A simple activity monitor with /dev/random

Today I was performing some tests in the random number generators of some browsers and found, by chance, this mail sent to Bugtraq by Michal Zalewsky called “Unix entropy source can be used for keystroke timing attacks”. While the idea of Michal is very good, I failed to find a reliable way of doing it in my house computer after some time (well, honestly, after just 1 hour…). However, a more simpler idea come to my mind: if /dev/random blocks when the entropy pool is empty and most of the events are generated when mouse or keyboard events happens, at least, I can write quite easily an activity monitor based on /dev/random.

A simple activity monitor

The idea is very simple: read all available data in /dev/random and then, depending on the intervals new data is available, try to determine if the mouse or keyboard is being used. For this I created the following simple Python script:

#!/usr/bin/python import time import select ACTIVITY_MOUSE = ACTIVITY_KEYBOARD = 1 def wait_for_activity ( ) : "" " Returns (0, time) for mouse and (1, time) for keyboard activity. Note, however, that the metrics are just a guess. " "" started = True f = open ( "/dev/random" , "rb" ) f. seek ( 2 , ) keyboard = mouse = ret = None while ret is None : t = time . time ( ) select . select ( [ f ] , [ ] , [ ] ) f. read ( 8 ) t = time . time ( ) -t if started: started = False continue if t & lt ; = 1 : if mouse & gt ; = 1 : ret = ( , t ) else : mouse += 1 keyboard -= 1 elif t & lt ; = 5 : if keyboard & gt ; = 1 : ret = ( 1 , t ) else : keyboard += 1 mouse -= 1 else : keyboard = mouse = f. close ( ) return ret def main ( ) : while 1 : act = wait_for_activity ( ) if act [ ] == ACTIVITY_MOUSE: print "MOUSE ACTIVITY DETECTED" , act [ 1 ] else : print "KEYBOARD ACTIVITY DETECTED" , act [ 1 ] if __name__ == "__main__" : main ( )

Execute this script and see if it works for you. In my case, for reading 8 bytes it typically takes 1 second or less when mouse events happens (normal stuff: browsing, reading mail, etc…) and 5 seconds or less for keystrokes. Some of the problems I noticed are, for example, that often the script thinks that when I’m writing mouse events are happening, when they are not (I think I type too fast for my script). In any case, more or less (in my home computer, at least) it’s working.

For next posts, hopefully, I’ll be able to write a working program for the (old) idea of Michal Zalewsky but, meanwhile, this is what I have working. I hope you find it interesting or useful. Bye!