ISOC NDSS.
[57]
Dave Jing Tian, Grant Hernandez, Joseph I Choi, Vanessa Frost, Christie Raules, Patrick Traynor, Hayawardh Vijayakumar, Lee Harrison, Amir Rahmati, Michael Grace, et al. 2018. ATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android Ecosystem. In Proc. of the 27th USENIX Security. 273--290.
[58]
Ajay Tirumala. 1999. iPerf: The TCP/UDP Bandwidth Measurement Tool. http://dast.nlanr.net/Projects/Iperf/ (1999).
[59]
Martin Vuagnoux and Sylvain Pasini. 2009. Compromising Electromagnetic Emanations of Wired and Wireless Keyboards. In Proc. of the 18th USENIX Security, Vol. 8. 1--16.
[60]
Chen Wang, Xiuyuan Zheng, Yingying Chen, and Jie Yang. 2016. Locating Rogue Access Point using Fine-grained Channel Information. IEEE Transactions on Mobile Computing, Vol. 16, 9 (2016), 2560--2573.
[61]
WeChat. 2023. WeChat - Free Messaging and Chatting App. https://www.wechat.com/. Online; accessed 28 March 2023.
[62]
WiKI-Eve. 2023. https://github.com/Nest-Fi/WiKI-Eve. Online; accessed 6 August 2023.
[63]
Tzu-Tsung Wong. 2015. Performance Evaluation of Classification Algorithms by k-fold and Leave-one-out Cross Validation. Pattern Recognition, Vol. 48, 9 (2015), 2839--2846.
[64]
Songyang Wu, Yong Zhang, Xupeng Wang, Xiong Xiong, and Lin Du. 2017. Forensic Analysis of WeChat on Android Smartphones. Digital Investigation, Vol. 21 (2017), 3--10.
[65]
Xiaomi. 2023. Xiaomi 13 Pro. https://www.mi.com/sg/product/xiaomi-13-pro/. Online; accessed 10 April 2023.
[66]
Edwin Yang, Qiuye He, and Song Fang. 2022. WINK: Wireless Inference of Numerical Keystrokes via Zero-Training Spatiotemporal Analysis. In Proc. of the 29th ACM CCS. 3033--3047.
[67]
Yong Yu, Xiaosheng Si, Changhua Hu, and Jianxun Zhang. 2019. A Review of Recurrent Neural Networks: LSTM Cells and Network Architectures. Neural computation, Vol. 31, 7 (2019), 1235--1270.
[68]
Qinggang Yue, Zhen Ling, Xinwen Fu, Benyuan Liu, Kui Ren, and Wei Zhao. 2014a. Blind Recognition of Touched Keys on Mobile Devices. In Proc. of the 21st ACM CCS. 1403--1414.
[69]
Qinggang Yue, Zhen Ling, Xinwen Fu, Benyuan Liu, Wei Yu, and Wei Zhao. 2014b. My Google Glass Sees Your Passwords. Prof. of the Black Hat USA (2014).
[70]
Shujie Zhang, Tianyue Zheng, Hongbo Wang, Zhe Chen, and Jun Luo. 2022. Quantifying the Physical Separability of RF-based Multi-Person Respiration Monitoring via SINR. In Proc. of the 20th ACM SenSys. 47--60.
[71]
Zijian Zhang, Nurilla Avazov, Jiamou Liu, Bakh Khoussainov, Xin Li, Keke Gai, and Liehuang Zhu. 2020. WiPOS: A POS Terminal Password Inference System Based on Wireless Signals. IEEE Internet of Things Journal, Vol. 7, 8 (2020), 7506--7516.
[72]
Man Zhou, Qian Wang, Jingxiao Yang, Qi Li, Feng Xiao, Zhibo Wang, and Xiaofeng Chen. 2018. PatternListener: Cracking Android Pattern Lock using Acoustic Signals. In Proc. of the 25th ACM CCS. 1775--1787.

Cited By

View all

Index Terms

  1. Password-Stealing without Hacking: Wi-Fi Enabled Practical Keystroke Eavesdropping

      Recommendations

      Comments

      Information & Contributors

      Information

      Published In

      cover image ACM Conferences
      CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security
      November 2023
      3722 pages
      ISBN:9798400700507
      DOI:10.1145/3576915
      This work is licensed under a Creative Commons Attribution International 4.0 License.

      Sponsors

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      Published: 21 November 2023

      Check for updates

      Author Tags

      1. beamforming feedback information
      2. keystroke inference attack
      3. password-stealing
      4. wi-fi sensing
      5. wireless security

      Qualifiers

      • Research-article

      Funding Sources

      • Ministry of Education, Singapore
      • National Research Foundation, Singapore and Infocomm Media Development Authority under its Future Communications Research & Development Programme

      Conference

      CCS '23
      Sponsor:

      Acceptance Rates

      Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

      Upcoming Conference

      CCS '25

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • Downloads (Last 12 months)6,722
      • Downloads (Last 6 weeks)3,167
      Reflects downloads up to 28 Dec 2024

      Other Metrics

      Citations

      Cited By

      View all

      View Options

      View options

      PDF

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      Login options

      Media

      Figures

      Other

      Tables

      Share

      Share

      Share this Publication link

      Share on social media