# Keystroke Detection by Exploiting Unintended RF Emission from Repaired USB Keyboards

## TL;DR

This paper demonstrates that RF emissions from repaired USB keyboards can be exploited over long distances to detect keystrokes with high accuracy, revealing a new hardware-based side-channel vulnerability.

## Contribution

It introduces a novel long-range keystroke detection method exploiting unintended RF emissions from repaired USB keyboards, surpassing previous distance limitations.

## Key findings

- Achieved ~100% keystroke detection accuracy up to 12 meters.
- Repaired cables emit detectable RF signals over long distances.
- Multi-layer shielding can mitigate the emission-based vulnerability.

## Abstract

Electronic devices and cables inadvertently emit RF emissions as a byproduct of signal processing and/or transmission. Labeled as electromagnetic emanations, they form an EM side-channel for data leakage. Previously, it was believed that such leakage could be contained within a facility since they are weak signals with a short transmission range. However, in the preliminary version of this work [1], we found that the traditional cable repairing process forms a tiny monopole antenna that helps emanations transmit over a long range. Experimentation with three types of cables revealed that emanations from repaired cables remain detectable even at >4 m and can penetrate a 14 cm thick concrete wall. In this extended version, we show that such emanation can be exploited at a long distance for information extraction by detecting keystrokes typed on a repaired USB keyboard. By collecting data for 70 different keystrokes at different distances from the target in 3 diverse environments (open space, a corridor outside an office room, and outside a building) and developing an efficient detection algorithm, ~100% keystroke detection accuracy has been achieved up to 12 m distance, which is the highest reported accuracy at such a long range for USB keyboards in the literature. The effect of two experimental factors, interference and human-body coupling, has been investigated thoroughly. Along with exploring the vulnerability, multi-layer external metal shielding during the repairing process as a possible remedy has been explored. This work exposes a new attack surface caused by hardware modification, its exploitation, and potential countermeasures.