Mackenzie Jackson: Hello everyone. Welcome back to another episode of The Secure Disclosure. Thrilled to be here with David vonThenen. Thanks so much for agreeing to sitting down with me here in Copenhagen, of all places.
David vonThenen: Yeah, for sure. I know, thanks for having me, and yeah, I'm excited, excited to talk about everything security-related, AI, and all that stuff.
Mackenzie Jackson: So, one of the reasons I reached out to you is you have a fascinating talk here that I want to go into.
David vonThenen: Yeah, definitely. So the talk was on acoustic keystroke logging. The idea is that, traditional keystroke loggers, you install something on an active computer that's running, you're typing away, and you're intercepting the keystrokes as they're happening in some type of log or journal. The idea of this is based purely on the sounds of the clicks on the keyboard using a microphone, you're able to then, using machine learning, classify what letters are being pushed purely based on the signature of the sound.
Mackenzie Jackson: That is crazy. Does it work?
David vonThenen: Yes, it does. It's very fascinating. As I was kind of building this out, it was originally based on a research paper that I had found, and so I kind of built the model training and the inference and everything based on that research paper, and I kind of attacked it from two ways of attacking the problem. The original research paper was using a single keyboard. So this is like one known keyboard where you collect all the sounds, you train the machine learning model to then classify A, B, C, and so on, and that works to 100% accuracy, which is frightening.
Mackenzie Jackson: It is crazy because I can understand the concept behind it. Where I struggle is the noise differences, because on a keyboard you would assume that it has the same mechanical functions. They say that we have a big, mechanical, loud keyboard. I don't know. Are the sounds different differentiators in this case? Is that based on how someone uses a keyboard, how heavily they press buttons, or is it the keyboard itself?
David vonThenen: It's the keyboard itself. So, as you buy a new keyboard, and actually one of the slides in the talk is, in the English language, you press keys at a certain frequency. So E is the most commonly pressed letter in the English language. So those keys have more wear on them, and based on that wear, it's going to have a different acoustic signature than H or L, right? And so basically, the wear and tear on it, you're using the machine learning model then to pick up super subtle nuances in each letter so that it can identify that particular letter.
Mackenzie Jackson: Yeah, that is crazy. And there's so many tech paths that you can think of this, right? Because the old kind of keylogger was you go into an office, you have to put in a USB, the computer has to be unlocked, it has to install something, it has to not be detected, right?
David vonThenen: Right.
Mackenzie Jackson: Now, I don't know, get a job as a cleaner at, I don't know, around the corner, put a pot plant in there with a microphone, and I guess you could continuously train. I mean, the scope here is so like to clarify a little bit. So I did kind of two attempts at it. The first one is you take a single keyboard. So this is like a keyboard that's a well-known keyboard. So the idea is, you're exactly pattern-matching the acoustic signature for just that keyboard. And then the second one was using multiple keyboards, like known keyboards, you then understand the acoustic signatures throughout the keyboards. And interestingly enough, one of the keyboards was done over Zoom. So the signature was recorded. He presses over Zoom on the other side. But these are known keyboards. So another way to say it is if you were to introduce a keyboard that the model has not seen before, the accuracy, I'm probably sure, goes to practically zero. So these are known keyboards, but there are, and in my talk, we discuss, there are actually different types of attacks you can do on one well-known keyboard and multiple. So, as an example, like a one well-known keyboard that's fixed that everyone knows, the example I gave was an ATM PIN as you're typing your PIN.
Mackenzie Jackson: Oh, yeah.
David vonThenen: So there are definitely methods for attacks for both of these types of things.
Mackenzie Jackson: Absolutely. And I think that, you know, you prove the concept first, you know, on a keyboard, but that you can expand it into, I don't know. And if you've ever been to a corporate office, a vibrator is going to corporate. I don't know why, but that's 100%. There are definitely applications for that.
David vonThenen: Yeah. And but when you go into a big corporate setting, there's the same keyboard on everyone's computer, right? So I think that if you prove that it can be done at such high levels of accuracy, then the bridge to kind of get to the right keyboard over time, and train the models on various different keyboards, and even the victims could be training the models if E is the most common character, the model could infer. Okay, this is I'll apply my other knowledge, right? Kind of sounds terrifying.
