Et Tu, MacBook? Unprivileged Keystroke Inference and Context Profiling via the Built-in IMU Side Channel
Jiaji He, Yi Shi, Junfeng Cai, Chang Liu, Yongqiang Lyu
cs.CR
2026-09-18
An unprivileged IOKit path reads the MacBook chassis IMU; BRUTUS recovers held-out keystrokes at 89.1%–97.5% character accuracy and clusters typists and desks without labels.
In 2026 Bourbonnais et al. showed that recent MacBooks hide an undocumented chassis IMU, a six-axis accelerometer-plus-gyroscope meant for orientation. A root process can read the raw stream at high enough fidelity to estimate pulse. That write-up treated root as a prerequisite. This paper checks whether the access boundary was overstated, and what else the sensor leaks besides pose.
Keystroke side channels on Apple Silicon already exist, and they all come with a deployment tax. Nearby microphones, a phone on the same desk, or a watch need physical proximity. The built-in camera and microphone sit behind TCC. Apple's public Core Motion API is not available to third-party macOS apps for this chassis sensor. Software channels need input-driven traffic, expose intervals rather than key identity, or depend on processor-specific cache probes. An undocumented IOKit path that any console-admin process can open removes that tax.
A privilege audit leaves three interfaces that never emit key values and never ask for TCC Input Monitoring. HIDIdleTime is an IOKit registry property any local process can poll; it resets on every HID event, and polling above 100 kHz yields sub-millisecond timestamps. CGEventSourceSecondsSinceLastEventType, available in a GUI login session, separates keyboard events from trackpad events. The payload is AppleSPUHIDDevice: IOKit checks admin-group membership on open and matches the caller UID to the console owner on each callback, delivering about 800 Hz of six-axis data. An SSH or launchd process under a different account gets no callbacks. Fast User Switching cuts the stream in about three seconds. Across ten MacBook Air units (M3/M4/M5, 13-inch and 15-inch, Sonoma through Tahoe), toggling Input Monitoring does not affect this path.
The threat model is the default install: the first user is in the admin group and is sitting at the GUI. The malicious process runs under that non-root UID. No elevation prompt, no extra entitlement.
Physically the IMU sits off-center on the logic board, so each key has a different lever arm. Force mostly scales amplitude; waveform shape and decay survive. Soft supports reflect the impulse, rigid desks dump it. After supervised contrastive training that pulls same-key embeddings together across devices, held-out D8, D9, and D10 reach same-key versus different-key AUCs of 91.2%, 98.5%, and 96.2%.
For key recovery, a timing oracle cuts a 300 ms window (100 ms of quiet, 200 ms of impact and decay), first differences expand six axes to 12 channels, and a 480K-parameter InceptionTime classifies 37 keys (a–z, 0–9, space). Under the same protocol it beat a 3-layer 1D CNN, a Transformer encoder, and a gradient-boosted ensemble by 4 to 14 points. Beam search (width 100, expand 6) builds strings; a Brown-corpus trigram rescores at word boundaries, freezing high-confidence positions so the language model cannot overwrite a key the sensor already called.
Label-free profiling skips the classifier. Roughly 99 keystrokes form a segment. Fifteen pairwise Pearson correlations among the six axes, each summarized seven ways, make a 105-d vector. Prediction strength picks k, then k-means. Correlations ignore force scaling and keep how posture, fingering, and the support couple energy across axes.
Training uses P1–P7 on D1–D7 across nine surfaces. Cross-test moves those seven people onto machines they did not train on. End-to-end assigns unseen P8–P10 to unseen D8–D10 at a café table, on a lap, and on a mattress. Each person types 15 random 8/9/10-character passwords and ten English sentences.
| Setting | Password CER | Password Top-5 | Sentence CER (+LM) | Overall CER |
| Cross-test mean | 6.2% | 98.1% | 4.8% (0.4%) | 5.0% |
| End-to-end mean | 9.9% | 86.7% | 5.3% (4.8%) | 6.0% |
| Best, P8 | 4.4% | 93.3% | 2.1% (1.4%) | 2.5% |
| Worst, P9 | 15.6% | 80.0% | 10.0% (11.5%) | 10.9% |
That overall range is 89.1% to 97.5% character accuracy. P2, P4, and P5 reach 0% sentence CER after the language model. P9 is the only case where the language model makes sentences worse: short inter-key gaps overlap three or four 300 ms windows, substitutions land on real English words, and the LM has no reason to reject them.
User profiling holds device, desk, and text fixed. Eight people yield k=8 with no labels; all 72 discovery segments and 24 later segments go to the right profile. At k=7, P2 and P3, similar build, similarly flat finger posture, collapse into one cluster; k=8 splits them. Environment profiling holds the typist fixed across nine surfaces (wood, steel, plastic, glass, mouse pad, laptop stand, leather sofa, mattress, lap), selects k=9, and assigns all 81+27 segments correctly.
Sample rate is the kill switch. On a 1,842-character corpus, password Top-5 is 96.00% at 800 Hz and 31.00%, 8.00%, and 0% at 200, 100, and 50 Hz. At 50 Hz, password CER is 62.00% and LM-aided sentence CER is 35.86%. Offline, music from a phone, network traffic, and CPU load at recorded amplitude barely move pairwise AUC. Only the MacBook's own speaker, at 10× and 25×, drops AUC from about 98.7% to 76.9% and 52.1%, because that vibration shares the chassis path with keystrokes.
TCC covers key-value APIs, the camera, and the microphone. It does not cover this undocumented IMU, nor the two content-free timing oracles. No extra hardware, no Input Monitoring dialog, no root. The default admin-plus-console user is enough.
The suggested fixes are concrete: put the IMU path under TCC, gate the timing interfaces, and cap the rate below 200 Hz, matching iOS at 100 Hz and Android 12's permission for rates above 200 Hz. 800 Hz is surplus for orientation and just enough for keystrokes. Driver-level noise in the keystroke band is the third option and does not need app cooperation.
The authors reported to Apple in March 2026. Apple reproduced the IMU leak in May 2026 and, at submission, was still tracing the root cause. The public artifact is the access-control audit and the physical characterization; the trained models and full attack pipeline stay in-house. A shared unibody, keyboard, and undocumented IMU make cross-device transfer easier than another microarchitecture-specific cache channel.
The IMU path needs the active console UID and admin-group membership. A secondary SSH or su session, even as an administrator, gets kIOReturnNotPrivileged on open. Fast User Switching drops the stream in about three seconds. Trackpad gestures and iOS ports are left as future work.
The study is ten MacBook Airs and ten people aged 22–35. No Pro, no external keyboard, no password-manager autofill. The worst held-out typist already breaks the fixed 300 ms window. A Brown trigram plus NLTK word list does not help Chinese input or random passwords, and the password column is correspondingly weaker. User and environment clustering pin down the other factor; mixing both (same person, new desk; same desk, new person) is untested. Noise is added offline. The 4-to-14-point InceptionTime edge is an internal comparison, not a matched bake-off against acoustic or co-located-phone attacks.