🕵️ RESEARCH & DEEP DIVES
- MacBook built-in IMU exposed as side channel enabling 89-97% keystroke inference
Researchers demonstrated BRUTUS, an unprivileged attack that uses MacBook IMU sensor data to infer keystrokes, users, and environment.- Applies to recent generations of Apple MacBooks with a built-in inertial measurement unit (IMU).
- Non-root processes can read IMU data via an IOKit driver, plus HIDIdleTime and CGEventSource metadata enrich the leakage.
- The IMU captures vibrations from typing, leaking keystroke identity, desk surface, and user behavior.
- The BRUTUS attack achieves 89.1-97.5% character-level key recovery and can reconstruct some sentences with 100% accuracy using language models.
- It also discovers unlabeled user and environment profiles and assigns subsequent activity segments to them.