Slashdot Mirror
Proof-of-Concept Android Trojan Uses Motion Sensors To Steal Passwords
judgecorp writes "TapLogger, a proof-of-concept Trojan for Android developed by resarchers at Pennsylvania State University and IBM, uses information from the phone's motion sensor to deduce what keys the user has tapped (PDF), thus revealing otherwise-hidden information such as passwords and PINs."
We talk often about mobile viruses and I've become somewhat inured to it (another malware embedded in rogue angry birds? yawn). But this is scary, brave new world scary.
I wonder if it would work on those of us who use a Swype keyboard. Then again, I do tap out my passwords. A thought: If you randomize the keyboard for password entries, that would make it harder to discern from malware like that and the over-the-shoulder attack.
This is the next wave in mobile malware it affects iPhone as well I guess no smart phone is safe. I guess they did not bother with blackberry. lol
http://thetechnologygeek.org/
According to TFA, the idea is actually somebody else's and previously published. This is an extension of the idea that uses a training phase, presumably a part of the Trojan where the user interacts with the phone for benign reasons (perhaps playing a game or entering data for a legitimate purpose) that it uses to calibrate the correlation between taps and the accelerometers.
It's pretty clever. Presumably, it can be defeated by refusing to allow background apps to have access to the sensors, though I can imagine applications where you want to allow that kind of thing (pedometers, for example).
Any device with access to the motion sensors using a touchscreen running some software can theoretically do this, not just Android.
I'm not going to click on the link, but I'll be there's an i Fanboi authoring this article.
I find it hard to believe that the motion sensor can be sensitive enough to detect such minuscule changes, when I sometimes need to tap the phone against the desk to have it acknowledge rotation. Also, if the phone is placed on the table to enter the passwords, most of the supposed motion is eliminated, significantly frustrating the attack.
Hyperbole: I use it liberally!
Penn State!
Just don't allow programs in the background to have access to the motion sensors. Is there any actual reason a background program would need such information anyways? It sounds like they just allowed it because developers didn't realize it could give away sensitive details. Now they know, it can be restricted pretty easily, I should think.
And if you do have a program that actually needs the motion sensor information while not in the foreground, just have it ask for special permission.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
so they can't say have pos 24,53 = h each time.
Those who would give up essential usability to purchase a little temporary security, deserve neither usability nor security.
Just have the password entry widget lock the accelerometer (or whatever) resource while in focus.
Have gnu, will travel.
We use the internal motion sensors on Android phones to provide all of the inertial navigation input we need to control the external thrusters on the capsules of the hihg altitude balloons we send up for biometric testing of the subjects inside. The subjects, usually kids about five years old, play Angry Birds and type out phrases of Shakespeare until they black out. If they disable background motion sensor use, it's possible we're going to lose more like 8 out of 10 kids we send up, instead of the usual 5 or 6. I can see already that we might have to go back to using spider monkeys, or those expensive parrots. Which means re-working the whole app, again. Man, science is hard.
Don't disappoint your bird dog. Go to the range.
Placing your phone on a table/counter/desk can save your data!
Comment removed based on user account deletion
Comment removed based on user account deletion
Once you install malware it's too late, it can just act as a key logger, it s doesn't need to read the sensor to find out your password.
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
...I've just watched an episode of NCIS where someone placed a bug in a computer keyboard that used subsonic acoustics to determine which key had been pressed... Hollywood science?
Operation Guillotine is in effect.
Infrormation?
The link says pdf. It doesn't link to a pdf. Am I the only one that gets annoyed about that?
There is nothing new here. You "could" potentially write a program that does a lot of things. The beauty of Android is that you essentially have a computer in the palm of your hand.
To those concerned that viruses will spread, research the Android permissions and security model. This model has not been broken. A user must give permission to the app first. Most users who are too stupid to read the permissions, are also too stupid to find alternative APK sources. So there is nothing to worry about. If you fall into the third category of users who read the permissions and blindly trust, well you knew what you were getting into.
I think that a lot of this "Android virus" propoganda is being put out by certain antivirus companies looking for a new revenue stream. They see Android as a cash cow in the future and they want to get people fearful of proof-of-concept malware and so-called viruses.