Et Tu, MacBook? 通过内置 IMU 侧信道进行无特权击键推断与上下文分析
Et Tu, MacBook? Unprivileged Keystroke Inference and Context Profiling via the Built-in IMU Side Channel
查看机构详情
- Tianjin University（天津大学）
- National University of Singapore（新加坡国立大学）
- Tsinghua University（清华大学）
机构由 AI 辅助整理，请以论文原文为准。
浏览论文内容
中文总结 AI 辅助
本研究揭示苹果 MacBook 内置 IMU 可被无特权访问，形成侧信道，据此提出 BRUTUS 攻击，实现高精度击键推断、用户识别与环境分析，强调需严格管控 IMU 访问权限。
中文摘要 AI 辅助
近几代苹果 MacBook 在其一体式机箱内嵌入了惯性测量单元（IMU），用于设备方向与运动感知。然而，该 IMU 不仅捕获预期的设备级信息，还无意中捕获了用户交互及周围环境产生的细微物理振动。这些信号构成了一种新颖且此前未被探索的侧信道。我们发现了一个漏洞，允许通过 IOKit 驱动程序以非 root 权限访问 IMU 数据，同时还有两个无内容系统元数据接口（HIDIdleTime 和 CGEventSource）进一步丰富了侧信道泄漏。通过对 IMU 数据的严格表征，我们揭示泄漏涵盖三个核心维度：（1）击键身份（按下了哪个键），（2）桌面表面（笔记本电脑放置的位置），以及（3）用户行为（谁在打字）。利用这些发现，我们提出了 BRUTUS，这是首个针对苹果 MacBook 内置 IMU 传感器的全面无特权侧信道攻击。BRUTUS 在按键恢复中实现了 89.1% 至 97.5% 的字符级准确率。此外，借助语言模型，它能够以 100% 的准确率成功重建某些句子。对于用户识别和环境分析，BRUTUS 无需标签即可正确发现用户和环境配置文件，并正确地将后续片段分配到相应的配置文件中。最终，这项工作凸显了严格规范对内置 IMU 传感器访问的紧迫必要性。
英文摘要
Recent generations of Apple MacBooks embed an inertial measurement unit (IMU) within their unibody chassis for device orientation and motion sensing. However, this IMU inadvertently captures not only intended device-level information but also subtle physical vibrations from user interactions and the surrounding environment. These signals establish a novel, previously unexplored side channel. We uncover a vulnerability allowing non-root access to IMU data via an IOKit driver, alongside two content-free system metadata interfaces (HIDIdleTime and CGEventSource) that further enrich the side-channel leakage. Through rigorous characterization of the IMU data, we reveal that the leakage spans three core dimensions: (1) keystroke identity (which key is typed), (2) desk surface (where the laptop is placed), and (3) user behavior (who is typing). Leveraging these findings, we introduce BRUTUS, the first comprehensive unprivileged side-channel attack targeting built-in IMU sensors on Apple MacBooks. BRUTUS achieves a character-level accuracy of 89.1% to 97.5% in key recovery. Furthermore, aided by language models, it can successfully reconstruct certain sentences with 100% accuracy. For user identification and environment profiling, BRUTUS correctly discovers user and environment profiles without labels and correctly assigns subsequent segments to their corresponding profiles. Ultimately, this work highlights the urgent necessity of strictly regulating access to built-in IMU sensors.
