Peeping Tom in the neighborhood: Keystroke eavesdropping on multi-user systems

Proceedings of the 18th USENIX Security Symposium

Volumn , Issue , 2009, Pages 17-32

  Zhang, Kehuan ^a   Wang, XiaoFeng ^a  

^a INDIANA UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER OPERATING SYSTEMS; HIDDEN MARKOV MODELS; MULTICORE PROGRAMMING; SECURITY SYSTEMS;

LARGE AMOUNTS; MULTI-CORE SYSTEMS; MULTIUSER SYSTEM; PASSWORD CRACKING; PUBLIC INFORMATION; SECURITY IMPLICATIONS; STATISTICAL INFORMATION; TRIGGER SYSTEMS;

APPLICATION PROGRAMS;

EID: 79959957319     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (34)

1. Cryptography/frequency analysis. http://en.wikibooks.org/wiki/Cryptography:Frequency\ analysis, Aug 2006.
2. ASONOV, D., AND AGRAWAL, R. Keyboard acoustic emanations. In IEEE Symposium on Security and Privacy (2004), pp. 3–11.
3. BERGER, Y., WOOL, A., AND YEREDOR, A. Dictionary attacks using keyboard acoustics emanations. In CCS (2006), ACM, pp. 245–254.
4. BERGROTH, L., HAKONEN, H., AND RAITA, T. A survey of longest common subsequence algorithms. In Proceedings of Seventh International Symposium on String Processing and Information Retrieval (2000), pp. 39–48.
5. BRUMLEY, D., AND BONEH, D. Remote timing attacks are practical. In In proceedings of the 12th Usenix Security Symposium (2003).
6. BUCHHOLTZ, M., GILMORE, S. T., HILLSTON, J., AND NIELSON, F. Securing statically-verified communications protocols against timing attacks. Electronic Notes in Theoretical Computer Science 128, 4 (2005), 123–143.
7. DESIGNER, S., AND SONG, D. Passive analysis of ssh (secure shell) traffic. Openwall advisory OW-003, March 2001.
8. DHEM, J. F., KOEUNE, F., LEROUX, P.-A., MESTRE, P., QUISQUATER, J.-J., AND WILLEMS, J.-L. A practical implementation of the timing attack. In Proceedings of CARDIS (1998), pp. 167–182.
9. DISTROWATCH.COM. Top ten distributions: An overview of today’s top distributions. http://distrowatch.com/dwres.php?resource=major, 2008.
10. EDIT VIRTUAL LANGUAGE CENTER. Word frequency lists. http://www.edict.com.hk/textanalyser/wordlists.htm, as of September, 2008.
11. FERRELL, J. procfs: Gone but not forgotten. http://www.freebsd.org/doc/en/articles/linux-users/procfs.html, 2009.
12. FRANCOIS, M. J., AND PAUL, H. J. Automatic word recognition based on second-order hidden markov models. In ICSLP (1994), pp. 247–250.
13. HOGYE, M. A., HUGHES, C. T., SARFATY, J. M., AND WOLF, J. D. Analysis of the feasibility of keystroke timing attacks over ssh connections. Technical Report CS588, School of Engineering and Applied Science, University of Virginia, December 2001.
14. INC., R. Process directories. http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/ en-US/ReferenceGuide/s2-proc-processdirs. html, 2007.
15. JONES, N. C., AND PEVZNER, P. A. An Introduction to Bioinformatics Algorithms. the MIT Press, August 2004.
16. JOYCE, R., AND GUPTA, G. Identity authorization based on keystroke latencies. Communications of the ACM 33, 2 (1990), 168–176.
17. KOCHER, P., JAE, J., AND JUN, B. Differential power analysis. In Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology (1999), Springer-Verlag, pp. 388–397.
18. LEECH, G., RAYSON, P., AND WILSON, A. Word frequencies in written and spoken english: based on the british national corpus. http://www.comp.lancs.ac.uk/ucrel/bncfreq.
19. LOSCOCCO, P., AND SMALLEY, S. procfs analysis. http://www.nsa.gov/SeLinux/papers/slinux/node57.html, February 2001.
20. LUK, C. K., COHN, R., MUTH, R., PATIL, H., KLAUSER, A., LOWNEY, G., WALLACE, S., REDDI, V. J., AND HAZELWOOD, K. Pin: building customized program analysis tools with dynamic instrumentation. In PLDI’05: Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation (2005), pp. 190–200.
21. MONROSE, F., AND RUBIN, A. Authentication via keystroke dynamics. In Proceedings of the 4th ACM conference on Computer and communications security (1997), ACM Press, pp. 48–56.
22. PETERSSON, J. What is linux-gate.so.1? http://www.trilithium.com/johan/2005/08/linux-gate/, as of September, 2008.
23. PROVOS, N. Systrace - interactive policy generation for system calls. http://www.citi.umich.edu/u/provos/systrace/, 2006.
24. RABINER, L. R. A tutorial on hidden markov models and selected applications in speech recognition. Proceedings of the IEEE 77, 2 (1989), 257–286.
25. SECURITY, S. C. Timing analysis is not a real-life threat to ssh secure shell users. http://www.ssh.com/company/news/2001/english/all/article/204/, November 2001.
26. SONG, D. X., WAGNER, D., AND TIAN, X. Timing analysis of keystrokes and timing attacks on ssh. In USENIX Security Symposium (2001), USENIX Association.
27. SOURCEFORGE.NET. http://sourceforge.net/projects/strace/, August 2008.
28. TEAM, G. http://www.gtk.org, as of September, 2008.
29. TEAM, P. Pax address space layout randomization (aslr). http://pax.grsecurity.net/docs/aslr.txt,March 2003.
30. TEAM, P. http://pax.grsecurity.net/, as of September, 2008.
31. TROSTLE, J. Timing attacks against trusted path. In IEEE Symposium on Security and Privacy (1998).
32. TSAFRIR, D., ETSION, Y., AND FEITELSON, D. G. Secretly monopolizing the cpu without superuser privileges. In Proceedings of 16th USENIX Security Symposium (Berkeley, CA, USA, 2007), USENIX Association, pp. 1–18.
33. ZHANG, L., ZHOU, F., AND TYGAR, J. D. Keyboard acoustic emanations revisited. In CCS’05: ACM Conference on Computer and Communications Security (2005), ACM Press, pp. 373–382.
34. ZHOU, Y., AND FENG, D. Side-channel attacks: Ten years after its publication and the impacts on cryptographic module security testing. csrc.nist.gov/groups/STM/cmvp/documents/fips140-3/physec/papers/physecpaper19.pdf, December 2005.