Identification of pressed keys by time difference of arrivals of mechanical vibrations

We identify the pressed keys of commercial PIN-pads by monitoring the arrival times of mechanical vibrations.We correctly classify the pressed key with 96.4% of accuracy.The certification processes does not address this new side-channel attack.We explain what are the design flaws responsible for this vulnerability. The possibility of finding the sequence of pressed keys in a mechanical keyboard is a serious security threat. In our previous work, we have shown that it is possible to identify, with high probability, the pressed key by analyzing the vibration generated by the keystrokes. At that time, we did not know the physical phenomenon responsible for leaking information as mechanical vibration. In this paper, we show that the TDOA (Time Difference of Arrivals) of the mechanical waves is the main culprit for leaking information. To demonstrate this hypothesis, we glued three accelerometers in a PIN-pad, collected the vibrations generated by the keystrokes and computed the relative delays of vibration arrival times in pairs of accelerometers. We show that it is possible to estimate the positions of the keys through simple difference of the delays. A simple classification scheme using the delays yielded 96.4% of recognition success rate. The same technique can be used to attack devices with touch-sensitive screen, identifying the region touched.