Malboard: Now Hackers Can Make Use Of Our Keystrokes To Hack

Saanvi Araav - Jun 13, 2019

We could use keystrokes to verify ourselves, but those verification systems could be fooled easily with Malboard.

3.2 Billion Email And Password Pairs Have Been Leaked, Here's How To Check If You Are Affected
Watch This Man Hack 26 iPhones At The Same Time Without Even Touching Them
China Attacked Indian Satellite Systems Several Times In The Last Decade

Recently, researchers have developed a new type of cyber attack that is capable of mimicking the identity of the user via their keystrokes. Unfortunately, the continuous evolution and the high level of sophistication of cyber attacks recently lead to the reality where antivirus products base on signature are not enough anymore.

Behavioral patterns based verification system

0 0xs3rh8 Njvbptdf — These days, a multi-layered solution for personal security (include those 2FA) is becoming more and more commonplace to reduce our dependency on just the passwords.

We have also look into using behavioral patterns (like mouse movements or keystrokes) to verify our identity. However, researchers from Ben-Gurion University of the Negev (BGU) said, this is not foolproof.

This Wednesday, the BGU's team announced that they have successfully developed a new type of cyber attack - Malboard. This new attack could evade all of those detection products on the market that use keystroke characteristics to verify the identity of the user.

How they did it?

In an online publication, the BGU's team pointed out how the hacker could use a fooled keyboard to send, generate malicious keystrokes that mimic the user.

The researchers used keyboards from Dell, Lenovo, and Microsoft for their research. The goal was to trick DuckHunt, TypingDNA, and KeyTrac ( authentication systems base on behavioral patterns). These software use machine learning and algorithms base on AI to verify our accounts with our keystrokes. Still, people could use those same algorithms to fool them.

Screenshot 2019 06 05 At 10 10 41 — From 83% to 100% of the tests, DuckHunt, TypingDNA, and KeyTrac were fooled.

The team at BGU gathered the data to develop Malboard from the result from 3 keystroke tests of 30 participants. Then, they fed this data to the underlying AI algorithms and database of the attack, which will mimic the keystrokes of the participants to go against the authentication systems. From 83% to 100% of the tests, DuckHunt, TypingDNA, and KeyTrac were fooled.

Doctor Nir Nissim of BGU said that Malboard would be useful in 2 scenarios: remote attacks by hackers remotely, or inside attackers who are capable of launching Malboard on the internal system's keyboard.

The paper of the team also suggests using detection modules to improve the verification system base on the keyboard, including keystroke sounds, detection of typographical errors, and monitoring power consumption.