The researchers from Georgia Tech have done this by using a smartphone accelerometer - the internal device that detects when and how the phone is tilted - to sense keyboard vibrations and decipher complete sentences with up to 80 per cent accuracy. The procedure is not easy, they say, but is definitely possible with the latest generations of smartphones.
"We first tried our experiments with an iPhone 3GS, and the results were difficult to read," said Patrick Traynor of Georgia Tech. "But then we tried an iPhone 4, which has an added gyroscope to clean up the accelerometer noise, and the results were much better. We believe that most smartphones made in the last two years are sophisticated enough to do this attack."
How it works
The technique works through probability and by detecting pairs of keystrokes, rather than individual keys (which still is too difficult to accomplish reliably, Traynor said).
It models "keyboard events" in pairs, then determines whether the pair of keys pressed is on the left versus right side of the keyboard, and whether they are close together or far apart. After the system has determined this for each pair of keys depressed, it compares the results with a dictionary. The technique only works reliably on words with more than three letters with an accuracy as high as 80 per cent.
How to fight the hack
"The way we see this attack working is that you, the phone's owner, would request or be asked to download an innocuous-looking application, which doesn't ask you for the use of any suspicious phone sensors," said Henry Carter, one of the study's co-authors . "Then the keyboarddetection malware is turned on, and the next time you place your phone next to the keyboard , it starts listening."
Mitigation strategies for this vulnerability are pretty simple and straightforward, Traynor said. First, since the study found an effective range of just three inches from a keyboard, phone users can simply leave their phones in their purses or pockets, or just move them further away from the keyboard.