Mackenzie Jackson: Yeah.
David vonThenen: So, I started with that single keyboard because I was kind of skeptical. I'm like, there's no way this is going to. When I saw it and I ran it again and then again, and I'm like, "Oh my gosh, this is actually real." And then that's when I took a multi-keyboard data set and then was like, "Hey, can I do this for multiple keyboards?" But to your point, if you go into a corporate office, your keyboard is sitting there and multiple people's keyboards, and you could independently, cleaning crew or whatever, after hours can come in, hit every letter on the keyboards, collect the sounds on multiple keyboards, and get fairly accurate results.
Mackenzie Jackson: What this kind of reminded me of when I was first reading this, and I had that moment, I saw your talk, and I was like, no way. You know, when the first people figured out that you could get a 3D model inside someone's house by the Wi-Fi thing, right? The tiny, small changes in Wi-Fi frequencies, we're at this level where the computational capabilities are just so far beyond what we're able to imagine.
David vonThenen: Oh, yeah. That.
Mackenzie Jackson: That you can train new models to do crazy things.
David vonThenen: For sure. And someone had brought up after the session, they were like, "This is super fascinating, what are some other different applications that you've seen of this?" And two things that popped up in my mind were using lasers to point at windows to pick up vibrational frequency for someone inside that is talking. And that's known, documented thing you're able to do. And then the other one was super, super low-tech that was in the 1940s, 50s, where it was a completely offline mechanism for like a listening device. And it was actually rooted in think like CIA espionage. It was a gift that was like a plaque that was mounted on the wall for some state department office, and it was this huge thing that inside had an antenna which basically when someone was talking in the room would cause this antenna that was embedded inside this large wooden plaque, which then would vibrate, and then you pointed a radio signal at it to pick up what was being said in the room. And that went on for decades, and someone discovered it by accident just by using frequencies and radio to listen in.
Mackenzie Jackson: There are so many cool different types of applications for security and listening, and yeah.
David vonThenen: "Cool" is an interesting choice of word.
Mackenzie Jackson: Yeah. Cool and frightening, but it's, you know, from a technical perspective.
David vonThenen: No, it is super cool and super interesting. It is hard to be optimistic about the future of privacy though.
Mackenzie Jackson: Yeah. Are there defenses against this? Like, if we get to this period where this technology is trained on all the keyboards, you know, widespread, are there defense mechanisms that we can do, or do we just need to accept that this is just now part of the risk vector that we live with?
David vonThenen: Yeah. So, part of the talk was how to defend against this. And part of the reason for building the model and having the code out there is for people to come up with ideas to defend against this type of stuff. So, some of the obvious examples are, if you have passwords, use a UB key or some two-factor authentication, some other, you see in spy movies where it's like you're talking to someone, you turn on the radio, or you turn on the water for the shower or the faucet to introduce interference patterns. Maybe there's ways of doing noise cancellation, picking up something as you're typing and then having something, another device emit the inverse of that. So, I'm only theorizing, but I can probably see some practical applications of doing this kind of stuff. It's just put it out there, have people come up with different defenses, aid the curiosity, and let's see what happens, right?
Mackenzie Jackson: I think it's the best strategy is always to put it out there, make it public, because you know that these applications, what's the next area of this? Like, you've obviously done this, you've talked a little bit about the lasers, but what are you kind of looking at next and how we can utilize this new technology of models and machine learning into kind of different applications?
David vonThenen: I'm deeply fascinated in this stuff, like AI, machine learning. And I've given talks about how to disrupt AI, different methods for confusing AI, trick it, and do something to misclassify something so you can get past sensors and filters. You know, with all of this privacy concerns and data collection that's happening and recording everything that you're doing, maybe there are different kind of applications to disrupt, right? So, it's like if you're doing something that's like, "Hey, we're now pinpointing you. You kind of have this affiliation." Maybe there's different ways of, as you're searching for things on the internet, leaving your footprint behind or whatever, to do the inverse of it, to kind of throw them off the track, to, "Hey, like they searched for this and now they're doing the exact opposite of it." Now it's harder for me to classify what you're doing because you're creating interference, almost, right? So it's like those kinds of ideas that for me are super fascinating, right?
