Slashdot Mirror
Exploiting the iPad's Glowing Keyboard
nonprofiteer writes "Earlier this week, a South African security researcher released shoulderPad, an app that's designed to auto-snoop on iPad users' passwords by watching their touchscreen keyboards. When a user types on an iPad's touchscreen, each key glows blue for a fraction of a second after it's struck, a helpful bit of feedback for any virtual keyboard. ShoulderPad's image recognition algorithms, based on Open CV's open source image recognition software, look for that flash of blue. 'At any distance, if the blue is distinguishable, shoulderPad can detect that keystroke,' says Meer."
One more thing to warn my informatics students about.
Wewi naotallowkitkjnm0potkje nitoine notone ever yiyu betcha! goatsexunhj,q *N& and fuuuuuuuuuuuc83yh89ynkHPHPHPH penus dofrg!!!!!!!!!!!!
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
Enable the iPad camera and feed a video window on the login screen so you can see who's looking over your shoulder.
Have gnu, will travel.
To make it easier to catch typos, secure text fields on iOS persistently display the most recent character typed (and hide it when you type the next one). If you're already recording video of the iPad screen, why not just look for that?
Yes he is. Keep an eye on the top-left corner of the video while the program's running.
This whole story is completely false.
The iPad keybord is not black, neither does it do a blue glow.
iOS virtual keyboards have *NEVER* been black. Yes if you Jailbreak you can put any type of skin (as see in the linked article), but the default virtual keyboard is white as in iPhone, iPod touch and iPad.
The iPad keyboard does not look like the one linked in the article, it's Apple grey/white.
> Nice twisting of reality here to make a story, reporters. Touchscreen devices of all varieties have been doing this for years. Even PalmOS was inverting the onscreen keys as you pressed them
You are the one twisting reality. Good stuff on the iPad = invented by Apple. Bad stuff on the iPad = same problem with all the other products in the universe but the other products are actually worse because they had it before and nobody fixed it.
This being said, it is a good thing you posted this as AC, otherwise people could have stolen your Slashdot password just by watching you typing it on your iPad.
lucm, indeed.
And by contrast, MS has visual feedback disabled on their virtual keyboards on the tablet editions of Windows. (Primarily for convertible tablets... remember those?)
Bizarro world, huh?
MS has visual feedback disabled on their virtual keyboards
Just for clarification, I meant to say "on password screens". It's off for the login screen and I think anything else the app reports is a password box.
DEviaNT sez you fail
While this is not a unique problem to the iPad, since it is the 800 pound gorilla in the room it deservedly gets the attention.
Whether or not any iPad keyboard is actually black with a blue afterglow (could that be IOS 5?), or whether this particular demo games the system a bit, is somewhat irrelevant. With both smartphones and tablets it's much easier to snoop someone's password. Most people don't seem to think about security at all when they're typing their login information in public on an iPad or smart phone, so shoulder snooping is easy; and the "display the most recent letter pressed" gimmick used by both iOS and Android provides yet another possible attack vector.
I used to be very much against letting a computer or other device save my passwords; but I'm beginning to think - with portable devices anyway - there's value in doing so. Of course, if you lose the device you're screwed...
And there's still the additional problem where a lot of wifi hotspots aren't secured, so you need to be doubly sure of the site security (e.g. https) for any website you might log into.
#DeleteChrome
It's called a scrambled keypad.
http://www.pcscsecurity.com/scramble-keypad-sp-100
This can be easily implemented on iPad, iPhones, or any touch screen device. It probably should.
OSS used for foul play, off with their heads!
sysadmins and parents of newborns get the same amount of sleep.
"Luck" and "open"?
Learn to love Alaska
That has to be one of the least impressive video demonstrations I've seen, it probably would have been quicker to frame advance the video manually and type the easily visible key presses by hand.
If this program could decode key presses from further away where keys are no-longer easily distinguishable by eye then I would be impressed.
Wouldn't it be easier and less obvious to just glance over someone's shoulder instead of standing there with your iPhone in your hand?
~Syberz
Better yet, using a time code like Google Authenticator. Ok, you have my password and my timecode. You now have 60 seconds to use it, and diddly squat after that. (Of course, if you just use a HEX time code and no password with non-visible shared secret, you're even more secure.)
The best security is something you can do regardless of who is watching, for instance even a USB time-coded key generator. Of course, your concern then is to keep the key generator from being stolen.
I8-D
If it worked for Vinnie Barbarino, then why didn't John Travolta try that in Swordfish?