GhostType: The Limits of Using Contactless Electromagnetic Interference to Inject Phantom Keys into Analog Circuits of Keyboards

GhostType: The Limits of Using Contactless Electromagnetic Interference to Inject Phantom Keys into Analog Circuits of Keyboards

Speakers: Qinhong Jiang

Conference: NDSS Symposium

YouTube: (no public video)

Overview

In a groundbreaking presentation at NDSS 2024, Qinhong Jiang unveiled "GhostType," a novel attack demonstrating the pervasive vulnerability of modern keyboards to contactless electromagnetic interference (EMI). This research, conducted by a collaborative team from Zhejiang University, the University of Michigan, and Northeastern University, challenges the fundamental assumption of trust in keyboard keystroke sensing mechanisms. Unlike traditional keyboard security threats like keylogging or BadUSB attacks, GhostType exploits vulnerabilities in the analog circuits of unaltered, legitimate keyboards, allowing adversaries to inject "phantom keys" without any physical contact or modification to the device.

The implications of GhostType are profound, extending far beyond typical consumer use cases. Keyboards are integral to critical infrastructure, including medical systems, industrial control, military operations, and ATMs. The ability for an adversary to remotely manipulate these devices—whether to block legitimate inputs (Denial-of-Service, DoS), inject random keystrokes to disrupt systems, or execute targeted commands such as deleting files or initiating system shutdowns—represents a severe and previously unaddressed threat vector. This research sheds light on a new class of vulnerabilities that necessitate a fundamental re-evaluation of keyboard security design, particularly in high-stakes environments where untrusted inputs could lead to catastrophic outcomes.

GhostType represents the first signal integrity analysis of keyboard sensing mechanisms, providing a comprehensive theoretical framework and extensive empirical validation across 50 commercial keyboards. The findings reveal that nearly all tested devices are susceptible, highlighting a widespread design flaw. Furthermore, the discovery of "hidden keys"—non-existent key intersections within the matrix circuit that can still be triggered—adds another layer of concern, enabling unexpected and potentially devastating system manipulations. This work not only exposes a critical blind spot in current cybersecurity defenses but also offers concrete insights for developing robust hardware and software countermeasures.

Background

[▶ Watch: Introducing GhostType: contactless phantom key injection vulnerability (0:00)]()

The security of input devices, particularly keyboards, has historically focused on two primary areas: keylogging and malicious device injection. Keylogging involves eavesdropping on typed keystrokes through various side channels, such as acoustic, electromagnetic, or even physical emanations. Countermeasures for these often involve securing the physical environment or employing robust encryption. The second major threat, exemplified by BadUSB attacks, involves reprogramming USB devices to masquerade as malicious keyboards, injecting arbitrary commands. These are typically mitigated by device authentication mechanisms and strict control over peripheral connections.

However, GhostType addresses a more fundamental and largely unexplored gap: the inherent security of the keyboard's underlying keystroke sensing mechanisms themselves, independent of transmission protocols like USB or Bluetooth. The typical keyboard workflow involves three steps: keystroke sensing, scancode transmission, and task execution. The core of keystroke sensing lies in the matrix circuit, a grid-like array of scanning lines (TXs) and receiving lines (RXs). Each key corresponds to an intersection with a switch. When a key is pressed, it closes a circuit, causing the corresponding RX line to drop to a logical-low state. The keyboard processor then uses a Schmitt Trigger at its input GPIO, with defined high (VIH) and low (VIL) threshold voltages, to detect this change and register a keypress. Keyboards also incorporate mechanisms like debounce to prevent spurious keystrokes and anti-ghosting (NKRO) to handle simultaneous keypresses.

The threat model for GhostType assumes a remote adversary operating without physical access to the keyboard's hardware or software. This adversary's goal is to contactlessly inject keystrokes using intentional EMI, either to perform a Denial-of-Service (DoS) attack by blocking legitimate inputs or to inject random or targeted keystrokes to manipulate the connected computer. The adversary might possess prior knowledge of the target keyboard's model, enabling pre-assessment through reverse engineering of a similar device. The attack setup involves hiding EMI injection equipment, such as an antenna and signal generator, under a desk or at a distance, controlled remotely, making detection challenging.

Key Findings

[▶ Watch: Keyboard architecture, security gaps, and adversary threat model (2:00)]()

The GhostType research uncovered several critical vulnerabilities and phenomena that collectively demonstrate the feasibility and widespread nature of contactless keystroke injection via EMI:

1. Lack of Signal Authenticity Verification: Through detailed signal integrity analysis, the research revealed that keyboard processors generally do not verify the authenticity of received scanning signals. This was confirmed by successful wired keystroke injection, where a simple negative pulse signal matching the keyboard's own scanning characteristics, if its amplitude dropped the RX voltage below VIL and its period aligned with the scanning cycle (Tin = Ts/k), was sufficient to register a keypress. This fundamental oversight allows for external manipulation.

