10 ms·
Thermal images reveal what parts of a screen were tapped
- nkassis 10y agoSolution add a feature to warm up the screen to exactly 98 degrees to avoid detection. Learned this from sneakers.
- oh_sigh 10y agoOr present a random 5 digit pin the user needs to enter before entering their personal pin. If the user has touched every button, then you get no information from that.
- kardos 10y agoFrom the thermal photo in the article, it looks like you get the sequence based on the residual heat intensity. Re-using digits would complicate that a bit, but I don't think pressing half of the buttons randomly before entering the real code eliminates the attack vector.
- knodi123 10y agoA scramble-pad is a perfect solution to this issue. But if you're not going to allow that, but you will allow impractically complicated solutions, then I think you'd be better off asking them to use their pin in a math problem. The CPU could easily choose one that didn't require remainders, to keep it mentally simple.
- zeroer 10y agoSure. Just concatenate a 256-bit nonce to your PIN, calculate the SHA-512 of the concatenation, and then type the last 4 hex digits of the hash. Easy!
- knodi123 10y agoIn my head, in less than a few seconds, I can take any PIN, calculate AES-encrypt it with a randomly chosen key, calculate the MD5, multiply the result by 65536, and then quickly type the least-significant 4 hex digits. Is that good enough?
- Lost_BiomedE 10y agoFor more sensitive areas, scramble pads are usually used. Solves a lot of security issues if you think anyone will go through much effort to get into an area.
- cmdrfred 10y agoFor anyone curious like myself: https://www.identiv.com/products/physical-access/utrust-physical-access-readers/utrust-scramblepad-readers https://www.identiv.com/products/physical-access/utrust-phys...
- rahkiin 10y agoWouldn't this burn your fingers?
- ksenzee 10y agoThey meant 98 degrees Fahrenheit - body temperature.
- CapitalistCartr 10y ago98F (37C) is approx. body temperature, so of course, it wouldn't harm a human body.
- Philomath 10y agoThe classic units of measurement problem. As an Aerospace engineer, I state the importance of using the proper units in any calculation.
- nkassis 10y agoYeah valid point. I should know better having moved from a metric country (except for pool temperature for some reason) to the US ;p
- alex- 10y agoAnother (cheaper?) solution would be to randomise the location of the keys each unlock attempt. It would cause me a massive problem - I basically only remember my pattern
- prawn 10y agoOne of my banks does this for online PIN entry and it's amazing how much it slows you down not being able to do it via muscle memory.
- macspoofing 10y agoOr move the location of the keys around the screen (but keep the order)
- ComodoHacker 10y agoIt would also make it impossible to unlock device off-sight (in the pocket) and increase chances of shoulder-surfing. The proper solution would be let user draw some figure anywhere on the screen then OCR it.
- Qantourisc 10y agoAndroid -> Settings -> Lock screen -> Scramble pin layout. If you are talking in general, hmmm yea hard, especially if it's mandatory.
- test1235 10y agoI use a pattern for my unlock, and you don't even need thermal imaging - you can see the smear left on the screen by my finger.
- Groxx 10y agodownside: oil from your fingers would cause the touched zones to retain / lose heat at a different rate.
- CamelCaseName 10y agoI've seen heated keypads at ATMs.
- nom 10y agoThis is nothing new. I remember an article/paper about the same thing but with pin pads. Keep in mind, it only works for a very short amount of time as the surface cools down quickly. I don't think it's an attack vector you should worry about. You can just as easily shoulder-surf the user as he unlocks the phone. It works even better with the "stroke gestures" that is common on android devices - most users don't disable the "draw line" option... it's much easier to spot and remember than a pin pad entry :D
- WestCoastJustin 10y agoDefinitely not new. You can easily do this with off the shelf FLIR handheld devices. Used to work in a data centre and our electrician would use the FLIR to inspect electrical panels for faulty breakers. We were chatting about the FLIR and she was like watch this, put your hand on the table then remove it, you could point the FLIR at the table 10-20 seconds later and still see your hand imprint. Was very cool. I think it cost ~$10k or something though.
