RE: unix entropy source can be used for keystroke timing attacks

["Schmehl, Paul L" <pauls () utdallas edu>]

> -----Original Message-----
> From: Michal Zalewski [mailto:lcamtuf () ghettot org] 
> Sent: Thursday, August 14, 2003 6:04 PM
> To: vulnwatch () vulnwatch org; bugtraq () securityfocus com
> Cc: full-disclosure () netsys com
> Subject: [Full-disclosure] unix entropy source can be used 
> for keystroke timing attacks
>
> Another bizarre vulnerability, for your amusement...
Indeed.  Where do you come up with this stuff?

> Several unix systems systems provide a secure entropy source 
> maintained by collecting certain information that is supposed 
> to be practically unpredictable (such as interrupt timings, 
> keyboard scancodes or device request times), then running it 
> thru one-way hashing function (SHA1 or MD5).
>
> A device called /dev/random estimates the amount of entropy 
> available in the entropy pool, and blocks on read when the 
> pool gets empty. This continues until the buffer is seeded 
> with some new data due to one of the events mentioned.

When I read this, I immediately thought of some work that I did back in
the 60's.  Without giving too much away, it is possible to monitor sound
patterns in such a way that you can *uniquely* identify moving objects.
(Think of looking for unique "noise" frequencies in the full spectrum of
random noise, such as the sound of a motor.)

The corollary is that you could uniquely monitor /dev/random access to
do the same thing.  All you need is something that records all the
"traffic" and then analyzes it for patterns.   Controlled research would
identify what each pattern signified, and within a reasonable amount of
time you might even be able to identify machine operators simply by the
pattern of their keystrokes.  From there, capturing *what* their typing
is a matter of relative ease.

Very interesting indeed.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html