1. Matrix Circuit as EM Coupling Paths: Disassembly and analysis of 15 off-the-shelf membrane keyboards showed dense, irregular traces on the multi-layered plastic matrix circuit boards. A frequency sweep test (10 MHz to 100 MHz) using an antenna under a Cherry KC1000 keyboard confirmed that these exposed traces act as potential EM coupling paths. This allowed for random keystroke injection and even keyboard blocking at specific frequencies (e.g., 30, 50, 60, 70, 80 MHz for injection, 20, 90, 100 MHz for blocking), proving that EMI can directly influence the analog sensing mechanism.

1. Discovery of Hidden Keys: A striking discovery was the ability to inject keys that do not exist on the keyboard's physical layout, termed hidden keys. This phenomenon occurs because the keyboard matrix circuit (Mp) often has more key intersections than physical switches (Mk). The keyboard processor's firmware, likely due to cost-effectiveness or oversight, fails to remove these non-existent keys from its processing logic. Examples of injected hidden keys included function keys for opening file browsers, controlling media playback, or even debug ASCII codes like 171 or 255. On one numeric-only keypad, researchers found 44 hidden keys, including alphabetical and control keys, which could be exploited for system manipulation, such as shutting down a computer.

1. Widespread Vulnerability: An extensive assessment of 50 off-the-shelf keyboards and keypads from 20 popular brands (40 membrane, 10 mechanical; 35 USB, 15 Bluetooth) revealed a startling prevalence of these vulnerabilities. 48 out of 50 keyboards were found to be vulnerable to GhostType attacks. The only two unsusceptible keyboards were found to have steel plates underneath their matrix circuits, acting as effective EMI shielding, thus providing a crucial insight for countermeasures.

1. Effective DoS and Keystroke Injection: The research demonstrated the practical feasibility of both Denial-of-Service (DoS) attacks and targeted keystroke injection. DoS attacks achieved nearly a 100% success rate on 36 of the 48 vulnerable keyboards, blocking user input across a wide range of frequencies and amplitudes. Keystroke injection was successful on 39 of the 48 vulnerable keyboards, achieving exceptionally high speeds, often exceeding 10,000 Actions per Minute (APM), with a peak of 22,939 APM on a mechanical keyboard, far surpassing human typing speeds.

Technical Deep Dive

[▶ Watch: Wired injection demonstrates lack of keystroke authenticity verification (4:00)]()

The core of GhostType's technical innovation lies in designing effective contactless keystroke injection signals and achieving targeted keypresses. This involved addressing two key research questions:

Q1: How to design effective contactless keystroke injection signals?

The GhostType injection signal is a pulse-modulated sinusoidal signal characterized by four configurable parameters: frequency (fin), amplitude (Vin), pulse width (Win), and period (Tin). Successful injection requires satisfying two main constraints:

1. Voltage Requirement (Constraint 1): The induced sinusoidal voltage, Vemi(t), at an RX pin must drop below the low threshold voltage (VIL) when a TX line is scanned. This is expressed by the condition: Ec Vin sin(2πfinmΔT + φ0) < VIdle - VIL, where Ec is the coupling efficiency, mΔT is the scanning time of the m-th TX, and VIdle is the idle state voltage. This means the minimum required injection voltage is VIdle - VIL. While resonant frequencies (fres) maximize coupling efficiency (Ec), they are difficult to calculate and not strictly necessary. Experiments showed that keystrokes can be injected across a wide range of frequencies, with the minimum required Vin varying non-linearly with fin, indicating certain frequencies offer higher coupling efficiency.

1. Timing Requirement (Constraint 2): Due to the keyboard's debounce mechanism, the injection signal must persist for at least two consecutive scanning cycles to be registered as a legitimate keypress. This translates to the condition sin(2πfinΔtm + φ0) = sin(2πfinΔt(m + M) + φ0), where M is the number of TXs. For cases where the time difference between adjacent TXs (Δt) is non-zero, a sufficient condition for synchronization is fin Δt M = C (where C is an integer). This, combined with ΔT = ktin + Δt, reveals that many solutions exist for achieving synchronization.

• Pulse Width (Win) and Period (Tin): The pulse width Win plays a crucial role in determining the number of injected TXs. For injecting a single keystroke, w < Win < ΔT (where w is the pulse width of the keyboard's own scanning signal) is sufficient. For injecting multiple keystrokes simultaneously, Win > w + kΔT can be configured to exceed the keyboard's key rollover capacity, potentially leading to a DoS attack.

Q2: How to inject a targeted keystroke?

