Slashdot Mirror
Cheap Thermal Imagers Can Steal User PINs
Bismillah writes: A British infosec company has discovered that cheap thermal imaging attachments for smartphones can be used to work out which keys users press on -- for instance -- ATM PIN pads. The thermal imprint last for a minute or longer. That's especially worrying if your PIN takes the form of letters, as do many users' phone-unlock patterns.
A heating / cooling element in the keypad would remedy this.
Just wipe the screen or keys and then breathe on it, if you're really worried about this (there's very, very little reason to be, really).
With modern oleophobic screens you might not even need to wipe it down.
"They were pure niggers." – Noam Chomsky
randomise the number keypad value position, or use multiple overlapping gestures, so the heat signature left is a blobby smear
They'd have to be watching them physically to know the order. This is bullshit.
press buttons with fingernail.
I recall seeing a demo of this probably two years ago. It's easily countervened by placing your fingers on all the keys (without pressing, of course) after you've entered your PIN.
#DeleteChrome
Use the thermal goggles, Fisher. They should allow you to see the heat signatures on the keypads.
How can I believe you when you tell me what I don't want to hear?
Stand within view of the keypad and record it on your cell phone camera.
not worried about this at all, without the card, the pin is useless anyow, and chipped cards make it much more difficult
OK, but they still need your card or phone right? There are a lot of ways to steal your PIN. How about a long zoom and video playback? But still, they need your card also. Some criminal walking up to the ATM right after you and imaging the keypad is useless unless you either forgot your card in the machine or you get mugged and he takes your card. You should be far more worried about card skimmers installed at pay-at-the-pump gas stations, or that bar tender that you hand your card to while out drinking.
Just wipe it down or press for a moment. That should probably help obfuscate it.
Over a decade ago I started using a simple keypad countermeasure. I put three fingers on the top row of keys, and stroke downwards so that I end up touching every single key. It didn't take long for me to be able to actually press a specific key without a significant pause. Stroke the keypad 5+ times to input a 4-digit pin and no camera will be able to record what keys you actually pressed or in what order. It also means all the keys get roughly equal heat signatures and anyone 'dusting'' for prints won't be able to tell which keys were pressed and which keys were just touched.
No security measure is 100%, but stroking the keypad is low-cost with high return which is the best kind of security.
even included in portions of old games like the original Splinter Cell.
This has been possible for quite some time now, and is hardly breaking news. The story is so old that the first time it was posted, Slashdot still came on clay tablets.
Just cruising through this digital world at 33 1/3 rpm...
I could hang back until you withdraw your cash, then I punch you in the face and take your money.
Just heat the pad to a temperature a few degrees higher with a few PTC resistors, or implement a scramble pad where the digits move to random positions.
After you key in your code and the machine goes to the other screen, just push the other buttons until all have been pressed.
I'm sorry but I see like two dozen people giving idiotic ideas and advising against eachothers workarounds. Put the damn phone in your pocket, it will be so hot your fingers simply won't matter.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
Demonstrated this trick 20 years ago....
I haven't used an ATM in decades. I simply buy something at Walmart or Sam's Club and get cash back using my Discover card. It's far easier to find a Walmart than your bank's ATM. It's not uncommon for me to walk in to Walmart and walk out with $60 cash and a bag of Lindt chocolates. I even have a name for it, I call it a "truffle withdrawal".
Enter your pin, then hit 1-0 on the keypad. Problem solved. I've actually been doing that for a couple years now, don't remember why.
I only use the center key and type my PIN in Morse code.
... to notice general trends. Over multiple ATM's in my city, I have concluded that the number 5 is the most frequently used digit on a pin pad. Whether that is enough information to make it easier to crack someone's pin is debatable, but I thought it was interesting.
File under 'M' for 'Manic ranting'
If this becomes a prevalent problem, a touch screen pin pad to randomise the ordering of the keys/letters could be used. A bit annoying for the user, which might also cause delays in input and cause it's own problems if being recorded, but a simple enough solution to solve the first problem.
Ultimately, your bank account is one of the things you want most secure and adding in some form of biometric identification as well as text message tokens to get some multi-factor authentication isn't going to piss you off unless you're trying to get some cash out for the bus a minute before it leaves. It's the complete opposite to what's currently happening, where credit cards don't even require a pin, with these new contactless payments. There is no security there at all.
All the more reason to make systems as secure as possible instead of trying to have sanctioned holes through everything. It's security not Swiss cheese.
This got a lot of press right after FLIR launched the iPhone attachment.... but it goes back even further than that probably even further than this stuff i found from 2011.. https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pins-with-thermal-cameras/
Tl;DW it's bunk.
Go to 13:00
https://youtu.be/uVaXe33-o_M
This only works if someone has your PIN and a gun, and you don't have a gun. If they don't have a gun and that use this to get your PIN and then they tell you to give you your card, you just shoot them in the neck, make an ironic comment about them not needing your PIN, and go home. If they've got a gun and you haven't, then you're giving them the card and PIN anyway. There's like no scenario when you need to breath on the keys, press extra ones etc.
randomize the keyboard layout. i've seen the door keypads at an FBI office which randomize the keypad layout. re-randomizing it after each press could help, too. who says passwords need to be letters and numbers? how about passwords that are a sequence of cat picture?
now we need to go OSS in diesel cars
The video shows someone pressing each of the keys firmly for a second or longer so that the keys have time to heat up. Who the hell enters a PIN like that?
In other old news, a lot of cameras are sensitive to infrared, and they use a blueish filter to limit themselves to the visible spectrum. Removing that and adding another filter for the higher frequencies is a cheap way to convert the phone's own camera for thermal imaging.
Yes to the first part, no to the second.
Most cameras use silicon detectors (because they're cheap). Silicon is sensitive out to about 1 micron wavelength. Humans can't see much past 0.7 microns, so silicon is sensitive to some of the spectrum that's in the infrared... but one micron isn't yet in the thermal infrared, so you won't see heat from stuff that's around 310 K (body temperature) or so with a camera not specifially designed to go farther into the IR.
http://www.geoffreylandis.com
The simplest solution would probably be to enter a random key sequence before the pass key phase. At that point it would be harder tell which keys were used for the pass key and which were random.
The main advantage is that this can be retrofitted via software fairly easily.
Jumpstart the tartan drive.
My PIN is all ones, but nobody will find out in what order.
Well, well
A "security" company has discovered that a cheap, easily available gun can be used to harm or even kill a user at a distance by projecting a small piece of dense metal into the body. The damage has been shown to last a minute or longer.
That's especially worrying if you are ever within the line-of-sight of another human being, as so many users are! Click through for our press release and support our pioneering work.
"They were pure niggers." – Noam Chomsky