Keystroke Detection by Exploiting Unintended RF Emission from Repaired USB Keyboards

2025-08-24

AI Summary

This study uncovers a novel electromagnetic (EM) side-channel attack surface arising from USB keyboard repairs: inadvertent formation of a monopole antenna during repair significantly amplifies RF emissions, enabling remote keystroke capture at distances up to 12 meters—even through concrete walls. To characterize this threat, the authors collect EM leakage signals from 70 distinct keypresses across three environments—open space, corridor, and outdoor—and propose an efficient detection algorithm integrating EM side-channel analysis for long-range keystroke identification. Experimental results demonstrate up to 100% recognition accuracy under interference-free conditions, with a maximum effective range of 12 meters—the longest reported distance for USB keyboard EM leakage exploitation. Crucially, this work provides the first empirical evidence that cable repair can deliberately engineer an effective radiating structure, thereby expanding the intersection of hardware tampering and side-channel attacks.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Cognitive Modeling & Cognitive Systems: Neural Spike Coding
• Data Mining & Knowledge Management: Knowledge Acquisition from the Web

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Electronic devices and cables inadvertently emit RF emissions as a byproduct of signal processing and/or transmission. Labeled as electromagnetic emanations, they form an EM side-channel for data leakage. Previously, it was believed that such leakage could be contained within a facility since they are weak signals with a short transmission range. However, in the preliminary version of this work [1], we found that the traditional cable repairing process forms a tiny monopole antenna that helps emanations transmit over a long range. Experimentation with three types of cables revealed that emanations from repaired cables remain detectable even at >4 m and can penetrate a 14 cm thick concrete wall. In this extended version, we show that such emanation can be exploited at a long distance for information extraction by detecting keystrokes typed on a repaired USB keyboard. By collecting data for 70 different keystrokes at different distances from the target in 3 diverse environments (open space, a corridor outside an office room, and outside a building) and developing an efficient detection algorithm, ~100% keystroke detection accuracy has been achieved up to 12 m distance, which is the highest reported accuracy at such a long range for USB keyboards in the literature. The effect of two experimental factors, interference and human-body coupling, has been investigated thoroughly. Along with exploring the vulnerability, multi-layer external metal shielding during the repairing process as a possible remedy has been explored. This work exposes a new attack surface caused by hardware modification, its exploitation, and potential countermeasures.

Problem

• Detecting keystrokes via RF emissions from repaired USB keyboards
• Analyzing long-range data leakage through unintended electromagnetic emanations
• Investigating vulnerabilities and countermeasures for hardware-modified keyboard security

Innovation

• Exploiting RF emissions from repaired USB keyboards
• Long-distance keystroke detection algorithm development
• Investigating interference and human-body coupling effects