Slashdot Mirror
Scientists Prove Your Phone's PIN Can Be Stolen Using Its Gyroscope Data (digitaltrends.com)
A team of scientists at Newcastle University in the UK managed to reveal a user's phone PIN code using its gyroscope data. "In one test, the team cracked a passcode with 70 percent accuracy," reports Digital Trends. "By the fifth attempt, the accuracy had gone up to 100 percent." From the report: It takes a lot of data, to be sure. The Guardian notes users had to type 50 known PINs five times before the researchers' algorithm learned how they held a phone when typing each particular number. But it highlights the danger of malicious apps that gain access to a device's sensors without requesting permission. The risk extends beyond PIN codes. In total, the team identified 25 different smartphone sensors which could expose compromising user information. Worse still, only a small number -- such as the camera and GPS -- ask the user's permission before granting access to that data. It's precise enough to track behavior. Using an "orientation" and "emotion trace" data, the researchers were able to determine what part of a web page a user was clicking on and what they were typing. The paper has been published in International Journal of Information Security.
So they are saying that if a malicious compromising app is already installed and running on your phone, then your phone could be compromised?
Were they on salary while determining this?
If I had a DeLorean... I would probably only drive it from time to time.
In 2017 everyone is a scientist. Even APK.
Long before touch-screens with capacitative sensing became commonplace there were some touch-screens systems that used a gyroscope as its sensor to sense how much the screen rocked when a user touched it.
It was very crude and inaccurate compared to other approaches but it could be mounted to most regular CRT computer monitors.
Unfortunately I have sold off my computer magazines from the early '90s so I can't look up the name of the manufacturer.
"We mustn't be caught by surprise by our own advancing technology" -- Aldous Huxley
Escalation of access is still an issue.
Personally I see the moral of the story as being the old one that security is weakened if you have to use the access method very frequently. That's one of the reasons why alarm systems often have a different code for each user instead of ending up with four numbers almost worn off the keypad after a few years.
How many days would elapse before the user had entered their PIN fifty times in their phone? I don't think it would be a very long time and the malware can wait.
If I'm a researcher entering a PIN multiple times I'm in a chair hunched over the phone. Me? I'm in my La-Z-Boy. I'm on the toilet. I'm in bed. I'm in the kitchen cooking. I'm at a red light getting a message. I'm in the grocery store unlocking my shopping list.
You really wanna tell me my gyroscope is in the same position in all these scenarios?
If you download from google store, every app has to ask permission.
this attack only works on those downloading from untrusted sources.
Pretty spiffy. Which cell phone?
File under 'M' for 'Manic ranting'
This could happen on any web page you happen to have visited and left open, in some cases the browser can be minimised and screen locked
https://link.springer.com/arti...
Just make an app that occasionally shows a fake unlock screen, and just capture the touches.
I will assume that this research was conducted using 4-digit PINs, which are the default for iOS and Android. I wonder how their success rate would hold up against, say, a 5-digit PIN, or 8, or N?
I generally rely on a biometric sign in for my phone*, but fall back on the PIN code once or twice per week. It's a whole lot more than 4 digits.
* I know, biometrics have their own set of risks; different conversation
This is an entirely sensible thing to do. You might have a game that uses the gyroscope. Embedded within that game there might be a rogue application that also uses the gyroscope data to measure the tilt as a result of using the keyboard, and report that along with your high score, or whatever to some game sever. If you have some security mode so when you are entering a password, it disables keyboard sharing, screen grabs, the camera (looking for reflections in you glasses) and the microphone (in case you say the numbers aloud) it must also disable the gyroscope and accelerometer. It does not matter that the process is not reliable - all we need to know is that is could work, so we can put in a fix.
Too often we learn what is possible after the event. We have to pay ingenious people to report weaknesses in the system. If you don't then the only ones working on it are the ones with something to gain.
1. write iphone app 2. record sensor data 3. sell PINs 4. profit!
Why did his statement get voted down? I think it's insightful satire.
As a firefighter, we are taught "Forcible Entry", because we may show up to a burning house and the homeowner may be able to answer the door. The first words out of the instructors mouth, Day 1, "locks keep honest people honest." Simple and profound.
Seems like the front door to your house and the front door to your phone are only as safe, as the moral society in which you live allows.
.... show up to a burning house and the homeowner may be able to answer the door.....
Ehem, may NOT be able to answer the door. LOL Too early for posting... need coffee.
For fuck's sake! There are no goddamn gyroscopes in mobile devices. What's used are accelerometers, which are non-spinning. Gyroscopes spin.
From the description the method is detecting which part of the screen you tap on. Thus if you use PIN keypad layout scrambling, such as in LineageOS they still won't know which digit you were tapping each time.
Because phones don't have gyroscopes. They have accelerometers.