Slashdot Mirror
Researchers Develop New Way To Steal Passwords Using Google Glass
mpicpp writes with a story about researchers who have developed a way to steal passwords using video-capturing devices.Cyber forensics experts at the University of Massachusetts in Lowell have developed a way to steal passwords entered on a smartphone or tablet using video from Google's face-mounted gadget and other video-capturing devices. The thief can be nearly ten feet away and doesn't even need to be able to read the screen — meaning glare is not an antidote. The security researchers created software that maps the shadows from fingertips typing on a tablet or smartphone. Their algorithm then converts those touch points into the actual keys they were touching, enabling the researchers to crack the passcode. They tested the algorithm on passwords entered on an Apple iPad, Google's Nexus 7 tablet, and an iPhone 5.
Time to trademark a 'No Glass Allowed' symbol.
TLDR - Researchers steal passwords by watching them being entered.
tongue. Thee thee thee ohw thoo ohw non.
electronic keypads should randomize the numeric order and that the device should not mirror the letter typed on the inout line or on the keypad.
I'm a consultant - I convert gibberish into cash-flow.
Because, after all,
You cannot capture what does not exist!
I suppose you can be more subtle about it, but really any video cam would work just as well. Especially if you set it up near a place where people will be typing a useful password instead of loitering and staring at people.
For the last couple of years I have been completely covering any input I give to a phone unlock or ATM PIN given. With cameras everywhere, this was only a matter of time.
We should learn what we need to know about issues, before we decide what we need to feel about them.
It would be a lot easier if the typing was done on a device where the letters were sticking out from the "screen" so this software could make out what letters were being touched more easily and accurately. I'll call this device a "key-board"! Oh, the security problems we'd have with such a device.
As the video points out, this is not limited to Google Glass, any video capturing device will work. But beyond that, this is really kind of obvious. Yeah, video recording someone entering their password on a touch device will give you a fairly accurate idea of what that password is. Record, playback at 1/4 speed, password. I would bet that security camera footage might even be better to work with due to the angle. The custom software I suppose is a nice achievement, but I would guess it's not all that necessary.
I'm sorry, but your opinion seems to be wrong.
Well I know this wouldn't be able to break iPhone fingerprint sensor or black berry's picture password.
The fact that the device is out in the open when the password is entered is the problem here.
There's one technology that solves this problem, and that technology is genital recognition. It works like a password, but it depends on the unique pattern exhibited by each individual's genitalia.
When a password needs to be entered, the user puts the phone down his or her pants/skirt/dress/whatever, and presses the screen against his or her genitalia. The pattern is then analyzed and compared against known data points modeling the genitalia. If there is a match, then the authentication succeeds. If there is not a match, then the authentication fails.
The important thing to remember is that the authentication happens in a secure area: within one's underwear. This helps prevent observers from deducing the password based on visible effects such as shadows and reflections.
FFS this was quite interesting enough without turning it into yet another fucking "completely different because it's done with Glass/3D printer" story.
I see none of the initial comments even read the summary. They skipped this part entirely:
The thief can be nearly ten feet away and doesn't even need to be able to read the screen — meaning glare is not an antidote. The security researchers created software that maps the shadows from fingertips typing on a tablet or smartphone. Their algorithm then converts those touch points into the actual keys they were touching, enabling the researchers to crack the passcode. They tested the algorithm on passwords entered on an Apple iPad, Google's Nexus 7 tablet, and an iPhone 5.
This just in, video cameras can record you entering passwords, more at 11.
The MMO WildStar uses a randomized keypad for their two-factor authenticator input.
After a while, you get pretty good at it.
Based on the buff pattern of his hand, he jerks off lefty. Flushing suggests approximately 6.5 hours ago. Computer estimates from wear pattern thinking of one Taylor Swift, body part: nose and upper lip.
It's on its way, people.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
"I don't get it, almost all his passwords should be Shift+v! Why isn't this working?"
"Read out says CTRL+v, boss."
"Don't be stupid! It has to be Shift!"
Demented But Determined.
Researchers Develop New Way To Steal Passwords Using a video camera
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"
Change your on-screen keyboard layout. Then they'll need to see the screen to figure out what letter is at each position.
I'm churning this over in my head to see if it sparks an idea that might actually be practical. My last major security-related software project was based on gender recognition, so this isn't too far off. Regarding my last project - captchas suck. People aren't much better than computers at recognizing squiggly letters. We are, however, REALLY good at spotting hot chicks.
If this modern United States government had half the balls of the founding fathers, characterwise, they would outlaw these glasses and make it a crime to spy.
That you can capture passwords with a camera.
WTF .. This place is really gone to the dumps..
---- Booth was a patriot ----
Is this the "think of the children" glass-killer ?
Requiem for the American Dream
Google must find a solution before it gets popular among hacking community and some people suffer.
So.. does it mean they won't need research grants anymore ?
I'm all for security researchers finding flaws and whatnot, but this seems way over the top. What thief would have been capable of developing an algorithm this sophisticated? Seems like all they've done is build a new tool for thieves, which would probably not have otherwise existed, and has basically no legitimate use. So why do it? Am I underestimating the sophistication of thieves these days?
The reason google glass is panned more than any other device like mobile phone, is because google glass is damn more discrete at filming whereas holding a mobile phone is far more obvious in most cases.
Well high def security cameras should be able to pick it all up.
Why doesn't someone just modify the snippet of code in the OS that displays the touch keys on the phone/tablet screen to place them in a new random order each time you unlock the device so that when you enter the PIN to unlock the device you never use the same finger placement pattern twice? That would also prevent analysis of scratches/smudges on the surface of the device as a means of cracking it.
I know, I know, users would probably complain.
With all the different models, orientation, screen overlays, types of on-screen keyboard, angle of phone, multiple lights.
This might work in a clean lab enviroment with standard phones set to default and read from a speisific angle. :P
In the real world it wont work for shit, ever try using a QR scanner out in the world, and not at home?
Use Dvorak.
Problem solved.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
The first ATM scam I recall from the news was at some small retailer in Toronto, where they had a skimmer on the debit card swipe, and a video camera in the ceiling watching you enter your PIN. That was almost 20 years ago. The question is whether the optics and resolution are really good enough for Google glass (or a cell phone video) to pick up enough detail at 10 feet. I guess another tip is to not curl your other fingers so you have only one extended digit, and type with more than one finger, thus confusing the video to some extent. But... the randomizing keypad is probably the best solution.
2 factor auth....problem solved