Identification of Pressed Keys by Acoustic Transfer Function

The possibility of uncovering the sequence of pressed keys in a PIN-pad, ATM or other device with mechanical keyboard that processes sensitive information is a serious security threat. In this paper, we show that the Acoustic Transfer Function (ATF) of the device carries information that discloses the pressed key. To demonstrate this hypothesis, we glued two microphones in empty spaces of two different PIN-pads, collected the acoustic emission generated by the keystrokes and estimated the transfer functions of the system through the two acquired audio signals. A simple classification scheme using the ATFs yielded 99.6% of recognition accuracy in one device and 46% in the other. The results show that there are devices that can be easily attacked using ATF and those that are more difficult to attack using this technique. We analyzed again the data where we obtained 99.6% of accuracy, this time using the traditional frequency spectrum based technique, obtaining only 52% of recognition rate. The results also show that the certification process has failed in identifying this vulnerability.