Slashdot Mirror
Scientists Prove Your Phone's PIN Can Be Stolen Using Its Gyroscope Data (digitaltrends.com)
A team of scientists at Newcastle University in the UK managed to reveal a user's phone PIN code using its gyroscope data. "In one test, the team cracked a passcode with 70 percent accuracy," reports Digital Trends. "By the fifth attempt, the accuracy had gone up to 100 percent." From the report: It takes a lot of data, to be sure. The Guardian notes users had to type 50 known PINs five times before the researchers' algorithm learned how they held a phone when typing each particular number. But it highlights the danger of malicious apps that gain access to a device's sensors without requesting permission. The risk extends beyond PIN codes. In total, the team identified 25 different smartphone sensors which could expose compromising user information. Worse still, only a small number -- such as the camera and GPS -- ask the user's permission before granting access to that data. It's precise enough to track behavior. Using an "orientation" and "emotion trace" data, the researchers were able to determine what part of a web page a user was clicking on and what they were typing. The paper has been published in International Journal of Information Security.
So they are saying that if a malicious compromising app is already installed and running on your phone, then your phone could be compromised?
Were they on salary while determining this?
If I had a DeLorean... I would probably only drive it from time to time.
In 2017 everyone is a scientist. Even APK.
Long before touch-screens with capacitative sensing became commonplace there were some touch-screens systems that used a gyroscope as its sensor to sense how much the screen rocked when a user touched it.
It was very crude and inaccurate compared to other approaches but it could be mounted to most regular CRT computer monitors.
Unfortunately I have sold off my computer magazines from the early '90s so I can't look up the name of the manufacturer.
"We mustn't be caught by surprise by our own advancing technology" -- Aldous Huxley
Escalation of access is still an issue.
Personally I see the moral of the story as being the old one that security is weakened if you have to use the access method very frequently. That's one of the reasons why alarm systems often have a different code for each user instead of ending up with four numbers almost worn off the keypad after a few years.
How many days would elapse before the user had entered their PIN fifty times in their phone? I don't think it would be a very long time and the malware can wait.
If I'm a researcher entering a PIN multiple times I'm in a chair hunched over the phone. Me? I'm in my La-Z-Boy. I'm on the toilet. I'm in bed. I'm in the kitchen cooking. I'm at a red light getting a message. I'm in the grocery store unlocking my shopping list.
You really wanna tell me my gyroscope is in the same position in all these scenarios?
The location of digits is random at each unlock attempt.
Hold me! I'm scurred!!
Oh wait... My cell phone gives me the option to scramble the numbers whenever I enter my pin to prevent this exact sort of stuff.
As you were!
Hacking and cracking aside, This concept isn't new - Nintendo's been doing gyroscopic sensing for at least 15 years that I am aware of with the WII, it's not exactly a stretch to apply the same logic to a phone and obtain positional information based on timing an application to measure positional information as a series of tilts in specific directions when in the process of unlocking of the phone.There's gonna be problems if the phone is on a solid surface like a table though.
But what I don't understand is. If someone already has access to the device to get gyroscopic information, what's the point in obtaining a PIN remotely?
What good would that do?
If you download from google store, every app has to ask permission.
this attack only works on those downloading from untrusted sources.
has neither a PIN nor a gyrothingie. Am I safe?
Ok, so I have a new game for the smartphone: complete the sequence, it is purely a coincidence that the numbers line up with the unlock buttons. In this game I will put up a sequence of numbers and you need to complete the sequence and as levels become harder the number of digits you need to enter increases. Make sure that while playing you give me access to the gyro; never mind, you already do this.
So if you walk away from your game while playing or I am running in the background I will just log the gyro to capture your pin....
Bingo, game-ification of pin code entry and automatic pin capture.
Who wants to start a phone game company with me?
It would be so easy to implement and reduce a bunch of other attacks as well. Won't happen, too user unfriendly. Sigh. We're going the opposite direction where the validation program is also looking at your gyroscope data to guess if it's you tapping or someone else. AI is a selling point, randomized UIs aren't.
This could happen on any web page you happen to have visited and left open, in some cases the browser can be minimised and screen locked
https://link.springer.com/arti...
Just make an app that occasionally shows a fake unlock screen, and just capture the touches.
I will assume that this research was conducted using 4-digit PINs, which are the default for iOS and Android. I wonder how their success rate would hold up against, say, a 5-digit PIN, or 8, or N?
I generally rely on a biometric sign in for my phone*, but fall back on the PIN code once or twice per week. It's a whole lot more than 4 digits.
* I know, biometrics have their own set of risks; different conversation
This is an entirely sensible thing to do. You might have a game that uses the gyroscope. Embedded within that game there might be a rogue application that also uses the gyroscope data to measure the tilt as a result of using the keyboard, and report that along with your high score, or whatever to some game sever. If you have some security mode so when you are entering a password, it disables keyboard sharing, screen grabs, the camera (looking for reflections in you glasses) and the microphone (in case you say the numbers aloud) it must also disable the gyroscope and accelerometer. It does not matter that the process is not reliable - all we need to know is that is could work, so we can put in a fix.
Too often we learn what is possible after the event. We have to pay ingenious people to report weaknesses in the system. If you don't then the only ones working on it are the ones with something to gain.
1. write iphone app 2. record sensor data 3. sell PINs 4. profit!
Why did his statement get voted down? I think it's insightful satire.
As a firefighter, we are taught "Forcible Entry", because we may show up to a burning house and the homeowner may be able to answer the door. The first words out of the instructors mouth, Day 1, "locks keep honest people honest." Simple and profound.
Seems like the front door to your house and the front door to your phone are only as safe, as the moral society in which you live allows.
.... show up to a burning house and the homeowner may be able to answer the door.....
Ehem, may NOT be able to answer the door. LOL Too early for posting... need coffee.
For fuck's sake! There are no goddamn gyroscopes in mobile devices. What's used are accelerometers, which are non-spinning. Gyroscopes spin.
From the description the method is detecting which part of the screen you tap on. Thus if you use PIN keypad layout scrambling, such as in LineageOS they still won't know which digit you were tapping each time.
"There's 1 man with a vision" https://slashdot.org/comments.pl?sid=10476859&cid=54226973/
APK
P.S.=> YOOD empire is illogical - I submit YOU are illogical to be a willing part of it... apk
Because phones don't have gyroscopes. They have accelerometers.