Slashdot Mirror
Touchscreens Open To Smudge Attacks
nk497 writes "The smudges left behind on touchscreen devices could be used to decipher passwords to gain access, according to researchers at the University of Pennsylvania. The report tested the idea out (PDF) on Android phones, which use a graphical pattern that the user traces to unlock the handset. The researchers took photos of the smudge trails left on the screen and bumped up the contrast, finding they could unlock the phone 92% of the time. While they noted Android 2.2 also offers an alphanumeric password option, the researchers claimed such a smudge attack could be used against other touchscreen interfaces, including bank machines and voting machines. 'In future work, we intend to investigate other devices that may be susceptible, and varied smudge attack styles, such as heat trails caused by the heat transfer of a finger touching a screen,' they said."
It would be easy enough to implement an alphanumeric password on a keyboard that's always a different shape / place on the screen. Or just instruct users to wipe their hand across the screen a few times on public touchscreens - maybe include a small microfiber cloth attached to the kiosk / ATM / whatever so clean it with.
Just randomize the keyboard every time, bam, smudges are now useless. Or use Apple's oleophobic display coating (http://iphoneindia.gyanin.com/2009/06/11/iphone-3gs-gets-oleophobic-coating-whats-this-oleophobic-coating/) assuming it's good enough to thwart this attack.
Vacuum cleaners suck. Kings rule.
... people could either wipe down touchscreens after use, WASH THEIR HANDS, or the public ones could have a cloth or something to remove smudges.
This isn't really that different from the case of push-button locks that are subject to "wear attacks", is it? You know, just check to see which of the 5 or so buttons are most worn/polished/dirty. If it's 3 of them, you've only got to try 6 permutations -- maximum -- to open it. Worked fine in my wife's hospital room for the locked supply drawer. Two tries. All the bandaids and gauze I wanted.
I'd say this case is much harder to fix than the touchscreen, given the "randomize" suggestion above. Sure it's a little bit of a pain, but not that bad if security is actually important.
I am not a crackpot.
Does this mean I should stop eating chocolate while using my touchscreen toy? :/
No seriously, it might work 92% of the time, but that's assuming the user just unlocked and did not use the device. Using it would introduce noise and break the unlock-smudges, dropping the percentage closer to zero the more they use it.
This comes at no surprise. Most people draw simple shapes on the graphical pattern lock. Would you be surprised if your computer was hacked if you set the password to "1234"?
For example, how many of you have drawn a triangle as your pattern? I know I did the first time I used my android phone. Then a few weeks later, when I was on an airplane, I watched a senior gentleman pull out his smart phone and draw the exact same pattern lock as me.
I then sat down and pondered the complexity of passwords using a graphical pattern lock. There's only 9 buttons to use and for most people they tend to only use adjacent buttons when drawing. If one were confined to this set of rules, the passwords would all be linear and simple geometric shapes. However, I figured out through trial and error, that you can actually double back on buttons you've activated and activate buttons that are non-adjacent to active ones by drawing in the blank space in between buttons. This should be a criteria for a strong graphical pattern lock, just like how there's requirements for strong alpha-numerical password locks. You should always have at least one double back button and one non-adjacent button as part of the pattern lock. This way the smudges left on your phone are non-linear.
Scanning for heat trails... that reminds me of Cyberia...
I was suprised this is news as well. Dusting keypad locks to see which keys are used most often isn't unheard of, and this just seems like a variation on that.
You're right, an ATM with a touchscreen would be an instant ADA fail, since putting braille on a touchscreen would be somewhat difficult.
That aside...
An ATM would be a lot harder to crack, because lots of people use it so the keys are going to be somewhat more randomly-used (since everyone has a different PIN).
The only way of using this would be to put a shim on the ATM to read the magstripe, then some sort of substance on the keypad, and then go back and determine which keys were pressed between each use of the ATM. And, hell, if you're going to go to that much trouble just integrate a pinhole camera into the shim and capture the actual fingers pressing the actual keys along with the magstripe. No fancy guesswork required.
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
Having recently gotten an android phone, I have to wonder why nobody has written a locker that simply tracks phone orientation changes through some movement pattern rather than the touchscreen. There'd be no smudges (so better security and a cleaner screen), and it should be quicker. Kinda like using a secret handshake to unlock your phone. Example passcode: +x, -y, -z, +y (750 possibilities for a four movement code, more if you get fancier in movement tracking).