According to researchers from the University of California Irvine (UCI) and two Italian Universities, an attack where keystrokes are recorded during a Skype call and then reassembled as text is possible because of the acoustic emanations of computer keyboards, already a proven privacy issue.

Unlike previous research, which was based on an adversary’s physical proximity to the victim, profiling of the victim’s typing style, and/or victim’s typed information being available to the adversary, the new study proposes a new keyboard acoustic eavesdropping attack, one based on Voice-over-IP (VoIP), or the core technology behind Skype (and many other chat services out there, we might add).

In their paper (PDF), the UCI researchers argue that users typing on their desktop or laptop computer’s keyboard while participating in a Skype call become vulnerable to the demonstrated electronic eavesdropping. The VoIP software acquires acoustic emanations of pressed keystrokes and transmits them to the others involved in the VoIP call, thus creating a vulnerability.

The issue, the researchers argue, is that people often engage into secondary activities while in a VoIP call, and that some of these activities include typing. They also say that Skype conveys enough audio information to reconstruct the victim’s input with an accuracy of 91.7% if the victim’s typing style and keyboard are known (the accuracy drops to 41.89% if they aren’t known).

However, the attack is not possible if the victim uses a touchscreen or a holographic keyboard and keypad. Moreover, the researchers explain that, because Skype is encrypted, an attacker who is not part of the call can’t easily pilfer keystrokes.


Yahoo continues to seek high ground with regard to public reports that last year it scanned user email messages in compliance with a classified government order.

General counsel Ron Bell yesterday sent a letter to Director of National Intelligence James R. Clapper asking the government to confirm Yahoo was ordered to conduct surveillance on the intelligence community’s behalf, as well as declassify the order and publicly clarify the circumstances.

Yahoo’s actions were described in an Oct. 4 Reuters exclusive article that said Yahoo complied with the order by building a specialized system that would scan messages looking for an unknown specific set of characters. The company’s security team found the activity in May 2015 not long after it was deployed, and believed hackers had penetrated the Yahoo network. The Reuters article suggests that CEO Marissa Mayer bypassed the security team, asking engineers to build the system, a situation that led to the resignation of CISO Alex Stamos.

The New York Times, the next day, said that Yahoo had adapted an internal scanner designed to ferret out child pornography and spam to search for a particular “signature” aligned with terrorist organizations. The Times also said that the Justice Department obtained the custom order from the Foreign Intelligence Surveillance Court early in 2015, along with it a gag order preventing Yahoo from disclosing.

 Yesterday’s letter to Clapper is an attempt by Yahoo to maintain openness with its users in defense of their privacy.

“We appreciate the need for confidentiality in certain aspects of investigations involving public safety or national security; however, transparency is critical to ensure accountability and in this context must including disclosing how and under what set of circumstances the U.S. government uses specific legal authorities, including the Foreign Intelligence Surveillance Act, to obtain private information about individuals’ online activities or communications,” Bell wrote. “Citizens in a democracy require such information to understand and debate the appropriateness of such authorities and how the government employs them.”




When the new president takes up residence at 1600 Pennsylvania Ave., cybersecurity will be on the shortlist for action. What's a president to do?

TechNewsWorld asked more than a dozen experts what should be at the top of the new leader of the free world's cyberagenda. Following are some of their responses.

"The president has to set the tone early on cybersecurity -- within the first 100 days -- and say right off the bat that this matters," said Sam Curry, chief product officer at Cybereason.

The first priority should be protecting government systems, he explained.

"New cabinet secretaries have to understand that their mission can't be done without secure systems," said Curry. "Far too often, cybersecurity is not even on the list of priorities for initiatives and agencies and staffing."

All government agencies should be required to adopt a formal assumption of breach framework, recommended Jeffrey Carr, CEO of Taia Global.

"This means that they acknowledge that they are currently in a state of breach," he explained, "and must immediately act to identify and secure their critical assets as well as build in resiliency."


Share the Wealth

Information sharing is another issue that needs executive attention.

Some progress has been made in sharing cyberintelligence between public and private sectors during the current administration, but the next administration should ramp up those efforts, recommended Scott J. White, director of the cybersecurity program at The George Washington University.

"The United States has the largest intelligence-gathering apparatus in the world," he pointed out.

"Who is it gathering that intelligence for? If it's gathering intelligence just for its own internal consumers in government, then we're making a mistake," White continued. "We have to be able to get real-time, threat-based cyberintelligence to the private sector."

Public-private cooperation is important in organizing the nation's cybersecurity efforts, maintained Damien Van Puyvelde, an assistant professor at The University of Texas at El Paso.





I played a board game with my almost-three-year-old daughter a few days ago. Given how much time I spend away from home I tend to be pretty easy to con into just about anything my twins want to do. Bella picked the one with the little pop-up bubble where you press down and the die jumps, and there are pieces that move around the board. I think it was a modern version of Sorry. Remember that from when you were a kid?

My daughter set all the pieces up (which is impressive for an almost-three-year old) and pointed at the bubble when it was my turn to roll the die. Then, the fun started.

As we started playing, I got the sense that these weren’t exactly the rules from the rule book. But since I didn’t have time to read that, and she doesn’t know how to read, I went along with it. The game got more interesting for the next few minutes. I rolled the die, I moved the pieces and she would rearrange them to some other configuration she preferred. She probably watched some of the bigger kids playing by taking turns and moving pieces and decided she would just figure out the rest.

You can safely assume I lost the game. I think.