Slashdot Mirror
Smartwatches Can Be Used To Spy On Your Card's PIN Code (softpedia.com)
An anonymous reader writes: A researcher has developed a smartwatch app that can interpret hand motions and translate the movements to specific keystrokes on 12-key keypads, like the ones used at ATMs. The app sends the data to a nearby smartphone, which then relays it to a server, for analysis. The whole AI algorithm on which it's built has a 73% accuracy for touchlogging events, and 59% for keylogging. The entire code is on GitHub, along with his research paper, and a YouTube video.
Most people wear watches on their off hand, so it won't be a problem.
Except that most people are right-handed and wear watches on their left hand. So not a problem in most cases (as even TFA hints)
soylentnews.org
Try typing on the numerical keyboard, like a cashier. You only need to use fingers to reach every number, this is why it is so efficient.
I don't own a smart watch, but when I wear a watch it's on my left wrist. If I enter a PIN code it's with my right hand. I don't see how this could work unless they're on the same hand?
Also it will only work if your hand is made of concrete.
Wristwatches are usually worn on the left hand. Most people type PINs with the right hand, which is the more talented limb for the majority of people. Thus an "Attack on Smartwatch" doesn't seem to warrant a live action adaptation?
When I wear a watch at all, I wear it on my left wrist. I type ATM PIN codes with my right hand (because I'm right handed. And most lefties I know wear their watches on their right wrist.)
But if I ever do get a smartwatch, I'll definitely make sure I don't wear it on my right wrist.
This is a perfect scenario re-created to prove a thesis. "Pre-trained model" Can we get a definition of what this is? Because this could be highly skewed.
As you are using more "smart" devices with ability to load apps, there are more opportunities to hack you.
Fortunately, I'm right-handed and am wearing my watch on a left wrist. And best of all - it's not a "smart" one.
This PIN attack would be highly practical in Saudi Arabia, where the salafite medieval ruling classes have a penchant to chop off peoples' left hand, thus forcing them to wear a smartwatch on the remaining (right) hand.
So, while I see some good points about which hand you're going to type your PIN with ... as I see it, smart watches and so many other products are pretty much insecure by design.
Some company rushes a product to market because it sounds cool, they build in some features which also sound cool, and they make it so it can communicate with everything.
In the process someone glosses over that it wants to talk to everything, or that they forgot to add any security, or that is leaks personal information all over the place by uploading information to several different sites ... ads, analytics, telemetry, the company who sold it so they have your personal information.
You walk into a store, it connects to their wifi, the store's app detects you, updates information about you, sends you a custom sale flyer based on your previous purchases ... it keeps track of the fact that you spend a lot of time in the pain aisle. It updates more of your information. They sell that information to 5 other places.
You go home, it tells your thermostat you're home. Your hacked nanny cam records what you do. Google connects your last purchase with your ad profile, and when you sit down at your computer you see fresh ads for paint.
All of these gadgets and doo-dads, I just don't see the point. I don't need to be tracked wherever I go so I can sign into Facebook or tweet that I'm in McDonalds.
At the end of the day, between the fact that the companies you give the information to are lazy and terrible at security your information gets out, between what they share with their 15 ad partners your information gets out and you probably get served malware, and your connected whatsit probably gets hacked because it's got crap security.
I don't trust the makers of these products, and quite frankly I can't make myself get excited about an internet connected roll of toilet paper. I don't need my fridge to tweet me that I'm low on butter. My oven doesn't need to be pre-heated from my phone. My front door doesn't need to be able to recognize my friends. My kitchen table doesn't need to update my Facebook status.
It's insecure, or it's untrustworthy. And in an awful lot of cases it's pointless.
Lost at C:>. Found at C.
You mean I could get accurate many axes of output from a wrist mount?
If you don't have a habit of covering any pad you are entering a PIN on with another hand, you are naive at best.
Small cameras aimed at pads to capture PINs have been around for years.
But the mind boggles. An accurate hand,(ok arm and wrist) based controller? That would be one of the most awesome rc controllers ever. But we can't have that because it would be too dangerous.
This might just lead to touch screen keypads, where the numbers change sequence per use?
I already know of one bank where your online pin needs to be entered via a reconfiguring onscreen keypad. I believe the intent is to avoid key loggers.
