SCRAPE: Side-Channel Attack to Reveal Alphanumeric Passwords from EEG Signals

In recent years, wearable Internet of Things (IoT) devices, such as brain-sensing headsets, have gained popularity for their ability to provide insights into users’ well-being. These devices record Electroencephalography (EEG) signals, which are traditionally used in medical settings to monitor brain activity. With the advent of affordable EEG headsets, this technology has become more accessible to the general public. However, these devices are not without security vulnerabilities, which hackers can exploit to intercept users’ EEG data. Recent research has demonstrated that EEG signals, when processed and analyzed using machine learning, can be used to infer user conditions or activities, such as muscle movements, emotions, or even limited keyboard input.In this paper, we explore the potential of deep learning to infer the digits and words typed on a keyboard based on a person’s recorded EEG signals, achieving high accuracy. If deep learning techniques can be employed to deduce user activity from EEG signals, they could potentially expose sensitive and private information, such as password entry. Our contributions include demonstrating an attack model by developing and comparing various deep learning models to infer the digits and words typed by a person wearing an EEG headset. We also detail the process of reading raw EEG signals from a consumer-grade EEG headset and implementing a series of noise filters and signal transformations to refine the signal samples. Finally, we develop and test both CNN and RNN models for EEG signal classification to accurately infer passwords.