Slashdot Mirror
Exploiting the iPad's Glowing Keyboard
nonprofiteer writes "Earlier this week, a South African security researcher released shoulderPad, an app that's designed to auto-snoop on iPad users' passwords by watching their touchscreen keyboards. When a user types on an iPad's touchscreen, each key glows blue for a fraction of a second after it's struck, a helpful bit of feedback for any virtual keyboard. ShoulderPad's image recognition algorithms, based on Open CV's open source image recognition software, look for that flash of blue. 'At any distance, if the blue is distinguishable, shoulderPad can detect that keystroke,' says Meer."
One more thing to warn my informatics students about.
Wewi naotallowkitkjnm0potkje nitoine notone ever yiyu betcha! goatsexunhj,q *N& and fuuuuuuuuuuuc83yh89ynkHPHPHPH penus dofrg!!!!!!!!!!!!
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
Enable the iPad camera and feed a video window on the login screen so you can see who's looking over your shoulder.
Have gnu, will travel.
This is like a hello world of opencv programs...color blob detection. Unless you're stealing shitloads of passwords...which probably isn't the case...you could just as easily watch the slowed down video. He's not even extracting what keys they're typing!?
To make it easier to catch typos, secure text fields on iOS persistently display the most recent character typed (and hide it when you type the next one). If you're already recording video of the iPad screen, why not just look for that?
Nice twisting of reality here to make a story, reporters. Touchscreen devices of all varieties have been doing this for years. Even PalmOS was inverting the onscreen keys as you pressed them.
This whole story is completely false.
The iPad keybord is not black, neither does it do a blue glow.
iOS virtual keyboards have *NEVER* been black. Yes if you Jailbreak you can put any type of skin (as see in the linked article), but the default virtual keyboard is white as in iPhone, iPod touch and iPad.
The iPad keyboard does not look like the one linked in the article, it's Apple grey/white.
a human would need less resolution.
a human can understand the finger.
a human can work it out without a glowing keypad.
the amount of false positives will be overwhelming. not to mention the extreme difficulty in getting a computer to recognize something so easily recognizable by a human.
I've farted more than you'll ever know.
That's what she said!
DEviaNT sez you fail
While this is not a unique problem to the iPad, since it is the 800 pound gorilla in the room it deservedly gets the attention.
Whether or not any iPad keyboard is actually black with a blue afterglow (could that be IOS 5?), or whether this particular demo games the system a bit, is somewhat irrelevant. With both smartphones and tablets it's much easier to snoop someone's password. Most people don't seem to think about security at all when they're typing their login information in public on an iPad or smart phone, so shoulder snooping is easy; and the "display the most recent letter pressed" gimmick used by both iOS and Android provides yet another possible attack vector.
I used to be very much against letting a computer or other device save my passwords; but I'm beginning to think - with portable devices anyway - there's value in doing so. Of course, if you lose the device you're screwed...
And there's still the additional problem where a lot of wifi hotspots aren't secured, so you need to be doubly sure of the site security (e.g. https) for any website you might log into.
#DeleteChrome
It's called a scrambled keypad.
http://www.pcscsecurity.com/scramble-keypad-sp-100
This can be easily implemented on iPad, iPhones, or any touch screen device. It probably should.
OSS used for foul play, off with their heads!
sysadmins and parents of newborns get the same amount of sleep.
this is OT spam and whoever moded this up needs to have their mod abilities suspended
A rubber hose is the fast, most sure-fire way to get any info out of any body, dead or alive !!
Up your nose with a rubber hose brings back such fond mammories !!
You have a rather strange sex life. And thank you, no, you don't have to add any additional details.
Faster! Faster! Faster would be better!
Is this spam or have I somehow, completely, missed a 'classic' herve leger dress slashdot meme? I'm quite intrigued. O.0
Only goes up to large. My basement dwelling fat ass would split the seams :/. I call spam.
"Luck" and "open"?
Learn to love Alaska
how different is it from capturing a video of someone entering password using a conventional keyboard?
That has to be one of the least impressive video demonstrations I've seen, it probably would have been quicker to frame advance the video manually and type the easily visible key presses by hand.
If this program could decode key presses from further away where keys are no-longer easily distinguishable by eye then I would be impressed.
The iPod Touch, iPhone and even Android all do the blue flash on key touch for visual feedback.
Checked it on my Android based Samsung phone and yes, it does it too.
Wouldn't it be easier and less obvious to just glance over someone's shoulder instead of standing there with your iPhone in your hand?
~Syberz
Better yet, using a time code like Google Authenticator. Ok, you have my password and my timecode. You now have 60 seconds to use it, and diddly squat after that. (Of course, if you just use a HEX time code and no password with non-visible shared secret, you're even more secure.)
The best security is something you can do regardless of who is watching, for instance even a USB time-coded key generator. Of course, your concern then is to keep the key generator from being stolen.
I8-D
If it worked for Vinnie Barbarino, then why didn't John Travolta try that in Swordfish?
Anyone? Hello...