Menu

password

Attackers Can Figure Out Your Password by Listening to Keystrokes

Attackers Can Figure Out Your Password by Listening to Keystrokes

/ /

Hackers are constantly developing new ways to access private data, and it can be tough to keep up-to-date with the latest cybersecurity threats emerging.

One of the most worrying new trends in recent times is AI. Criminals now use artificial intelligence to collect user data and steal private information.

While many of us are worried about what a hacker sees, we must also be mindful of what they hear. New research has shown that criminals can hear what keystrokes you are pressing to find out what you’re typing. This can lead to passwords and sensitive information being exposed.

This article explains how this process works and, most importantly, how to keep your passwords and personal information safe.

How can you hear a password? Through keystrokes

Keystrokes are essentially the buttons you press on a keyboard. They’ve always been highly sought-after by hackers because knowing what keys are used helps crack passwords, login details, credit card numbers, and other sensitive information.

One method of extracting this information is listening to you typing on a keyboard. Hackers intercept microphones and nearby recording devices, record your typing patterns, and analyze the audio.

As scary as this may seem, it isn’t necessarily a new phenomenon. In 2017, for example, researchers were already experimenting with how the sound of keystrokes could, in theory, help spy on people’s activity online.

These early prototypes had many weaknesses. Firstly, they struggled with eliminating background noise and clicking sounds, making it hard to isolate keystrokes. Additionally, they took a long time to piece together large chunks of information, making them an unattractive hacking method.

But recent advances in AI technology have changed everything.

Recording and analyzing keystroke audio is more reliable and quicker to crack than ever. New research from British universities has revealed how machine-learning algorithms have created a system of identifying which keys are typed with incredible accuracy.

The team developed the research around different recording devices and found that certain devices provided more accurate results. For example, when trained using a mobile phone recording of keystrokes, the algorithm proved 95% successful.

When trained on recordings through Zoom, which used keystroke sounds together with what the user was typing in chats, it was 93% successful.

In this day of remote working, this research is quite scary. It can mean that recording devices like your mobile phone, which might sit idly beside you during your workday, can be a major vulnerability to your cybersecurity.

Equally, “off-the-shelf” equipment like webcams and headsets, many of which have built-in microphones, can be exploited to extract the content of your typing, even

when not in use.

5 ways to protect yourself and your data

Thankfully, you are not defenseless against this type of cyber criminality. Despite emerging AI technology, malware protection tools and software can help protect you and your data from prying eyes and ears.

Below are five simple ways of protecting yourself:

1.    Virus scanning

Whether you’ve recently clicked on a bad link or pop-up and want peace of mind as you browse the internet, high-quality antivirus software is essential to keeping your data safe.

Not only does it offer protection in real-time as you type, but you can also scan downloads for viruses, restrict access to unsecured websites, and perform regular checks to ensure nothing is on your system that compromises your microphone’s security.

2.    Permissions

Apps and programs regularly need permission to use your microphones and

webcams. For example, it makes sense for your browser to request microphone use if you click into a Zoom meeting.

However, it might be a red flag if you’re doing something else and a program randomly wants the use of your microphone. You should regularly check to see what apps are requesting the use of your devices and when, as it might be an attempt by someone to listen to your typing.

3.    Password protection

A strong password is an essential part of cybersecurity. Tips to strengthen passwords include using a variety of upper and lowercase letters, numbers, and symbols. Basically, the longer the password, the harder it is for hackers to crack.

Also, avoid using personal information or phrases, and never use the same password for multiple services. Some of the best malware protection software comes with password management features, which encrypt passwords and populate them

into fields so you don’t have to type them.

4.    Two-factor authentication (2FA)


Two-factor authentication is an effective way of ensuring only you have access to your account. When logging into a service, you must verify your identity a second time – usually with a single-use code sent via email or text.

This means that even if your keystrokes are being logged, the hacker cannot do much, as they won’t have access to the verification code to log in with.

5.    When not in use – mute or disconnect

Finally, another easy way to limit the chance of criminals listening to your keystrokes is to deny them the opportunity in the first place. If you’re not using your webcam, microphone, or other devices, disconnect them from your PC, or ensure they’re powered off fully. If you’re on a group Zoom or Skype call, be vigilant in muting your microphone each time you’ve finished speaking to hide any sound from your keystrokes. You can also place your mobile phone far from the workspace, ensuring it won’t pick up any

Cyber Security Threats and Defense

Cyber Security Threats and Defense

/ /

Security Threats to network are an emergent problem for the individual as well as organizations in the whole world, and the security threats become worse and multiply day by day. Computer networks are necessary for everyday activities and both Individuals and organizations depend on their computers and networks.

Intrusion to these computers by an illegal person can result in a network breakdown and loss of data and work. Attacks on a network can be disturbing, resulting in a loss of time and money due to damage or theft of significant information.

The Intruders can enter the network through software vulnerabilities, guessing someone’s username and password, and hardware attacks. An intruder is an individual, commonly called a hacker or software, that enters a computer without authorization. When an intruder (hacker) successfully gains access to the network, four types of security threats may happen:-

Loss of Data and manipulation

When a hacker successfully enters someone’s computer, he destroys or alters data records. Examples include sending a virus reforming a computer’s hard drive and breaking into a records system to change information.

