A group of security researchers have developed a new cyberattack called Malboard that mimics the victims’ keystroke characteristics and uses Artificial Intelligence (AI) to inject malicious software onto a system. The team from Ben-Gurion University of the Negev (BGU) in Israel, which also developed the attacks’ detection mechanisms, said that Malboard even evades several detection products that are intended to continuously verify the user's identity based on personalised keystroke characteristics.
The keyboards used in the research were from Microsoft, Lenovo and Dell, the team notes in their paper named “Malboard: A Novel User Keystroke Impersonation Attack and Trusted Detection Framework Based on Side-Channel Analysis,” published in the journal Computer and Security. According to researchers, the keystrokes generated maliciously by a compromised USB keyboard do not typically match human typing and can easily be detected. Malboard uses AI to autonomously generate commands in the users’ style to attack a system and evade detection.
“In the study, 30 people performed three different keystroke tests against three existing detection mechanisms including KeyTrac, TypingDNA and DuckHunt. Our attack evaded detection in 83 percent to 100 percent of the cases,” Dr Nir Nissim, Head of the David and Janet Polak Family Malware Lab at Cyber at BGU, said in the paper. “Malboard was effective in two scenarios: by a remote attacker using wireless communication to communicate, and by an inside attacker or employee who physically operates and uses Malboard,” added Nissim, who is also a member of the BGU Department of Industrial Engineering and Management.
“Our proposed detection modules are trusted and secured, based on information that can be measured from side-channel resources, in addition to data transmission. These include (1) the keyboard's power consumption; (2) the keystrokes' sound; and (3) the user's behavior associated with his or her ability to respond to typographical errors,” Nitzan Farhi, a BGU student who developed both the attack and detection mechanisms, noted.
The team proposes using the detection framework for every keyboard when it is initially purchased and daily at the outset. The researchers plan to expand their work on other popular USB devices, including computer mouse user movements, clicks and duration of use. They are also planning to enhance the typo insertion detection module and combine it with other existing keystroke dynamic mechanisms for user authentication because, reportedly, this behaviour is difficult to replicate.