Targeted injection is more complex, demanding precise localization to a specific RX line and synchronization with a particular TX line.

1. Opportunities for RX Selection: Despite the dense and complex routing of RX traces on the circuit board, simulations and experiments demonstrated that the susceptibility to EMI differs significantly across various RX traces and with different antenna positions. By carefully selecting the antenna's position along the targeted RX trace, adversaries can localize the injection signal to predominantly affect a specific RX line. This spatial targeting is a key enabler for precise manipulation.

1. Opportunities for TX Selection (Synchronization):

• Synchronizing with Scanning: Keyboards unintentionally emit electromagnetic signals during their internal scanning process. Researchers found that these emissions can be detected, received, and amplified to extract crucial timing information. By identifying the strongest emission as a flag, the adversary can synchronize their injection signal with the keyboard's internal scanning sequence, ensuring the EMI pulse aligns with the activation of a specific TX line.
• Synchronization-free Injection Strategy: A more advanced technique exploits the two-stage scanning mechanisms often employed by keyboards, particularly Bluetooth devices, for power conservation. These keyboards initially operate in an interrupt-driven mode, only detecting if any key is pressed. Upon detection, they switch to a polling mode to identify the specific key. GhostType exploits this by injecting a trigger signal, Vemi(ttrig), that satisfies ttrig = w + ΔT to force the keyboard into the polling mode. Once in polling mode, a precisely adjusted delay tdelay = Ts + (m-1)ΔT can be used to inject the targeted keystroke without needing to actively sense the keyboard's ongoing EM emissions. This strategy significantly enhances the robustness and stealth of targeted attacks, especially against wireless keyboards.

Demo / Proof of Concept

[▶ Watch: Contactless EMI injection confirmed via frequency sweep tests (5:00)]()

The evaluation of GhostType's performance constituted a comprehensive proof-of-concept, demonstrating the attack's efficacy and robustness across a wide array of commercial keyboards.

The experimental setup utilized standard laboratory equipment: a signal generator to create the pulse-modulated sinusoidal signals, a power amplifier to boost the signal strength, and a near-field antenna to direct the EMI. This setup was used against 50 off-the-shelf keyboards and keypads from 20 popular brands, encompassing 40 membrane and 10 mechanical keyboards, and representing both 35 USB and 15 Bluetooth protocols. Two key metrics were used: Success Rate (SR), the percentage of successful attacks, and Actions per Minute (APM), quantifying the injection speed.

The overall performance was alarming: 48 out of the 50 tested keyboards were found to be vulnerable to GhostType attacks. The only two unsusceptible keyboards were observed to have steel plates underneath their matrix circuits, suggesting that this additional EMI shielding was the reason for their resilience.

DoS Attack: Denial-of-Service attacks were successfully performed on 36 of the 48 vulnerable keyboards, achieving nearly a 100% SR. These attacks could be conducted across a wide range of frequencies and amplitudes. Notably, mechanical and gaming keyboards with NKRO (N-key rollover) capacity were generally less susceptible to DoS, as their design allows them to handle multiple simultaneous keypresses without blocking, which is a known feature against ghosting issues.

Keystroke Injection: The research successfully injected fake keystrokes on 39 of the 48 vulnerable keyboards. The injection speeds achieved were remarkably high, far exceeding human typing capabilities. For instance, researchers achieved 12,110 APM on a membrane gaming keyboard and an astonishing 22,939 APM on a mechanical keyboard. Both random and targeted keystroke injection demonstrated nearly a 100% SR on applicable devices. The injection speed was shown to vary significantly with frequency and to increase with amplitude (Vin).

Environmental Factors: GhostType proved robust against various environmental variables:

• Antenna Positions: The attack was robust to minor antenna displacement, successfully injecting the same targeted keystroke even when shifting the antenna 14mm in the X-axis and 12mm in the Y-axis.
• Injection Distance: DoS attacks achieved a 100% SR at a 10mm distance, and keystrokes could still be injected at 30mm. Using more professional equipment, the attack distance for both DoS and keystroke injection was extended to over 1 meter.
• Table Material: The attack was successful across different tabletop materials (solid wood, acrylic, MDF, glass) with 10mm thickness, achieving similar success rates and injection speeds.
• Table Thickness: Keystrokes were successfully injected through tables up to 25mm thick, and DoS attacks maintained a 100% SR at 15mm thickness.

Hidden Keys Demonstration: The existence and exploitability of hidden keys were investigated on 10 keyboards, and they were found on every device. These included function keys (e.g., opening file browser, media controls, sleep) and debug ASCII codes. A particularly striking example was a numeric-only keypad where 44 hidden keys, including alphabetical and control keys, were discovered and demonstrated to be exploitable, for instance, to shut down a computer.

