Slashdot Mirror
Hackers Can Use Smart Watch Movements To Reveal A Wearer's ATM PIN (ieee.org)
the_newsbeagle writes: By gaining access to the sensors in someone's smart watch, hackers could track the person's hand movements at an ATM and figure out his/her pin. The hacker needn't be anywhere near the ATM; data can be lifted from the smart watch by either a discreet wireless sniffer or by malware on the watch that sends info to a server. This is hardly the first demonstration of the security flaws in smart watches. Last year, a research group showed that a watch's sensors can reveal keystrokes on a computer keyboard. The team of researchers, led by Chen Wang and Yingying Chen at the Stevens Institute of Technology in Hoboken, New Jersey, were able to record movements down to the millimeter and crack private ATM PINs with 80 percent accuracy on the first try. To eliminate the security breach, manufacturers could better secure the data stored in their wearables, and/or add noise so one's physical hand movements cannot be as easily translated. Of course, consumers could simply wear their smart watch on their non-dominant hand.
I can't speak for everyone, but I think almost everyone wears their watch on their non-dominant hand?
Use the chip of a card when possible and if you are holding something that can track movement in one hand, watch, phone, whatever, use the one that is electronics free to put in your pin.
University professors are under constant pressure to come up with something interesting to show they are a world class expert in their field. And grad students who do most of the grunt work are under pressure to prove themselves as well. So this is yet another impractical technique. No hacker is going to bother with something this hard to make work. Maybe a nation state hacking team might, but probably not.
Much simpler to install a hidden camera or a direct electrical monitor on the button presses from the keypad itself. Also, look at it this way. On that bitcoin bazaar, Evolution I think it was called, people's pin numbers were about 10 bucks each. Not worth this kind of hassle. This tells me there is far more stolen information readily available than there are crooks to use that information to make fraudulent purchases and cash withdraws with.
Which makes sense - there are probably still many, many ways to gain access to a database of credit card numbers, or places to set up a skimmer. The actual task of writing the number to a fake credit card and then using it somewhere in person is a far riskier task and one far more likely to result in one's eventual arrest and imprisonment...
now I just need some straws to grasp at.
that I am a carpenter who hammers nails at odd hours.
People don't realize this, but about a hundred years ago when people switched from pocket watches to wrist watches, they were clever enough to realize that future models would feature motion sensors and people would do their banking at electronic cash dispensing machines. Hence the tradition of wearing watches on the left hand.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Breaking story: Security researchers find new way to rate an individuals porn preferences using nothing but smart watch worn on the dominant (porn) hand.
I can lick my own shoulder.
Probably of more concern for this (or use!): https://atap.google.com/soli/ Don't even need any electronics on the person.
In this case, 1111, 2222, 3333, etc. would be the most secure PINs.
https://it.slashdot.org/story/...
sheesh
I need an update to my smartwatch that lets me wear 2 of them and use a rolled-up, printed piece of paper as a keyboard.
We could always just present the numbers on a keypad in a random position for each transaction. That of course would require conscious thought and effort of the person using the keypad which is probably too much to ask the 'average' user. It would also make life more difficult for blind users.
errr....umm...*whooosh* *whoosh* Is this thing on ?
Excuse me sir. Can I trouble you to type these numbers into this keypad. There's quite a few combinations and I need you to do each 3 times. Why? Oh just calibrating accelleratometer in your smartwatch so I can identify all future numbers you type.
I'm going to guess this hack never makes it out of a laboratory.
Welp, so much for academia. They're blaming bogeymen too.
Even without this technology, your fingers will leave a heat mark on the ATM keys long enough for a malicious person to take a picture of it with a thermal camera. Therefore, when I use an ATM machine, I always hold my fingers over a subset of keys to warm them up while waiting for the excruciatingly slow computer in the thing to do its job. That probably sufficiently masks the thermal print left by actually entering my PIN. Furthermore, I have developed a habit of pressing on the keypad frame as if pressing a key on the pad to fool lurkers. That would probably also protect against the smartwatch appraoch. It's rather easy to protect against such attacks, just introduce sufficient noise.
Note that most ATM machines allow pressing random keys while they're not ready for input. You might also want to press random keys during that time.
0x or or snor perron?!
Can't wait to get the results of their time/stroke to orgasm studies. Will be well replicated, too.
I always wear my watch on my non-pin-entering hand; furthermore, I recently got in the habit of simulating non-pin-entering hand mini seizures, just in case this sort of thing ever happened. Take that, stupid hackers!!
Put your smart watch on
Take your smart watch off
Put your smart watch on
And shake it all about
Do the SecOp-sy Dropsy And pass you're secrets around
And that's what it's all about!!!
When I type my wrist doesn't move very much. I mostly move my fingers, and use several of them to type. While I can see how a person using the hunt-and-peck method could be tracked with his watch, I think it'd be much more difficult to track what the rest of us type.
I am right-handed and wear my watch on my left wrist, which works well so I can keep writing while look up the time.
Considering left-handedness is a minority and watches are becoming less common overall by the younger generation, this will affect less and less people as time goes by. I'm usually the "old-timer" in the room that even wears a watch and knows what the term "DOS prompt" even means.
Also, since smartwatches seem to need a recharge every single night, I don't see why this is much of a concern by anybody no matter which wrist you wear a watch on. Perhaps in the future when they finally resolve the battery life issue, it might.
As long as your smart watch isn't a Gear S2. I swear this thing think I hit my daily walking goal when all i'm doing is sitting and reading a book. The other day it automatically switched to cycling while I was driving my car... at 72MPH. If I could cycle that fast I wouldn't need a car. If anyone tries to get my pin using my watch all they end up with is some weird data: He's not moving... now he just moved marginally downward... now he's accelerated left at 212 MPH..... now he's stopped.... now he's in the next county....
Whenever a player quits EVE to go play WoW, the Average IQ of both games increase.
(2) alternate hands between typing digits. It's not difficult. Step (1) is probably best.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"