KeyPrint: Practical Black-box Keystroke Inference Attacks to Mobile Devices

Recent years have shown substantial interest in revealing vulnerability issues of keystroke privacy on smartphones and tablets. While significant prior works have leveraged different techniques to compromise the keystroke security of these mobile devices, existing methods are typically executed on the basic assumption of white-box scenarios where the adversary possesses prior knowledge of the victim's device and usage behavior, or they are conducted within a pre-set trap attack environment. These limitations undermine the practicality and real-world applicability of the proposed methods. In this paper, we present KeyPrint, a practical black-box keystroke inference attack system for mobile devices, without requiring any prior knowledge of the victims and attack scenarios. The primary innovation of KeyPrint is the ability to leverage both on-device acoustic source and attenuation path disparities in device medium to create the fingerprint of keystroke position. To enable their differentiation, we design a theoretical model to represent the keystroke position with the keystroke-induced sonic effect (KiSe) captured by built-in microphones. We also propose a novel approach to mitigate the impact of ambient noise and detect keystroke events, which improves KeyPrint's wide-adaptability. Finally, we propose using machine learning to cluster KiSe samples and infer keystroke content from unlabelled clustering results. We implemented KeyPrint on commercial smartphones/tablets and evaluate the prototypes in typical indoor and outdoor scenarios using different mobile devices. Experiments results demonstrate that KeyPrint can achieve an average accuracy of 55% and 70% for inference on keystroke content when the number of inputted words only reaches 30 and 40, respectively. Leveraging the spatial correlation between numeric and letter keys within the virtual keyboard, KeyPrint effectively reduces the search space for PINs from 10 digits to 10 candidates, with a probability of 63.9%.