An attacker may not need to crack your device’s screen or watch what you type directly in order to access sensitive information; the sound of keyboard clicks can carry more details than it seems.

A recent study showed that analyzing sounds produced by pressing keys could be used to predict what a user is typing, including passwords and sensitive texts.

According to a report published on the Tom’s Hardware website, researchers from the University of Augusta relied on a technique known as side channel attack. This technique involves recording the sounds produced by pressing keys, analyzing their acoustic characteristics, and then attempting to link each click to the key that generated it.

During tests, the system was able to identify keystrokes with an overall success rate of about 43%. This percentage does not mean that a complete password can be extracted once the sound of the keyboard is recorded, but it reveals that acoustic signals can provide attackers with analyzable information, especially when a larger number of samples are collected.

Doesn’t need professional microphone

One of the most concerning aspects of the study is that the experiment was not limited to an ideal environment or advanced recording devices. The researchers tested the method in the presence of ambient noise, with different types of keyboards, and even using low-quality microphones. Moreover, the system’s success was not linked to a specific typing style.

This means that the microphone built into a smartphone or laptop could, in theory, be sufficient to capture the required signals if the right conditions are met.

How can keys be identified?

The process starts with recording a number of keystrokes and then analyzing the characteristics of each sound, such as its intensity, duration, and the nuances between clicks. The system then attempts to match these patterns with potential keys.

It doesn't stop at analyzing the sound alone; dictionaries and language models can be used to predict the most likely words, which may help narrow down possibilities when audio data is incomplete.

These findings build on previous research that demonstrated the potential of using keyboard sounds to deduce pressed keys. However, this new study focuses on testing the idea in conditions closer to everyday use, with varying keyboards and background noise.

The risk depends on the circumstances

However, it doesn't mean that anyone can record a few seconds of keyboard sound and immediately read the victim's password. The effectiveness of the attack is influenced by the quality of the recording, distance from the device, type of keyboard, typing speed, and ambient noise levels.

The research also discusses scenarios where malware or computer-connected devices could access audio data, opening the door to more complex attacks.

Researchers believe that reducing the noise from a keyboard can limit the signals available to an attacker, while certain typing patterns and variations may make it harder to distinguish between clicks.

Interestingly, in future work, researchers plan to leverage large language models (LLMs) to improve text recognition accuracy. This reveals an unfamiliar aspect of the cybersecurity race: a sound that seems like mere background noise could become, with the help of AI, a source of information that should remain confidential.