Information Theft

In this case, an intruder accessed the computer and obtained confidential information. The intruder used this information for different purposes and also sold it.

Identity Theft

The individual usually obtains the personal document on their personal computer.  The intruder stole this personal information. Using this information, an intruder can get legal documents, make an unauthorized purchase, and apply for credit.

Disruption of service

If the intruder can’t get in, he tries to ensure that no one else can. This is the Dos (denial-of-service attack). This kind of security threat does not try to get information directly. Depending on which service crashes under the load, its effect can expose other previously protected resources.

Physical Security Threats

Physical security is another crucial aspect of network security. The elements of physical security must be dealt with in the organizational policy. Physical security threats have four classes:

  • Hardware security threats– this is a security threat related to hardware. It damages network devices, servers, and workstations.
  • Electrical threats—This threat concerns the input voltage. The voltage may be insufficient, spike, unconditioned, or loss of power.
  • Maintenance threats—This threat concerns poor handling of electrical components, poor cabling and labeling, and a lack of spare parts.
  • Environmental threats—Environmental threats are also significant. Temperatures that are too hot or cold and humidity that are too wet or dry are ecological threats.

To Limit the physical damage to equipment, make a security plan as follows:-

  • Lockup equipment
  • Prevent unauthorized access
  • Maintain electronic logs of entry and exits
  • Use security cameras

The figure below illustrates a general floor plan for a secure computer room for a network.

Defence plan from security threats

Defense Against Threats

In defending against network attacks, there are four sets of tools that will help you keep your network secure against unauthorized access, monitoring, and network attacks: management, firewall, encryption, and endpoint security.

Management

Management is the primary defense against network attacks. The following actions should be implemented in configuration management against network attacks.

Backup, Upgrade, Update, and Patch

The machines in the network should be running up-to-date because the latest update can provide more effective defence against network attacks. Whenever new malware is released, the operating systems need the latest update with the latest antivirus software. The best way to keep up-to-date against network attacks is to download security updates and patches from the operating system vendor.

The management needs to create a central patch server for critical security patches. All other systems must have access from time to time. Any required security patches not installed on a host are automatically downloaded from the server and installed automatically for user intrusion.

Backup is essential when defending against network attacks. Each computer should have the latest copy of the backup.  All configuration files in your Operating Systems or Applications should have enough security.

Authentication, Authorization, and Accounting

Authentication, authorization, and accounting (AAA) network security services provide primary access control on a network device. AAA authenticates and controls access to a network; it also controls the users’ what they can do while they are logged in.

Passwords

The password is very important to protect network devices against attacks. It is important to use strong passwords rather than the default password or an easy password. For passwords, implementation follows the below steps.

  • Use a complex password, including uppercase letters, lowercase letters, numbers, symbols, and spaces, only if allowed.
  • Use a minimum of 8 characters password, preferably 10 or more characters.
  • Do not use common dictionary words for the password.
  • Avoid passwords based on repetition, number sequences, letter sequences, usernames, relative or pet names, and misspell words.
  • Do not use biographical information, such as birthdates, ID numbers, ancestor names, or other easily identifiable information.
  • Change passwords often.
  • Do not write passwords down and leave them in precise places.
  • Following are examples of passwords

Weak Password

  • Amrick
  • Michel
  • Yasir
  • Nokia
  • Khan1975
  • 1234567

Strong Password

  • P@12>fo<ur^1978
  • No ^^&34@fsc^hub

On Cisco routers and switches, leading spaces are ignored for passwords, but spaces after the first character are part of the passwords. The passphrase is a password that uses the space bar to create a phrase of many words. The passphrase is also a strong password.

Firewalls

A firewall is the most efficient security tool for protecting users from network attacks. The firewalls exist in between two or more networks, controlling traffic and preventing unauthorized access between them. End systems also use a personal firewall. The following are different techniques that use a firewall for filtering:

  • URL filtering prevents or allows access to websites using Keywords or URLs. Packet filtering uses a MAC address or IP address to prevent or allow access.
  • Application filtering – Prevents or allows access by specific application types.
  • State full packet inspection (SPI) – Incoming packets must be valid responses from internal hosts. Voluntary packets are blocked unless permitted particularly. SPI also recognizes and filters specific types of attacks.

Encryption

The administrator can use encryption as a defense against network attacks. It can give protection against eavesdropping as well as sniffer attacks. Internet Protocol Security (IPSec), Private Key Infrastructure (PKI),  and Virtual Private Networks (VPN) can also secure a network against attacks.

Endpoint Security

Individual computer (host) system or device that acts as a network client, common endpoints are laptops, desktops, servers, smartphones, and tablets. Securing and preventing these devices from a network attack is the most challenging task for a network administrator.

Securing endpoints must have well-documented policies, and the employees must be aware of these rules. The employees must be trained for proper using the network. The policies also include the use of antivirus software and host intrusion prevention.