The truth is, with interactive security, the human is always going to be the weak point.
Jumpstart the tartan drive.
Also, for this to work, the PIN needs to by typed by "Hunt'n'Peck" method (one finger, hand moving around the keypad) so that there's actual wrist motions to be detected and spied on by the smartwatch.
Currently, smart-watches are worn by nerdy geeks (and are considered un fashionnable by the general population, though some marketing-centered companies like Apple are bound to eventually change the general perception of these gadgets), and geeks tend to touch type (thus more finger motion, using more than 1 finger and less wrist motion) by habit of using computers.
In other worlds, handedness aside, the poeple who tend to do the most spy-able like motion are the less likely to wear the spy device.
That's why the real-world crooks (card skimmer) have been relying on camera for the spying (when not plain tampering with the keypad).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
It's a PIN.. Not a PIN Code.. Not a PIN Number.
You just said "Personal Identification Number Code"
You know what? Nevermind. Sound stupid.
I'm going to set your feet on fire while you sleep tonight, though, samzenpus.....
#OxfordCommaCaliphate
When I type my pin, I use at least 3 fingers, and my wrist barely moves at all. Many people use one finger, and move their entire arm between each keypress. I assume this technology is better at the second style of typing.
It would be a huge boon to the deaf, and might encourage people to learn sign language.
excitingthingstodo.blogspot.com
Srsly.
I guess I'm the only one who uses two fingers or hands to enter 4 digit pin? I have a credit union, so for me easy access to ATMs means going to the nearest 7eleven.
You may understand the unease I had at first, but really when compared to a Chase ATM, it was about the same.
So for my personal security, I always check for card skimmers by gripping and shaking the scanner. Then, I use one hand with two fingers, or two hands to enter the PIN for one of two few reasons: speed, reducing the amount of time at an ATM, and for blocking visual access to the keys I press. I always look around for any" security cameras" around the ATM.
I try to only visit the same ATM, so I can see why changes to the hardware.
Then when I'm done, I randomly press keys to protect myself against heat signature attacks.
Finally, I wait until the terminal is ready to accept a new transaction. #1 I always ask for to receipt. And because of the inconsistent manner ATMs function, I can't trust that nothing will come out, so I want.
#2 some ATMs a actually wait for input to close out a session." would you like do perform transaction? "
So I don't trust ATMs very much,except that they'll give you the correct amount of money.
I guess I'm the only one who uses two fingers or hands to enter 4 digit PIN?
I have a credit union, so for me easy access to ATMs means going to the nearest 7eleven.
You may understand the unease I had at first, but really when compared to a Chase ATM, it was about the same.
So for my personal security, I always check for card skimmers by gripping and shaking the scanner. Then, I use one hand with two fingers, or two hands to enter the PIN for one of two reasons: speed; reducing the amount of time at an ATM, or for blocking visual access to the keys I press. I always look around for any "security cameras" around the ATM.
I try to only visit the same ATM, so I can see what changes in the hardware.
Then when I'm done, I randomly press keys to protect myself against heat signature attacks.
Finally, I wait until the terminal is ready to accept a new transaction. #1 I always ask for no receipt. And because of the inconsistent manner ATMs function, I can't trust that nothing will come out, so I wait.
#2 some ATMs actually wait for input to close out a session "Would you like to perform another transaction?"
So I don't trust ATMs very much, except that they'll give you the correct amount of money.
On an aside, I'm using firefox on android, and it seems to lag terribly. And when I swipe the top stories, the entire page swipes to nothing. smh
My abilities are only limited by my imagination
Who doesn't know that all "smart" devices spy on the user. Even though you bought it, you don't own it. You don't have complete control over what it does or doesn't do. You pay for convenience with your personal data. Some people value their personal data more than others.
I see potential here: strap an accelerometer array (smartphone) to each wrist, and enable typing without a keyboard. Write your next novel tapping away at a blank desk... or even just wiggling your fingers in the air. Sure would be easier than tapping away at a tiny smartphone screen, and you wouldn't have to lug around a BT keyboard.
As for entering PINs, I always have at least three fingers over the keypad at all times, to obfuscate which key is being pressed/tapped. Not foolproof, but maybe makes it just difficult enough for the nefarious person to move on to the next potential victim.
Give me my freedom, and I'll take care of my own security, thank you.