A team of\u00a0university researchers\u00a0in China and Singapore have discovered a new attack method called \u201cWiKI-Eve\u201d, which allows the theft of Wi-Fi passwords through keystroke eavesdropping without the need for hacking.<\/p>\n
The WiKI-Eve attack intercepts the cleartext transmissions of smartphones that connect to modern Wi-Fi routers and deduces individual numeric keystrokes, thus detecting the password.<\/p>\n
This attack only works on numerical passwords. According to the security researchers who have discovered this threat, the WiKI-Eve has an accuracy rate of up to 90%, allowing numerical passwords to be stolen.<\/p>\n
WiKI-Eve exploits a new feature, BFI (beamforming feedback information), which debuted in Wi-Fi 5 (802.11ac) in 2013. BFI allows Wi-Fi devices to send feedback about their position to routers so that they can improve their signal accuracy to that location.<\/p>\n
However, the drawback is that BFI sends information from a smartphone to an access point (AP) in clear text, which can easily be intercepted and collected by any other Wi-Fi devices in monitor mode without the need for hardware hacking or cracking an encryption key.<\/p>\n
The WiKI-Eve attack is devised to intercept Wi-Fi signals during password entry in real time. The attacker needs to identify the target using an identity indicator, such as a MAC address, which can be done by monitoring network traffic and correlating it with the user\u2019s behavior.<\/p>\n
After this, while the victim is actively using the smartphone, the attacker intercepts the victim\u2019s BFI time series during password entry using a monitoring tool and launches the WiKi-Eve attack. Each keystroke impacts the Wi-Fi antennas, creating a unique Wi-Fi signal that can be analyzed.<\/p>\n
To conduct an extensive evaluation of WiKI-Eve, researchers tested the method on various smartphone models and in different environments and got impressive results. They found that the WiKI-Eve attack can decipher 6-digit numerical passwords with an accuracy of 85% in less than 100 attempts. However, the success rate of password inference accuracy decreases by about 23% when the distance between the attacker and the access point increases from 1m to 10m.<\/p>\n
The researchers also found that WiKI-Eve achieved a keystroke classification accuracy of 88.9% for individual keystrokes and up to 65.8% top-10 accuracy for stealing passwords of mobile applications (e.g., WeChat).<\/p>\n
In order to protect yourself from a possible WiKI-Eve attack, the researchers have suggested potential solutions such as keyboard randomization, signal obfuscation, encryption of data traffic, CSI scrambling, Wi-Fi channel scrambling, and more.<\/p>\n","protected":false},"excerpt":{"rendered":"
A team of\u00a0university researchers\u00a0in China and Singapore have discovered a new attack method called \u201cWiKI-Eve\u201d, which allows the theft of Wi-Fi passwords through keystroke eavesdropping without the need for hacking. The WiKI-Eve attack intercepts the cleartext transmissions of smartphones that connect to modern Wi-Fi routers and deduces individual numeric keystrokes, thus detecting the password. This […]<\/p>\n","protected":false},"author":20,"featured_media":117411,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48520,15,3],"tags":[14023,2280,3928,6832,690,1303,1068,62402],"class_list":{"0":"post-117400","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security","8":"category-hacking","9":"category-security-and-hacking-news","10":"tag-2g-network","11":"tag-network","12":"tag-passwords","13":"tag-routers","14":"tag-security","15":"tag-wi-fi","16":"tag-wifi","17":"tag-wiki-eve"},"yoast_head":"\n