Researchers from the University of Padua, Italy, and the University of California, Irvine, successfully guessed what users typed based on the sounds of keystrokes during a Skype conversation.
The idea behind this attack, called Skype & Type (S&T), is that people using Skype voice or video calls often continue to work in other applications while they are on a Skype call.
Because most keyboards are quite loud, the sounds are transmitted through the computer's microphone to the other party, who can easily record them and extract them from the background noise.
The research team says that a machine learning algorithm can be created that will be able to categorize each keystroke based on similar characteristics. The algorithm will detect the user's typing style and then accurately guess what they are about to type.
"Specifically, our results demonstrate that, given some knowledge of the victim's typing style and keyboard, the attacker achieves a top-5 accuracy of 91.7% in guessing a random key pressed by the victim," the researchers say.
"The accuracy drops to a not-so-reassuring 41.89% if the attacker ignores both the typing style and basic keyboard information," the researchers add.
Furthermore, the research team reports that the S&T attack is reliable, even when the bandwidth measurements of the Internet fluctuate or when people are talking and covering the sound of the keystroke.
Previously, researchers have demonstrated that they can record keystroke sounds and guess which keys the user is pressing with very high accuracy, using microphones placed near the user's computer.
The Skype & Type attack opens the door for a new vector of security breach, via VoIP audio and video calls. Technically, the attack could be ported to any other service that features high-fidelity audio and video calls.
