Slashdot Mirror
Researchers Used Sonar Signal From a Smartphone Speaker To Steal Unlock Passwords (vice.com)
An anonymous reader quotes a report from Motherboard: On Thursday, a group of researchers from Lancaster University posted a paper to arXiv that demonstrates how they used a smartphone's microphone and speaker system to steal the device's unlock pattern. Although the average person doesn't have to worry about getting hacked this way any time soon, the researchers are the first to demonstrate that this kind of attack is even possible. According to the researchers, their "SonarSnoop" attack decreases the number of unlock patterns an attacker must try by 70 percent and can be performed without the victim ever knowing they're being hacked. The attack begins when a user unwittingly installs a malicious application on their phone. When a user downloads the infected app, their phone begins broadcasting a sound signal that is just above the human range of hearing. This sound signal is reflected by every object around the phone, creating an echo. This echo is then recorded by the phone's microphone. By calculating the time between the emission of the sound and the return of its echo to the source, it is possible to determine the location of an object in a given space and whether that object is moving -- this is known as sonar.
The researchers were able to leverage this phenomenon to track the movement of someone's finger across a smartphone screen by analyzing the echoes recorded through the device's microphone. There are nearly 400,000 possible unlock patterns on the 3x3 swipe grid on Android phones, but prior research has demonstrated that 20 percent of people use one of 12 common patterns. While testing SonarSnoop, the researchers only focused on these dozen unlock combinations. Ten volunteers were recruited for the study and were asked to draw each of the 12 patterns five different times on a custom app. The researchers then tried a variety of sonar analysis techniques to reconstruct the password based on the acoustic signatures emitted by the phone. The best analysis technique resulted in the algorithm only having to try 3.6 out of the 12 possible patterns on average before it correctly determined the pattern.
The researchers were able to leverage this phenomenon to track the movement of someone's finger across a smartphone screen by analyzing the echoes recorded through the device's microphone. There are nearly 400,000 possible unlock patterns on the 3x3 swipe grid on Android phones, but prior research has demonstrated that 20 percent of people use one of 12 common patterns. While testing SonarSnoop, the researchers only focused on these dozen unlock combinations. Ten volunteers were recruited for the study and were asked to draw each of the 12 patterns five different times on a custom app. The researchers then tried a variety of sonar analysis techniques to reconstruct the password based on the acoustic signatures emitted by the phone. The best analysis technique resulted in the algorithm only having to try 3.6 out of the 12 possible patterns on average before it correctly determined the pattern.
Banana Republic! Then no one cares about anything.
The unlock pattern on my phone is just there to prevent buttdialing. I am no so concieted as to think anybody wants access to my phone. I don't use my phone for anything that matters enough. It's not the center of my life.
You can use an insanely elaborate way to read the password instead of just monitoring the input ?
Rube Goldberg would be proud.
While probably not a real security problem at this time, it nicely demonstrates what powerful hardware and software can to even with simple sensors.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The headline says "passwords" yet this is about patterns. Specifically, this is about the ~400,000 possible patterns you can get from a 3x3 pattern grid on Android.
OH WAIT IT'S NOT
It's about twelve specific ones.
Researchers used a microphone and speaker to record 10 different people performing each of the 12 most distinct patterns possible unlock patterns on a 3x3 grid 5 times each. On that data set of 600 recordings, their best-performing algorithm was able to get it down to an average of 3.6 pattern guesses until success.
Neat, maybe, but hardly a security concern. USE A FUCKING PASSWORD.
1. Trump goes to prison for life
2. Trump's phat booty is raped by a well-hung inmate daily
3. NO COLLUSION!
4. Trump pretends it never happened
5. Trump dies and is buried under the prison
The End
My unlock pattern is drawing creimer's face; it absorbs ultrasound! (And anything else even remotely edible)
I get that the sonar bit is clever, by why is it necessary to link that part with stealing passwords, other than to make it a little more press worthy.
Didn't they cover this in "The Dark Knight"?
https://www.scienceabc.com/humans/movies/how-scientifically-accurate-is-batmans-sonar-machine-in-the-dark-knight.html
This is perfect for all those air-gapped smartphones that can still download malicious apps off the internet.
If it takes on average 3.6 tries to guess which of 12 patterns a person uses, that's not a 70% reduction!
Random guesses pick which of 12 patterns a person uses within 6.5 tries on average. The correct percentage reduction isn't 8.4/12, it's 2.9/6.5, or 45%.
"When a user downloads the infected app, their phone begins broadcasting a sound signal that is just above the human range of hearing"
so... 5 kHz?
( too much loud rock music)
Sorry, but they weren't guessing out of the blue. They were guessing from a subset of only 12 combinations. 12. The real security issue here is that people only generally use 1 of 12 different combinations.
So what are the 12 patterns? Cursory searches do not reveal this interesting piece of info. Could be fun at parties.
-
All good stuff, but is " decreases the number of unlock patterns an attacker must try by 70 percent" right?
If there are 12 options and I guessed randomly, I'd expect to have to try 6 before I got it.
They reduced this to 3.6, which I make a 40% reduction - have I missed something?
Sure? I think it does for the simple reason it can't be turned into a bug.
Figure 1 in the paper: https://arxiv.org/pdf/1808.102...
Mostly variants (rotations and flips) of L, Z, and 1.
Avantslash: low-bandwidth mobile slashdot.
I'm now waiting for the first sonar based night vision app to come out :) Maybe something that enhances the low light camera?
I wonder how good it is with distance? Can you map a room with it?
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
I wonder how good it is with distance? Can you map a room with it?
It's not remotely like The Dark Knight, but a little bit.
He's getting rather old, but he's a good mouse.
20% of the time it works 70% of the time?
I mean that's still a decrease but this is the kind of security research that's much ado about nothing. Where's the threat to the consumer? Who's going to be using this? What would even be the reason/motive?
so they mostly drew a straight line. Whew, wouldn't want to have to repeat that multiple times.
Would have been quicker to just try the 12 combos.....no guarantee it scales either.
Anyone believe it can tell a 7 from an upside-down L ?
I am guessing it could detect 1 from L from Z. The 1's didnt help much but a Z helps alot, thus the average guess goes down.