Sensitive numbers play an unparalleled role in identification and authentication. Recent research has revealed plenty of side-channel attacks to infer keystrokes. The common idea is that pressing a key of a keyboard can cause a unique and subtle environmental change, which can be captured and analyzed by the eavesdropper to learn the keystrokes. However, these attacks also require either a training phase or a dictionary to build the relationship between an observed signal disturbance and a keystroke. As acquiring the training data about the victim is often unpractical, this research develops a side-channel attack that does not require training procedures.

This dissertation demonstrates that typing a number creates not only a number of observed disturbances in space (each corresponding to a digit), but also a sequence of periods between each disturbance. Based upon existing work that utilizes inter-keystroke timing to infer keystrokes, we build a novel technique that combines the spatial and time domain information into a spatiotemporal feature of keystroke-disturbed wireless signals. With this spatiotemporal feature, the proposed attack can infer typed numbers without the aid of any training.

Experimental results on top of software-defined radio platforms show that this attack vastly reduces the guesses required for breaking certain 6-digit PINs from 1 million to as low as 16, and can infer over 52% of user-chosen 6-digit PINs with less than 100 attempts. This dissertation also discusses feasible countermeasures that can resist the proposed attack and evaluates them in real-world typing environments.