Slashdot Mirror
Researchers Used Sonar Signal From a Smartphone Speaker To Steal Unlock Passwords (vice.com)
An anonymous reader quotes a report from Motherboard: On Thursday, a group of researchers from Lancaster University posted a paper to arXiv that demonstrates how they used a smartphone's microphone and speaker system to steal the device's unlock pattern. Although the average person doesn't have to worry about getting hacked this way any time soon, the researchers are the first to demonstrate that this kind of attack is even possible. According to the researchers, their "SonarSnoop" attack decreases the number of unlock patterns an attacker must try by 70 percent and can be performed without the victim ever knowing they're being hacked. The attack begins when a user unwittingly installs a malicious application on their phone. When a user downloads the infected app, their phone begins broadcasting a sound signal that is just above the human range of hearing. This sound signal is reflected by every object around the phone, creating an echo. This echo is then recorded by the phone's microphone. By calculating the time between the emission of the sound and the return of its echo to the source, it is possible to determine the location of an object in a given space and whether that object is moving -- this is known as sonar.
The researchers were able to leverage this phenomenon to track the movement of someone's finger across a smartphone screen by analyzing the echoes recorded through the device's microphone. There are nearly 400,000 possible unlock patterns on the 3x3 swipe grid on Android phones, but prior research has demonstrated that 20 percent of people use one of 12 common patterns. While testing SonarSnoop, the researchers only focused on these dozen unlock combinations. Ten volunteers were recruited for the study and were asked to draw each of the 12 patterns five different times on a custom app. The researchers then tried a variety of sonar analysis techniques to reconstruct the password based on the acoustic signatures emitted by the phone. The best analysis technique resulted in the algorithm only having to try 3.6 out of the 12 possible patterns on average before it correctly determined the pattern.
The researchers were able to leverage this phenomenon to track the movement of someone's finger across a smartphone screen by analyzing the echoes recorded through the device's microphone. There are nearly 400,000 possible unlock patterns on the 3x3 swipe grid on Android phones, but prior research has demonstrated that 20 percent of people use one of 12 common patterns. While testing SonarSnoop, the researchers only focused on these dozen unlock combinations. Ten volunteers were recruited for the study and were asked to draw each of the 12 patterns five different times on a custom app. The researchers then tried a variety of sonar analysis techniques to reconstruct the password based on the acoustic signatures emitted by the phone. The best analysis technique resulted in the algorithm only having to try 3.6 out of the 12 possible patterns on average before it correctly determined the pattern.
Banana Republic! Then no one cares about anything.
The unlock pattern on my phone is just there to prevent buttdialing. I am no so concieted as to think anybody wants access to my phone. I don't use my phone for anything that matters enough. It's not the center of my life.
While probably not a real security problem at this time, it nicely demonstrates what powerful hardware and software can to even with simple sensors.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
My unlock pattern is drawing creimer's face; it absorbs ultrasound! (And anything else even remotely edible)
I get that the sonar bit is clever, by why is it necessary to link that part with stealing passwords, other than to make it a little more press worthy.
I also find the bit about it being just outside hearing range to be suspicious as well. In my experience what that really means is people like me will experience an insanely annoying high pitched sound barrage.
Didn't they cover this in "The Dark Knight"?
https://www.scienceabc.com/humans/movies/how-scientifically-accurate-is-batmans-sonar-machine-in-the-dark-knight.html
If there are 12 common patterns, just try all 12. It'd be faster than this Rube Goldberg setup.
This is perfect for all those air-gapped smartphones that can still download malicious apps off the internet.
If it takes on average 3.6 tries to guess which of 12 patterns a person uses, that's not a 70% reduction!
Random guesses pick which of 12 patterns a person uses within 6.5 tries on average. The correct percentage reduction isn't 8.4/12, it's 2.9/6.5, or 45%.
And when they say "reduces ... by 70%", that's really not true.
To try all 12 patterns, on average you'll get it in 6 guesses. So they're 3.6 guesses is a very small improvement.
More importantly, why would you even need the passcode at that point?
"When a user downloads the infected app, their phone begins broadcasting a sound signal that is just above the human range of hearing"
so... 5 kHz?
( too much loud rock music)
Sorry, but they weren't guessing out of the blue. They were guessing from a subset of only 12 combinations. 12. The real security issue here is that people only generally use 1 of 12 different combinations.
So what are the 12 patterns? Cursory searches do not reveal this interesting piece of info. Could be fun at parties.
-
All good stuff, but is " decreases the number of unlock patterns an attacker must try by 70 percent" right?
If there are 12 options and I guessed randomly, I'd expect to have to try 6 before I got it.
They reduced this to 3.6, which I make a 40% reduction - have I missed something?
Sure? I think it does for the simple reason it can't be turned into a bug.
Figure 1 in the paper: https://arxiv.org/pdf/1808.102...
Mostly variants (rotations and flips) of L, Z, and 1.
Avantslash: low-bandwidth mobile slashdot.
More importantly, why would you even need the passcode at that point?
People do insecure things like reuse passwords or minor variants.
This is about a pattern unlock. How often do those get reused?
why would you even need the passcode at that point?
You tell me why you asked the question
I'm now waiting for the first sonar based night vision app to come out :) Maybe something that enhances the low light camera?
I wonder how good it is with distance? Can you map a room with it?
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
I wonder how good it is with distance? Can you map a room with it?
It's not remotely like The Dark Knight, but a little bit.
He's getting rather old, but he's a good mouse.
Yes! They're comparing the number of attempts to the total number of possibilities. "Reduces by 70%" is accurate only if you declare that entering the patterns at random "reduces by 50%".
He's getting rather old, but he's a good mouse.
20% of the time it works 70% of the time?
I mean that's still a decrease but this is the kind of security research that's much ado about nothing. Where's the threat to the consumer? Who's going to be using this? What would even be the reason/motive?
Because you used the word "password" when the whole article is about unlock patterns. Just because I used words more similar to you doesn't mean I forgot what we were actually talking about.
Yeah good luck with that chief.
so they mostly drew a straight line. Whew, wouldn't want to have to repeat that multiple times.
Would have been quicker to just try the 12 combos.....no guarantee it scales either.
Anyone believe it can tell a 7 from an upside-down L ?
I am guessing it could detect 1 from L from Z. The 1's didnt help much but a Z helps alot, thus the average guess goes down.