When the keyboard sounds too loud: how kbd-audio turns sound into text

Have you ever thought that your mechanical keyboard click is not just a sound, but a potential data leak? The kbd-audio project turns this theoretical threat into a working tool that can guess keystrokes from sound. Let's figure out how it works and why it's needed.

What hides behind acoustic interception

kbd-audio is an open-source toolkit for keyboard sound analysis. The project's main feature is three versions of the Keytap tool, each using different approaches for text recognition:

1. Keytap — requires prior training on recordings from a specific keyboard
2. Keytap2 — uses letter frequency statistics and n-grams in English
3. Keytap3 — fully automated version with improved algorithms

How it works in practice

You can try the technologies right in your browser through the online demo:

• Keytap demo
• Keytap2 challenge
• Keytap3 vulnerability check

For local use, the project offers:

git clone https://github.com/ggerganov/kbd-audio
cd kbd-audio
mkdir build && cd build
cmake ..
make

The main dependencies are SDL2 for audio handling and FFTW3 for Fourier transformation (optional).

The technical details of the project

Under the hood, kbd-audio uses:

• Acoustic signal analysis from the microphone
• Comparison with reference samples (Keytap)
• Statistical language models (Keytap2/3)
• Sound wave visualization for debugging

The view-gui tool lets you see what the "sound fingerprints" of keystrokes look like:

Who might find this useful

1. Security system developers — for testing vulnerabilities
2. Forensic experts — as a digital forensics tool
3. Mechanical keyboard enthusiasts — to check how "noisy" their keyboard is
4. CTF players — as a non-standard analysis tool

As users note:

"This works incredibly well. I hope you realize what you've created" — ffpip

"This attack and Van Eck phreaking are why Edward Snowden, while typing passwords and other sensitive information, would pull a blanket over himself and his laptop" — aarchi

Is it worth trying?

kbd-audio is simultaneously:

• A proof of concept of the vulnerability
• A ready-to-use pentest tool
• An interesting example of signal analysis

If you work in information security or simply enjoy exploring unconventional technologies, this project is worth your attention. Just don't be surprised if after getting acquainted with it, you feel inclined to switch to a membrane keyboard or start typing under a blanket.

P.S. The project's author, Georgi Gerdjikov (ggerganov), is also known for other interesting developments in signal processing and machine learning.