不要Skype和类型！IP语音中的声发射丢弃
Don't Skype & Type! Acoustic Eavesdropping in Voice-Over-IP
摘要：
计算机键盘的声音辐射代表了严重的隐私问题。正如在先前的工作中所展示的那样，声音的物理特性可能会揭示用户正在键入的内容。然而，以前的攻击假设相对较强的对手模型，这在许多现实世界中并不实用。这些强有力的模型假设：（i）对手与受害者的物理接近度，（ii）受害者的打字风格和键盘的精确轮廓，和/或（iii）对手可获得的大量受害者的键入信息（及其对应的声音）。本文提出并探讨了一种新的键盘声窃听攻击，涉及IP语音（VoIP），称为Skype &类型（S&T），同时避免了先前的强大对手的假设。这项工作的动机是简单的观察，人们经常从事次要活动（包括打字），而参与VoIP呼叫。正如预期的那样，VoIP软件获取并忠实地传输所有声音，包括按下按钮的声音，其中可能包括密码和其他敏感信息。我们表明，一个非常流行的VoIP软件（Skype）传达了足够的音频信息，以重建受害者的输入-在远程键盘上键入的语音。我们的研究结果表明，在受害者的打字风格和键盘模型的一些知识，攻击者达到前5名的准确率为91.7%，猜测一个随机键按下的受害者。此外，我们证明了S&T对各种VoIP问题（例如，互联网带宽波动和语音的存在），从而证实了这种攻击的可行性。最后，它适用于其他流行的VoIP软件，如谷歌环聊。
英文摘要：
Acoustic emanations of computer keyboards represent a serious privacy issue. As demonstrated in prior work, physical properties of keystroke sounds might reveal what a user is typing. However, previous attacks assumed relatively strong adversary models that are not very practical in many real-world settings. Such strong models assume: (i) adversary's physical proximity to the victim, (ii) precise profiling of the victim's typing style and keyboard, and/or (iii) significant amount of victim's typed information (and its corresponding sounds) available to the adversary. This paper presents and explores a new keyboard acoustic eavesdropping attack that involves Voice-over-IP (VoIP), called Skype & Type (S&T), while avoiding prior strong adversary assumptions. This work is motivated by the simple observation that people often engage in secondary activities (including typing) while participating in VoIP calls. As expected, VoIP software acquires and faithfully transmits all sounds, including emanations of pressed keystrokes, which can include passwords and other sensitive information. We show that one very popular VoIP software (Skype) conveys enough audio information to reconstruct the victim's input -- keystrokes typed on the remote keyboard. Our results demonstrate that, given some knowledge on the victim's typing style and keyboard model, the attacker attains top-5 accuracy of 91.7% in guessing a random key pressed by the victim. Furthermore, we demonstrate that S&T is robust to various VoIP issues (e.g., Internet bandwidth fluctuations and presence of voice over keystrokes), thus confirming feasibility of this attack. Finally, it applies to other popular VoIP software, such as Google Hangouts.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
