Proof-of-Concept Android Trojan Uses Motion Sensors To Steal Passwords

← Back to Stories (view on slashdot.org)

Proof-of-Concept Android Trojan Uses Motion Sensors To Steal Passwords

Posted by Soulskill on Monday April 23, 2012 @07:14AM from the for-when-normal-keylogging-is-just-too-precise dept.

judgecorp writes "TapLogger, a proof-of-concept Trojan for Android developed by resarchers at Pennsylvania State University and IBM, uses information from the phone's motion sensor to deduce what keys the user has tapped (PDF), thus revealing otherwise-hidden information such as passwords and PINs."

27 of 105 comments (clear)

Min score:

Reason:

Sort:

yikes! by noh8rz3 · 2012-04-23 07:17 · Score: 5, Insightful

We talk often about mobile viruses and I've become somewhat inured to it (another malware embedded in rogue angry birds? yawn). But this is scary, brave new world scary.
1. Re:yikes! by kthreadd · 2012-04-23 07:46 · Score: 2
  
  Not scary, open!
2. Re:yikes! by hierophanta · 2012-04-23 07:52 · Score: 2
  
  +1 good vocabulary
3. Re:yikes! by tchuladdiass · 2012-04-23 08:24 · Score: 5, Insightful
  
  The reason this is significant is that apps are usually installed with limited access to items it doesn't need. So normally a bad app won't be able to steal passwords, or lift your address book, unless you give it permissions. This demonstration is simply showing a covert channel for information leakage that people may not have thought about before.
4. Re:yikes! by noh8rz3 · 2012-04-23 09:53 · Score: 2
  
  You mean, people who run any APK they find deserve to infect their friends and colleagues with nasty diseases? Cuz I can't say I agree with that sort of laissez fairs attitude. Surely in the name of public health we should expend a little effort helping those who won't help themselves.
Swype by Pat+Attack · 2012-04-23 07:19 · Score: 5, Interesting

I wonder if it would work on those of us who use a Swype keyboard. Then again, I do tap out my passwords. A thought: If you randomize the keyboard for password entries, that would make it harder to discern from malware like that and the over-the-shoulder attack.
1. Re:Swype by x1r8a3k · 2012-04-23 07:28 · Score: 2
  
  I have a slide out physical keyboard on my phone. I think thats the simplest way to defeat this.
  
  Also this seems to only be able to get the location of taps and infer what you've typed. What if I'm using a non standard keyboard layout?
2. Re:Swype by HexaByte · 2012-04-23 08:35 · Score: 2
  
  Better then that, we could all just start randomly moving our devices while typing our passwords, or dancing some hip-hop moves while doing so.
  I don't think they'll be able to adjust for that!
  
  --
  HexaByte - he's a square and a half!
3. Re:Swype by robmv · 2012-04-23 08:53 · Score: 4, Interesting
  
  long term better solution is that OS fields for passwords and PIN keypads disable applications access to motion sensor data. If you are custom drawing a password field and not using the OS provided one, add an API to hide motion sensor data when you need it
New Wave of Virus by lipanitech · 2012-04-23 07:21 · Score: 2

This is the next wave in mobile malware it affects iPhone as well I guess no smart phone is safe. I guess they did not bother with blackberry. lol

--
http://thetechnologygeek.org/
1. Re:New Wave of Virus by SJHillman · 2012-04-23 07:33 · Score: 4, Funny
  
  Blackberry is the OS/2 of the mobile world.
2. Re:New Wave of Virus by SJHillman · 2012-04-23 08:15 · Score: 2
  
  Ok, here's the comparison:
  OS/2 was once great, but was a little ahead of its time so it ended up slowly fading away. It's still used and will likely be used for time to come even after support has completely dried up.
  Blackberry was once great, but was a little ahead of the smartphone curve so now it's slowly fading away. It's still used and will likely be used for time to come even after support has completely dried up.
Well, that's pretty clever by jfengel · 2012-04-23 07:21 · Score: 5, Informative

According to TFA, the idea is actually somebody else's and previously published. This is an extension of the idea that uses a training phase, presumably a part of the Trojan where the user interacts with the phone for benign reasons (perhaps playing a game or entering data for a legitimate purpose) that it uses to calibrate the correlation between taps and the accelerometers.
It's pretty clever. Presumably, it can be defeated by refusing to allow background apps to have access to the sensors, though I can imagine applications where you want to allow that kind of thing (pedometers, for example).
1. Re:Well, that's pretty clever by YodasEvilTwin · 2012-04-23 07:26 · Score: 2, Funny
  
  I always give pedos access to my vibration sensors.
I find this hard to believe by ThunderBird89 · 2012-04-23 07:22 · Score: 4, Insightful

I find it hard to believe that the motion sensor can be sensitive enough to detect such minuscule changes, when I sometimes need to tap the phone against the desk to have it acknowledge rotation. Also, if the phone is placed on the table to enter the passwords, most of the supposed motion is eliminated, significantly frustrating the attack.

