Covert channels can be used to circumvent system and network policies by establishing communications that have not been considered in the design of the computing system. We construct a covert channel between different computing systems that utilizes audio modulation demodulation to exchange data between the computing systems over the air medium. The underlying network stack is based on a communication system that was originally designed for robust underwater communication. We adapt the communication system to implement covert and stealthy communications by utilizing the ultrasonic frequency range. We further demonstrate how the scenario of covert acoustical communication over the air medium can be extended to multi-hop communications and even to wireless mesh networks. A covert acoustical mesh network can be conceived as a meshed botnet or malnet that is accessible via inaudible audio transmissions. Different applications of covert acoustical mesh networks are presented, including the use for remote keylogging over multiple hops. It is shown that the concept of a covert acoustical mesh network renders many conventional security concepts useless, as acoustical communications are usually not considered. Finally, countermeasures against covert acoustical mesh networks are discussed, including the use of lowpass filtering in computing systems and a host-based intrusion detection system for analyzing audio input and output in order to detect any irregularities.
@cite_15: 
@cite_26: Eavesdropping on electronic communication is usually prevented by using cryptography-based mechanisms. However, these mechanisms do not prevent one from obtaining private information through side channels, such as the electromagnetic emissions of monitors or the sound produced by keyboards. While extracting the same information by watching somebody typing on a keyboard might seem to be an easy task, it becomes extremely challenging if it has to be automated. However, an automated tool is needed in the case of long-lasting surveillance procedures or long user activity, as a human being is able to reconstruct only a few characters per minute. This paper presents a novel approach to automatically recovering the text being typed on a keyboard, based solely on a video of the user typing. As part of the approach, we developed a number of novel techniques for motion tracking, sentence reconstruction, and error correction. The approach has been implemented in a tool, called ClearShot, which has been tested in a number of realistic settings where it was able to reconstruct a substantial part of the typed information.
@cite_4: We take a closer look at keyboard acoustic emanations specifically for the purpose of eavesdropping over random passwords. In this scenario, dictionary and HMM language models are not applicable; the attacker can only utilize the raw acoustic information which has been recorded. We investigate several existing signal processing techniques for our purpose, and introduce a novel technique -- time-frequency decoding -- that improves the detection accuracy compared to previous techniques. We also carefully examine the effect of typing style -- a crucial variable largely ignored by prior research -- on the detection accuracy. Our results show that using the same typing style (hunt and peck) for both training and decoding the data, the best case success rate for detecting correctly the typed key is 64 per character. The results also show that changing the typing style, to touch typing, during the decoding stage reduces the success rate, but using the time-frequency technique, we can still achieve a success rate of around 40 per character. Our work takes the keyboard acoustic attack one step further, bringing it closer to a full-fledged vulnerability under realistic scenarios (different typing styles and random passwords). Our results suggest that while the performance of these attacks degrades under such conditions, it is still possible, utilizing the time-frequency technique, to considerably reduce the exhaustive search complexity of retrieving a random password.
@cite_39: Side channel attacks exploit implementation-specific information leakage to defeat cryptographic measures, usually designed to provide confidentiality. The majority of published attacks require physical possession or network access to the target device, and as such are not suitable for implementation by an attacker wishing to carry out a remote, passive and undetectable attack. Surveillance techniques can be applied to compromising emanations, which is effectively side channel leakage from devices handling the sensitive, and protected, information desired by the attacker. By monitoring compromising emanations from devices processing data in plaintext, such as computer monitors and keyboards, an attacker can completely bypass the protection offered by cryptographic primitives. Published work on these emanations focusses on three main sources; electromagnetic radiation, visual representations of the data, and acoustic signals. This project aims to review the literature on techniques exploiting these emanations, and place them in the context of real world attacks, potentially undertaken by a variety of individuals and organisations. Current and future technological developments of sensors and consumer electronics will also be discussed in relation to their applicability to these attacks, identifying possible directions in which they might develop in the future.
For eavesdropping on a computer user's keystrokes by using a computers's physical emanations, several techniques have been proposed. Halevi and Saxena @cite_4 present a study on acoustical emanations from keyboards where the keyboard input is recovered from the sound of a keystroke. Raguram, White, Goswami, Monrose and Frahm @cite_15 discuss a setup where typed input is recovered from environmental reflections, while Frankland @cite_39 describes information leakage over keyboard LEDs that are manipulated to carry an optical signal. Moreover, Balzarotti, Cova and Vigna @cite_26 show that keystrokes can be automatically captured by recording the keyboard with a camera and analyzing the video stream. We also gather keystrokes from a computer user, but we record the keystrokes directly on the infected victim (i.e., the user's computer) where a malware prototype needs to be placed in preparation of an attack. This malware prototype contains both a keylogger software and a network stack for covert acoustic communication in order to spread the recorded keystrokes over the covert network.