ClickLeak: Keystroke Leaks Through Multimodal Sensors in Cyber-Physical Social Networks

Public social environments are hot beds of security leaks, either they are virtual or physical. The nature of social settings allows numerous people to co-exist in the same space. This close un-bounded proximity opens up the possibility of privacy compromise in such environments. In this paper, we explore a novel and practical multi-modal side-channel keystroke recognition system, named ClickLeak, which can infer the PIN code/password entered on numeric keypad by using the commodity Wi-Fi devices. Such numeric keypads are commonly available in many public social environments. ClickLeak is built on the observation that each key input makes unique pattern of hand and finger movements, and this generates unique distortions to multi-path Wi-Fi signals. Acceleration and microphone sensors of smart phones determine the starting and ending time of keystrokes, while the time series of channel state information are analyzed to determine the keystrokes. The evaluation results have shown that with large scale data collections from public social settings, the key recognition accuracy can reach higher than 83%.