Et Tu, MacBook? Unprivileged Keystroke Inference and Context Profiling via the Built-in IMU Side Channel
Unprivileged access to MacBook motion sensors can infer keystrokes with up to 97.5 percent accuracy.
The paper shows that inertial sensors in recent Apple MacBooks leak typing vibrations through an unprivileged IOKit interface, supplemented by HIDIdleTime and CGEventSource metadata. Their attack, BRUTUS, infers which key was pressed, the desk surface, and who is typing. Character recovery reaches 89.1% to 97.5%, and language-model assistance reconstructed some sentences at 100% accuracy. The authors say access to built-in IMU sensors should be strictly regulated.
- Unprivileged IOKit access exposes MacBook IMU vibration data.
- BRUTUS recovers characters with 89.1% to 97.5% accuracy.
- Language models reconstructed some sentences at 100% accuracy.
- The same signals profile the typist and desk surface.
- Authors urge stricter controls on built-in IMU access.
From the original article
1 min read at arxiv.orgRecent generations of Apple MacBooks embed an inertial measurement unit (IMU) within their unibody chassis for device orientation and motion sensing. However, this IMU inadvertently captures not only intended device-level information but also subtle physical vibrations from user interactions and the surrounding environment. These signals establish a novel, previously unexplored side channel.
By Jiaji He · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.