The Doctors discuss a new threat in cyberspace, the “Thermanator”! Researchers at University California Irvine determined hackers may be able to steal your passwords without ever seeing you type it. They can do this by using a thermal camera that tracks where your fingers hit the keyboard.
Professor of computer science Dr. Gene Tsudik and his student and co-author of the “Thermanator study,” Tyler Kaczmarek, join The Doctors to discuss their study’s findings.
Tyler explains humans are warm-blooded, and the keyboards they hit are typically cold. Anytime the hands touch something colder than they are, heat will transfer from the hands to keyboard. If just a password is typed, using a thermal camera you can see hot regions corresponding to the keys that are hit. While the order of the keys typed can’t necessarily be found by just looking at the letters, hackers may be able to figure out the password using anagram/word jumblers online.
Tyler demonstrates as plastic surgeon Dr. Andrew Ordon types in his password and after a few minutes, they easily figured it out! (Wondering what it is? Check out the video below.)
Dr. Tsudik explains these hackers are not necessarily strangers but more likely people who are in your work environment who may be able to quickly snap a photo of your keyboard. He says people often will type in their passwords and then walk away while their computers reboot.
Dermatologist Dr. Sonia Batra notes this is less likely to happen with a laptop because the battery beneath the keyboard will keep it warm. Dr. Tsudik says this is correct, however, if you are just turning on the laptop and it is cold, this type of attack can still happen. The best protection against this is to use chaff typing, where after typing a password you type arbitrary keys or, to just swipe your hand across the keyboard after password entry.
Tyler says these thermal cameras, which are specialized tools, are getting more sophisticated and also smaller in size. While the technology is not yet high quality enough for an attack like this, Tyler says there are thermal cameras that can even plug into a smartphone. ER physician Dr. Travis Stork shares his concern that this could happen at ATMs, but luckily, most ATMs are metallic (unlike most computer keyboards which are plastic) so they absorb heat faster and lose these thermal markers quickly.