--
Hyperbole: I use it liberally!
1. Re:I find this hard to believe by SJHillman · 2012-04-23 07:37 · Score: 5, Insightful
  
  It's not a perfect attack, but it doesn't need to be successful against every single user on every single phone. Most modern smartphones don't require physical abuse to register motion and most smartphone users don't put the phone down, put the password in, then pick it back up every single time. How about an analogy? Let's say there's a PC virus that exploits the wheel function of a USB mouse. Not every PC will have a USB mouse with a wheel, and even among those that do, not every user will use it. However, there's still enough vulnerable PCs that this theoretical virus could be highly successful.
2. Re:I find this hard to believe by x1r8a3k · 2012-04-23 07:43 · Score: 2
  
  I just checked on my phone with the raw data from the sensors. If i put if flat on a table, they stay still, but just holding it it can detect the small changes of me just not being able to hold it perfectly still. It will even register if I leave one side on a table and raise the other side by about 1mm. I think the rotation thing is more smoothed out in software to prevent it changing too often.
Easy enough to fix by Baloroth · 2012-04-23 07:23 · Score: 3, Insightful

Just don't allow programs in the background to have access to the motion sensors. Is there any actual reason a background program would need such information anyways? It sounds like they just allowed it because developers didn't realize it could give away sensitive details. Now they know, it can be restricted pretty easily, I should think.
And if you do have a program that actually needs the motion sensor information while not in the foreground, just have it ask for special permission.

--
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
1. Re:Easy enough to fix by Scared+Rabbit · 2012-04-23 07:30 · Score: 2
  
  Well that would certainly break the pedometer apps out there.
2. Re:Easy enough to fix by CastrTroy · 2012-04-23 07:40 · Score: 2
  
  Yes, but that would require that people actually be able to change permissions on what individual programs can access. I recently got an Android phone and find it quite laughable what kind of permissions some apps are asking for. Why does a tic-tac-toe game need access to my contact list, the internet (ok ads are one explanation), and my phone information (call information, when I make a call, who the call is to, my phone number etc)? I should be able to lock down my phone by default. There should be no reason I shouldn't explicitly be able to deny programs information to sensors and internal phone data and just send them empty data if they ask for it, so they don't crash. I liked this about my old Nokia phone a lot . It would frequently ask and reask when programs could access the network. It was a little bit of an annoyance, but at least I know I had control over what apps were doing. There's firewalls for the network that can be applied at the application level, but for me that isn't good enough. I immediately thought of a way around it in which one has access to your contact and phone history, and wrote the information out to the SD card, while another app which actually needed access to the network but didn't have access to the contact info (and therefore you were more likely to grant it net access) would read the same data off the SD card and send it over the internet. I can only think of a very limited set of applications that have access to contact lists and phone history. And really I would expect those apps to be built into the phone, not something you download from some random software maker.
  
  --
  
  Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
3. Re:Easy enough to fix by X0563511 · 2012-04-23 09:46 · Score: 2
  
  So? Pedometers are cheap. If you are not stationary, just use the GPS to determine distance/speed. If you are stationary, chances are the platform knows how "far" you have gone and how "fast" you are going.
  If you're jogging in place... well, deal with it :P
  
  --
  For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Franklin said it best. by Anonymous Coward · 2012-04-23 07:26 · Score: 4, Funny

Those who would give up essential usability to purchase a little temporary security, deserve neither usability nor security.
1. Re:Franklin said it best. by Entropius · 2012-04-23 07:48 · Score: 3, Insightful
  
  This is just a further illustration of the basic idea that letting someone run arbitrary code on your system is a bad idea, and that access to external communications and sensors breaks sandboxing. Someone with the ability to turn on a webcam, for instance, can do all sorts of nefarious things, including seeing you type your password reflected in your glasses if it's high-enough resolution.
2. Re:Franklin said it best. by h4rr4r · 2012-04-23 07:57 · Score: 3, Insightful
  
  So don't install their code. The flip side it that it is even worse if someone else gets to decide what arbitrary code is allowed to run on your system.
Simple fix by PPH · 2012-04-23 08:36 · Score: 4, Insightful

Just have the password entry widget lock the accelerometer (or whatever) resource while in focus.

--
Have gnu, will travel.
1. Re:Simple fix by robmv · 2012-04-23 11:14 · Score: 2
  
  That solves the PIN entry widget, malware could hypothetical capture passwords from password fields, so those fields need to be protected too. The problem remain with apps that don't use native toolkits, so to add an API that locks hardware devices that could be used to capture sensitive information is enough in an ideal world. In the real world many app developers will simply ignore to use it
Fixing This Will Damage Science by ScentCone · 2012-04-23 08:53 · Score: 4, Funny

We use the internal motion sensors on Android phones to provide all of the inertial navigation input we need to control the external thrusters on the capsules of the hihg altitude balloons we send up for biometric testing of the subjects inside. The subjects, usually kids about five years old, play Angry Birds and type out phrases of Shakespeare until they black out. If they disable background motion sensor use, it's possible we're going to lose more like 8 out of 10 kids we send up, instead of the usual 5 or 6. I can see already that we might have to go back to using spider monkeys, or those expensive parrots. Which means re-working the whole app, again. Man, science is hard.

--
Don't disappoint your bird dog. Go to the range.