Mackenzie Jackson: Yeah. Yeah, that is. It is. It's kind of like a digital version of turning on the faucet.
David vonThenen: Yeah. Exactly. It's just to, you know, machine learning is great for identifying patterns. The more you can have it misidentify, throw in noise, and you know, it's fascinating that you could possibly like undo or do model collapse so that the thing can't classify what you're doing, right?
Mackenzie Jackson: Absolutely. I'm going to briefly interrupt this episode to thank our sponsor of the podcast, Aikido Security. Aikido Security is your complete code to cloud security solution. It secures everything from the first line of code that you write all the way through your supply chain, your dependencies. And of course, Aikido is also a leader in AI pen-testing and AI code auditing. So, make sure you check them out today. You can start for free at aikido.dev. All right, enough about that. Let's get back to the episode. One thing that you said that we kind of brushed over, but I want to bring it back because I've been thinking about it is you mentioned in one of the experiments it happened over Zoom.
David vonThenen: Mhm.
Mackenzie Jackson: So, I guess when people think about doing a theoretical test of this, you can point a very big microphone directly at a keyboard, have the best possible kind of available signatures of the sound, right? But this also works just with someone on a call, right?
David vonThenen: For sure. Yeah. And so, kind of maybe theorizing on different kinds of attacks, if you did go into the office, collected, and trained a machine learning model on a known keyboard, like a co-worker's keyboard. I'm not saying you do this, but I'm just saying like a possible attack mechanism for this is record sounds on a keyboard. And if that keyboard is being used over Zoom, you could still collect that signature and classify what is being typed in a Word document if that microphone happens to be unmuted. So there are, and hopefully your corporation has kind of security in mind, but having it being done remotely saying, "I wasn't in the office on that day. I don't know what you're talking about." You have all your security mechanisms in place. But there's this bad actor who's doing very, very bad things. It just kind of opens the mind of what's possible, right?
Mackenzie Jackson: For sure. And I think that is what made me so interested in this. It's just kind of like I just never would have thought of this application, but it feels so relevant. Yes, of course, there's a relevant application, but also where it goes from here is also very interesting and the next applications, and I think it changes how you need to think about privacy. We actually need to think about interference in addition to good password hygiene, for example.
David vonThenen: Oh, yeah, 100%. And you know, it's in this world where all this data is being collected on us, it's, I think we as individuals need to be aware that this stuff is happening, but then also be hyper-vigilant and maybe even trying to disrupt this kind of stuff just from all these bad actors and even people, corporations or third parties that are trying to use this stuff against us. It's just like to kind of discuss, it's better to be aware, put it out there, and then give people tools to potentially fight back against this stuff, right?
Mackenzie Jackson: Yeah. I want to nerd out a little bit into the actual training that you did in order to be able to do this. You're mentioning you're mentioning that you built out the kind of machine learning models. From a technical point of view, I think when we're talking about AI, you just kind of thought of, "I'm going to send a whole bunch of sounds to Chat, to everything." Some people, you know, like, how did you go about the training process of that? Is it using like a foundational model, or are we in a different area because kind of this isn't a use case for LLMs, I guess.
David vonThenen: Yeah. So, this is not using any kind of foundational model. It's not even using a pre-trained model. So, this is like training of just a machine learning model from scratch. And so, part of the session and the code and everything is literally how to deconstruct the problem. And so, we first talk about collecting the data and getting a data set, and then how do you divide the data set into training data and then validation data and then some data to test against. So, it is literally creating an ML architecture to build out this model, and it's like a code-style architecture where it's like a neural network with like transformers built into it. But it's literally then taking the training data, trying to observe patterns using PyTorch. So that's the framework that I used to train the machine learning model, and build and finding those different subtle nuances in every letter, right? And kind of it starts off with taking wave files, use like in linear 16 format, converting them to spectrographic images, which so you can see frequency over time, and then you have a heat map effectively of what intensity at what particular frequency at what point in time. And you know, you can map out the entire sound, you know, for like the letter A, right? And so, it's literally taking those images and then having the PyTorch framework kind of deconstruct everything to find out, "Oh, here is this thing that makes this uniquely the letter A or B or C." And then that's kind of like effectively how that machine learning model training happens, right?
