My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging
  Side-Channel Attack
  Wearables that constantly collect various sensor data of their users increase
the chances for inferences of unintentional and sensitive information such as
passwords typed on a physical keyboard. We take a thorough look at the
potential of using electromyographic (EMG) data, a sensor modality which is new
to the market but has lately gained attention in the context of wearables for
augmented reality (AR), for a keylogging side-channel attack. Our approach is
based on neural networks for a between-subject attack in a realistic scenario
using the Myo Armband to collect the sensor data. In our approach, the EMG data
has proven to be the most prominent source of information compared to the
accelerometer and gyroscope, increasing the keystroke detection performance.
For our end-to-end approach on raw data, we report a mean balanced accuracy of
about 76 % for the keystroke detection and a mean top-3 key accuracy of about
32 % on 52 classes for the key identification on passwords of varying
strengths. We have created an extensive dataset including more than 310 000
keystrokes recorded from 37 volunteers, which is available as open access along
with the source code used to create the given results.
