{"slug": "et-tu-macbook-unprivileged-keystroke-inference-via-built-in-imu-side-channel", "title": "Et Tu, MacBook? Unprivileged Keystroke Inference via Built-In IMU Side Channel", "summary": "Researchers reported in an arXiv paper submitted on 18 Sep 2026 that Apple MacBooks' built-in inertial measurement unit (IMU) can be read without root access via an IOKit driver, enabling a side-channel attack they call BRUTUS that recovers typed characters with 89.1% to 97.5% accuracy. Aided by language models, BRUTUS reconstructed certain sentences with 100% accuracy and also profiled users and desk environments without labels, using the IMU plus the HIDIdleTime and CGEventSource metadata interfaces. The authors conclude that access to built-in IMU sensors needs strict regulation.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 18 Sep 2026]\n\n# Title:Et Tu, MacBook? Unprivileged Keystroke Inference and Context Profiling via the Built-in IMU Side Channel\n\n[View PDF](https://arxiv.org/pdf/2609.21569)\n\n[HTML (experimental)](https://arxiv.org/html/2609.21569v1)\n\nAbstract:Recent generations of Apple MacBooks embed an inertial measurement unit (IMU) within their unibody chassis for device orientation and motion sensing. However, this IMU inadvertently captures not only intended device-level information but also subtle physical vibrations from user interactions and the surrounding environment. These signals establish a novel, previously unexplored side channel. We uncover a vulnerability allowing non-root access to IMU data via an IOKit driver, alongside two content-free system metadata interfaces (HIDIdleTime and CGEventSource) that further enrich the side-channel leakage. Through rigorous characterization of the IMU data, we reveal that the leakage spans three core dimensions: (1) keystroke identity (which key is typed), (2) desk surface (where the laptop is placed), and (3) user behavior (who is typing). Leveraging these findings, we introduce BRUTUS, the first comprehensive unprivileged side-channel attack targeting built-in IMU sensors on Apple MacBooks. BRUTUS achieves a character-level accuracy of 89.1% to 97.5% in key recovery. Furthermore, aided by language models, it can successfully reconstruct certain sentences with 100% accuracy. For user identification and environment profiling, BRUTUS correctly discovers user and environment profiles without labels and correctly assigns subsequent segments to their corresponding profiles. Ultimately, this work highlights the urgent necessity of strictly regulating access to built-in IMU sensors.\n    \n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/et-tu-macbook-unprivileged-keystroke-inference-via-built-in-imu-side-channel", "canonical_source": "https://arxiv.org/abs/2609.21569", "published_at": "2026-09-21 13:07:08+00:00", "updated_at": "2026-09-21 13:25:09.488212+00:00", "lang": "en", "topics": ["ai-safety", "machine-learning", "large-language-models"], "entities": ["Apple", "MacBook", "BRUTUS", "IOKit", "HIDIdleTime", "CGEventSource", "arXiv"], "alternates": {"html": "https://wpnews.pro/news/et-tu-macbook-unprivileged-keystroke-inference-via-built-in-imu-side-channel", "markdown": "https://wpnews.pro/news/et-tu-macbook-unprivileged-keystroke-inference-via-built-in-imu-side-channel.md", "text": "https://wpnews.pro/news/et-tu-macbook-unprivileged-keystroke-inference-via-built-in-imu-side-channel.txt", "jsonld": "https://wpnews.pro/news/et-tu-macbook-unprivileged-keystroke-inference-via-built-in-imu-side-channel.jsonld"}}