Mackenzie Jackson: Yeah. No, it's very interesting. And I think it's important to have these conversations because AI just gets lumped into the foundational models now, right? But we need to also be aware that actually there's a whole lot of opportunity that doesn't require melting the entire world power to train them, you know, in specific use cases. And it's interesting to hear kind of the process in actually doing that.
David vonThenen: Yeah, definitely. And there's like, you know, the hype, all this AI hype, which is fantastic. I love playing with foundational models, LLMs, and all that stuff for pinpointing accuracy on something this specific. Some of these normal traditional machine learning models are ideal because of the precision that's required. And so, you can use like traditional ML models to attack a very specific problem, but then feed that data into that LLM and say, "Hey, if I'm trying to classify sounds, if you need to interact with an LLM to break down like give me the result of what this key press is," or like it's used great to have a machine learning model kind of be a foundational source of truth and then have the LLM kind of provide the human interface to talk about a problem or the answer or a solution or whatever, right?
Mackenzie Jackson: Yeah. Your kind of general opinion of where we're heading in AI and security. Do you like, it's fascinating to talk to people at the frontiers of that. Is this type of technology ultimately going to help us or hurt us? Do you, like if you had godlike powers and just from a security point of view, could stop the shenanigans of AI? Would that be beneficial for security, or ultimately do you think we're going to come out on top, more secure on this?
David vonThenen: All of this AI and ML stuff really kind of comes down to the human level, what we want to do as a society. I am very positive. I hope that it's a very positive world. You know, there's AI is being used to come up with new drug treatments and cancer detection and all that stuff. But, you know, the skeptic in me is also very afraid of people using this for very bad things. And, you know, kind of going back to that awareness thing is like, "Hey, there are going to be bad actors out there." I hope that that's not the case, but the reality is there probably are. And so, it's just better to understand, have awareness, kind of create mechanisms to defend against that just in case those bad actors happen to be closer by or whatever, right? But it kind of comes down to what we as a society and individuals, what we want to do with it. And I'm kind of a positive person. I want the drug treatments and the cancers and to elevate everyone. So that's, I'm hoping that's our future.
Mackenzie Jackson: Yeah. It can be this scary thing, but there was a gigantic campaign in the early 20th or late 19th century with fridges came about from the ice kind of mafias which existed and import ice from kind of, you know, their northern Canada, bring them into North America. And there was these campaigns that fridges are dangerous and emit radiation. And this was like, it was actually quite scary to bring in or be into a house with a fridge in it. So, it's kind of like, is AI the fridge as in are we all freaking out about the fridge that's in here? And actually, is it going to be great or is this, you know, or does this actually destroy society? It's kind of going to be one or the other, right?
David vonThenen: And, you know, this is all new stuff, right? And we're kind of all kind of stumbling our way to figure out all this stuff. And I think there's a, it's good to have like a healthy amount of skepticism because it prevents us from doing very stupid things or very harmful things. And so, having that skepticism, I think, is natural. It's healthy. And, you know, when we have that skepticism, we see something that's not being not used in a great way, you know, we have the ability to affect and change that, right?
Mackenzie Jackson: Yeah. Well, look, we're coming to the end of this. It's been a fantastic conversation. I can't wait for it. Yes, you really enjoyed this.
David vonThenen: Thanks.
Mackenzie Jackson: But we always like to play a game on the podcast with the guest just to put you on the spot here. So, the game is called, "Would You Rather?"
David vonThenen: Okay.
Mackenzie Jackson: And what I'm going to do is I'm going to give you two very crappy options.
