Skip to main content

ClickLeak: Keystroke Leaks in Cyber-Physical Social Networks through Multimodal Sensors


In both the virtual and real worlds, social situations exist where large-scale data collecting might jeopardize consumers' privacy. While there is a lot of focus on virtual social contexts [1], [2], it is crucial to remember that physical public settings are also influenced by information leakage privacy concerns. The essential idea is the border separating actual social settings and virtual social networks is gradually blurring. Cyber-physical social networks [3], [4] are the names given to these emerging systems. The concern of privacy and user data acquisition without consent or awareness has become more relevant as a result of this network overlap. Such data collecting may be carried out not just by service providers, but also by malicious individuals who have unrestricted access to the environment.

Restaurants, malls, and other areas where people are in close proximity to one another with no apparent communication limits are prominent examples of public social situations. In both virtual and physical worlds, the use of technology to acquire enormous amounts of data about consumers is fairly similar. Tracking users' whereabouts in online systems using sessions and cookies is similar to tracking people's locations at restaurants or malls using their smart phones. The amount of time spent reading a certain profile or liking a photo on social media is comparable to perusing merchandise in a store or conversing with other specific people, all of which may be traced via Wi-Fi signals.

This paper offers ClickLeak, a keystroke inference method that allows attackers to infer keystrokes from Wi-Fi signals when victims enter their credit or debit card pin codes at the point of sale. The idea for ClickLeak came from the observation that typing different keys results in distinct hand and finger movements.The ClickLeak System is seen in this graphic. Multipath Wi-Fi signals are subjected to various distortions as a result of these motions. Furthermore, the distinctive Wi-Fi signal aberrations can be used to detect keystrokes. To infer keystrokes, we use the fine-grained characteristic Channel State Information (CSI), which is acquired from incoming Wi-Fi signals. Furthermore, by combining the microphone and accelerometer data, which are induced synchronously as the finger touches the key, the keystroke signal segments may be calculated.

ClickLeak uses a cell phone as a sender in close proximity to the POS and a laptop as a receiver. The sender sends Wi-Fi signals indefinitely, and the receiver collects them. When cardholders type pin codes on the POS next to their phone, ClickLeak uses a variant of CSI to infer keystrokes. Three fundamental technical hurdles must be overcome in order to realize the promise of the keystroke recognition scheme in a real system. 1) Because the keystroke motion is too subtle to detect unique CSI variations, a reliable signal analysis approach is required to appropriately distinguish keystrokes. 2) Because ClickLeak obtains CSI values from the receiver in real time, the movement of entering pin codes is quick. As a result, rather of evaluating the entire CSI time series, the starting and ending times of key presses are required. 3) The mean of keystroke segmentation should be utilized to obtain the starting and ending points in the CSI time series for each keystroke when obtaining CSI time series of keystrokes.

The following are the primary contributions of this paper:

  • We show how an attacker can compromise a victim's information by abusing virtual social networks that rely on physical interactions between members to build trust and proximity.
  • We present ClickLeak, a context-based system that uses a smartphone and laptop receiver to extract CSI values and profile keyboard patterns.
  • We present a strategy for selecting subcarriers that are highly linked with keystrokes, and we demonstrate that this method improves keystroke recognition accuracy.
  • To develop classifiers, we employ the critical phase feature of CSI time series and combine the CSI amplitude and phase waveforms. This enhances the system's performance and accuracy.

The virtual network domain has spilled over into the realm of social networks. There are a variety of augmented reality and cyber-physical applications available that allow virtual social networks and physical social circles to collide. This overlapping raises serious privacy concerns, since the attacker may be able to collect information from victims without raising suspicion due to the close physical contact. In this paper, we look at a vulnerability that allows an attacker to collect PIN codes from users by using close proximity.Using Wi-Fi CSI time series, the system uses commodity hardware to infer keystrokes. We pick the sub-carriers that are closely connected with keyboard movements before PCA-based dimension reduction and adding the phase characteristic of CSI time series, as opposed to existing Wi-Fi signal based keystroke recognition algorithms. We also use the microphone and accelerometer sensors to figure out when victims enter pin codes during a vulnerable time window. Experimentation in a social situation demonstrates the system's usefulness. The accuracy of key identification is greater than 83 percent. With a larger network and more users, the system's accuracy improves dramatically.

Scroll to Continue

Related Articles