The practical implications of these findings were highlighted through potential attack scenarios:

1. User-like Adversaries: Could inject keystrokes at extremely high speeds for competitive gaming or automated tests, or trigger hidden functionalities for system manipulation.
2. Disruptive Adversaries: Posed a more severe threat, capable of manipulating critical equipment (medical, industrial, military) or causing irreversible loss in time-sensitive scenarios, such as deleting files, shutting down computers, or disrupting financial trading activities.

Defensive Implications

[▶ Watch: Discovery of injecting non-existent "hidden keys" into keyboards (6:00)]()

The widespread vulnerabilities uncovered by GhostType necessitate a re-evaluation of keyboard security design. The research proposes several concrete countermeasures, addressing both hardware and software aspects of keyboard manufacturing:

1. Shield Keyboards with Metal Materials: The most straightforward and empirically validated countermeasure is the implementation of robust physical shielding. The fact that the only two unsusceptible keyboards in the extensive evaluation had steel plates underneath their matrix circuits strongly suggests that full metal enclosures are highly effective. Manufacturers should consider employing full metal enclosures or at least incorporating metal shielding to protect both sides of the keyboard matrix from external EMI injections. This would significantly reduce the coupling efficiency (Ec) required for successful attacks.

1. Enhance the Keystroke Sensing Mechanism: Beyond physical shielding, fundamental improvements to the keyboard's internal sensing logic are crucial:

• Randomize Scanning Signal Waveform: To prevent the injection of phantom keys that mimic legitimate signals, the keyboard processor should be designed to verify the authenticity of received keystroke scanning signals. Randomizing the waveform of the scanning signal could serve as a unique verification signal that the processor checks, making it exceedingly difficult for an adversary to craft an EMI signal that passes this authenticity test.
• Redesign Scanning Parameters: Simulations conducted during the research (Figure 26 in the paper) showed that decreasing the time difference (ΔT) between adjacent TXs significantly reduces the success rate of phantom keystroke injections. Keyboard engineers should carefully choose scanning parameters, particularly minimizing ΔT, to intrinsically make keyboards less vulnerable to timing-based EMI attacks.
• Randomize Scanning Sequence: To complicate targeted keystroke injections, manufacturers could implement mechanisms to randomize the sequence in which TX lines are scanned. This would make it much harder for adversaries to predict when and which specific TX line will be active, thereby disrupting the synchronization required for precise key injection.
• Detect and Remove Hidden Keys: The discovery of hidden keys, which do not correspond to physical switches but can still be triggered, is a significant security oversight. Manufacturers should implement methods during firmware development to detect and explicitly remove these non-existent key mappings from the keyboard processing logic. This would prevent adversaries from exploiting these "ghost" functionalities to trigger unexpected and potentially malicious actions in the operating system.

These countermeasures, encompassing both robust physical protection and intelligent software/firmware design, are essential to ensure the trustworthiness of keystroke sensing mechanisms in an increasingly interconnected and threat-laden world.

Key Takeaways

• Novel Class of Vulnerabilities: GhostType introduces the first signal integrity analysis of keyboard sensing mechanisms, revealing a new and widespread class of vulnerabilities that allow for contactless keystroke injection via electromagnetic interference (EMI).
• Comprehensive Attack Theory and Capabilities: The research developed a detailed theoretical framework for contactless EMI injection, demonstrating its capability to perform Denial-of-Service (DoS) attacks, inject random keystrokes, and execute highly targeted keystroke manipulations (e.g., deleting files, shutting down systems).
• Pervasive Vulnerability Across Commercial Keyboards: An extensive evaluation of 50 off-the-shelf keyboards and keypads revealed that 48 of them were vulnerable to GhostType attacks, highlighting a systemic and widespread security flaw across various manufacturers, models, and protocols.
• Discovery of Exploitable Hidden Keys: The research uncovered "hidden keys" within keyboard matrix circuits that do not correspond to physical switches but can be maliciously triggered via EMI, enabling unexpected system manipulations.
• Robustness to Environmental Factors: GhostType attacks demonstrated remarkable robustness against factors like antenna displacement, injection distance (over 1 meter with professional equipment), table material, and table thickness (up to 25mm), showcasing its practical feasibility.
• Actionable Countermeasure Insights: The investigation provides crucial insights for developing both hardware (e.g., full metal enclosures) and software (e.g., randomized scanning signals, removal of hidden keys) countermeasures to mitigate these pervasive threats.

About the Speaker(s)

Qinhong Jiang is the presenter of GhostType, a significant research effort conducted by a collaborative team. Qinhong Jiang represents this collaborative research team, which includes contributions from Zhejiang University, the University of Michigan, and Northeastern University. The presentation at NDSS 2024 highlights their collective work in uncovering and analyzing novel security vulnerabilities in keyboard input mechanisms.