1(630)802-8605 Ravi.das@bn-inc.net

In the working world, there is one truism, that no employee should ever take advantage of:  There is no such thing as worker privacy.  Meaning, whatever you say, and especially type on your computer keyboard can come under the close scrutinization of your manager.

In fact, you could even be watched by a covertly placed CCTV camera, and not even know about it (this is very much used of course in retail settings – maybe not so much in office type of environment).

By law, your workplace is your employer’s playground  – you have to abide by their rules and policies.  You may like it, hate it, but the bottom line, is you have very little rights when it comes to privacy in the workplace.  By law, the employer has most of the upper hand.  In fact, I have written an entire article about this, which can be seen here:

https://resources.infosecinstitute.com/10-things-employers-need-to-know-about-workplace-privacy-laws/

The reason I bring this up is that, as I have just described, one of the most common and covert ways that an employer can keep track on what you are doing is by installing keylogging software on your workstation at the office, on your laptop, or even on your company issued wireless device.

The keys that you type on day in and day out are being recorded, and sent in a separate file to your manager, either via a download or in e-mail.

There are plenty of keylogging software packages on the market, and there are a bulk of them are even free to use.  But now, there could be a newer method coming down the road in which your boss can keep tabs on your keyboard activity.  And in fact, this could even be used by a Cyber attacker as well.

This new technique is known as the “Thermanator” approach.  In other words, your keystrokes can be recorded based upon the heat signatures left by your fingers.

Here is how this whole thing works:

  • The employee (or victim) must first use a typical keyboard to enter any series of keystrokes, such as their username/password combination;
  • This employee (or victim) must then be distracted away from their computer or wireless device, either willingly (such as being called into a meeting with a co worker) or through an accomplice directly luring them away (such as in the case of a Cyber attack);
  • While the employee (or victim) is not present, a camera capable of thermal imaging — and set up before the employee (or victim) is lured away — must rapidly take a set of images to record the thermal residue present on the keyboard before it dissipates.

In the laboratory tests that have conducted so far, Cyber researchers collected and analyzed thermal residues left behind from 31 participants.  They keyed in 10 different types of passwords.  These passwords were deemed to be both “strong” and “weak”, on 4 different types of keyboards.

After this initial key entry, the keystrokes could be collected in just a matter of 30 seconds or less, but if just a partial series of keystrokes were collected, then this took a minute, or even longer.  It is then analyzed from a “Heat Map”, which is illustrated below:

(SOURCE:  https://www.zdnet.com/article/this-attack-steals-your-passwords-by-reading-keyboard-heat/)

The Cyber researchers discovered an interesting finding:  Those individuals that use just two fingers for key entry (also known as the “hunt and peck” typists) are much prone to being a victim rather than those who use both hands.  They did not elaborate on the reason why for this, but my suspicion is that when using a two finger method, more time is spent in actually trying to find the keys.

As a result, this leaves a much more distinctive pattern that can recognized versus the two hand typing approach.  With the latter, much less time is actually spent in finding the actual keys, thus, leaving much more randomness in the typing patterns.

You may be asking at this point:  What exactly causes this thermal difference? According to scientists, since humans are traditionally warm blooded creatures, we prefer to be in environments that are cooler or even colder than our internal body temperature.  Thus, this heat difference, and since most of us use keyboards every day in our jobs, is left behind on the keypad.

My thoughts on this?  As the Cyber researchers have even admitted themselves, this type of covert surveillance (on part of the employee) or Cyber attack is not even close to being imminent yet.  It still is being researched into, but the potential does exist that this can happen.  That is what is important!!!

The full study can be downloaded here at this link:

https://arxiv.org/pdf/1806.10189.pdf

Also, it is important to remember, that trying to record the heat patterns from a series of keys required manual intervention at this point, as it was described earlier. Meaning, the employee or the victim has to be called away from their device in order for the samples to be collected.  Will the day come when this is not required?

The Cyber researchers have eluded to this, but my guess is yes, that this could very well happen.  Technology advances at a pace to which we are really never aware of, so that is why I think that it could really become a distinct possibility.

Also, as it was described, a special thermal imaging camera has to be literally placed right next to the keyboard, in close proximity in order to get a good gauge on the heat images left behind on the keyboard.  Obviously at this point, this cannot be covertly done, but who knows, maybe the next generation of computer keyboards will have such a camera mounted onto them?  After all, nobody ever imagined that Facial Recognition or even Iris Recognition could be implemented into a Smartphone.