David vonThenen: Wow.
Mackenzie Jackson: And you have to pick which one you would rather.
David vonThenen: Okay. So, the first one is you get to use complex passwords that are different for everything, but they're all stored in Notepad on your phone, or very complex password, but it's the same for everything. Which would you rather? Um, is the computer offline, so it's not connected to the internet? If that's the case, I might do Notepad.
Mackenzie Jackson: Okay.
David vonThenen: But if, you know, both of them are equally scary and equally horrible. Um, if those, these passwords, I'm assuming are used online on like websites and stuff like that, you know, one compromised situation. Um, if I had to choose, I would have a computer not connected to the internet that's solely dedicated for this Notepad.
Mackenzie Jackson: A Nokia like 3210 in your pocket with your password. That's now your password. That's a little bit of a hack, but I'll accept it. I think that that's, that's...
David vonThenen: Yeah, the security person in me is just cringing at both. That's, yeah, it's pretty scary.
Mackenzie Jackson: Another question here is, storing all of your API keys, your secrets, your credentials in an environment file in a project, but it's in a Git repository that's online, private, but it's there. Or you have an application with zero firewall.
David vonThenen: Oh, wow.
Mackenzie Jackson: So your application has to be perfect in every way or you're getting attacked, right? Or if you get leaked at any point, you're getting compromised completely. Oof. Um, so recently there was a whole bunch of secrets and stuff exposed in GitHub through, you know, MCP endpoints being exposed. And so, you know, that's pretty scary. Um, perfect application with no firewall, you know, there's nothing perfect. Everything can get hacked at some point. The environment file is very scary. Hopefully, it's a once-in-a-lifetime thing. That's a hard one. That's legitimately very hard.
Mackenzie Jackson: My answers on this question are about 50/50.
David vonThenen: Yeah. Um, I might go application.
Mackenzie Jackson: Mhm.
David vonThenen: Only because the potential for collecting all of that stuff in mass could be very horrible. Like having one system compromised could compromise everything. I'm hoping that I'm not important enough for anyone to care about, just have this application sitting there. I might go that just from like security obscurity kind of point of view.
Mackenzie Jackson: For sure. No, I kind of like, it's a hard one. I don't really, I change my opinion based on what the guest says, because they often bring up points. "Oh, that's a good point." Yeah.
David vonThenen: Hopefully, I'm not important enough for anyone to care.
Mackenzie Jackson: All right, last question here. You're building out an entirely new application, and you have two options. One, you use a complete AI coding tool like lovable or Replit where you just cannot enter the code. You've lost all your ability to code.
David vonThenen: Okay.
Mackenzie Jackson: You're just prompting.
David vonThenen: Okay.
Mackenzie Jackson: You can look into it, but you can only fix things via prompts. Or you're writing the application entirely character by character with no help of AI.
David vonThenen: Oh, wow. This is very interesting, because a lot of my coding these days is using AI. I, you know, not using handwritten code anymore. Um, if from a security point of view, and if I had this is something where like my job or well-being was built on top of this, I might go the old route and, you know, handwritten everything. Yeah, coming from an AI person, that's probably scary. But I mean, you know, I think a lot of the problems with coding and AI is that, you know, you don't have a clear understanding unless you're doing something very incrementally, if you're using AI to generate all of your code.
Mackenzie Jackson: Yeah.
David vonThenen: Whereas, you know, if you handwrite everything, you have very deep knowledge about all the internals. If I have enough time to write the handwritten application, I would go with that. Yeah. It is an interesting one because like, yeah, I could understand both, but it's like, I use AI so much now, I don't even know if I can remember how to do.
Mackenzie Jackson: Imagine starting it, like go get in there and then just start from, like, it's crazy.
David vonThenen: Yeah, it depends how big the application is, you know. But if from an understanding, understandability point of view, I'd probably go hand-coded.
Mackenzie Jackson: All right. Well, excellent. Well, look, thanks so much for joining us. It's been a fantastic conversation. I can't wait for it.
David vonThenen: Yes, you really enjoyed this. Thanks.