- k_sh 10y agoAs mentioned upthread, FLIR offers smartphone attachments for ~$250 nowadays. Dunno about the quality w/r/t the professional-grade stuff, though.
- jimmaswell 10y agoSometimes you can unlock people's phones by holding them up to the light and seeing where the grease marks are, if they use the dot pattern unlock or a small pin. Got a few people with this in high school.
- nom 10y agoI was about to mention this in my post but wanted to keep it short :D. The smudge marks are probably as good of an indicator as the heat signature, considering that they don't degrade with time. It also works better with the pattern-type unlock screen on android (but not so well with the pin-type). That reminds me, you could build a system that records and highlights the smudges (by using a circular arrangement of LEDs and a fixed camera, or by taking pictures from multiple angles under a single light source). It should make a good weekend project, maybe I'll try it :)
- Exofunctor 10y agoI recommend that everyone use an extended-length PIN for your phone. Both Android and iPhone support it. Mine is 12 digits; a bit of extra time, but vastly more difficult to brute-force or shoulder-surf.
- fpoling 10y agoWhy digits and not a real password? I have found that typing 10 letters is not too inconvenient on a phone.
- bradknowles 10y agoThe size of the alphanumeric keyboard is a real problem for me when trying to enter a password to open my device. Sure, I can do it, but it really slows me down, and makes the value of the password a lot less to me. I'd rather use a longer and more complex PIN on a much larger keyboard. Preferably one that re-uses at least some of the numbers, so they might have an idea of how long the PIN is, but they might have a harder time figuring out what the correct order of the numbers is. At least, that's my current view. That might change tomorrow. ;)
- cortesoft 10y agoDoesn't this depend on how worried you are about brute force and shoulder surfing? I am pretty sure in 99.9% of the time that someone is trying to access my phone for nefarious purposes is going to be someone who stole my phone when I left it somewhere. I have no reason to worry about an advanced attacker. In this case, why would I make the trade off of convenience for security? I have to do 3 times the work to try to defend against an insanely rare attack.
- raziel2701 10y agoThis was a common mechanic in the splinter cell games, you'd wait for a guard to go through a door with a keypad and you'd put on your thermal vision goggles to find the 4 numbers. I guess that now that thermal cameras are becoming more ubiquitous this has jumped closer to reality. Back then I can't imagine there were thermal cameras that were small and cheap. Nowadays you can get a flir lens for your phone at about $200 - $300 if I recall correctly.
- wlesieutre 10y agoYep, $250 for the FLIR One [1] or Seek Compact [2]. FLIR has a new version [3] launching Q2 for $200. [1] http://www.flir.com/flirone/ios-android/ http://www.flir.com/flirone/ios-android/ [2] http://www.thermal.com/products/compact/ http://www.thermal.com/products/compact/ [3] http://www.flir.com/flirone/products/?id=81752 http://www.flir.com/flirone/products/?id=81752 These things are really cool, we use a standalone one in my office for thermal testing products. It's not just fingers on screens, you can see footprints from someone walking across the floor.
- graedus 10y agoVery cool - any thoughts on the relative strengths and weaknesses of the FLIR vs Seek models?
- wlesieutre 10y agoNo personal experience with either. But my quick internet impression: the FLIR's main advantage is that it has a second (higher resolution) visible light camera, which it uses to add an edge detail overlay to the image. The disadvantage is that it has its own battery and has to be recharged. http://www.phonearena.com/news/Battle-of-the-thermal-imaging-cameras-FLIR-ONE-vs-Seek-Thermal-Compact_id78033 http://www.phonearena.com/news/Battle-of-the-thermal-imaging...
- bradknowles 10y agoThe problem I had with the Seek model was that it connected to my phone via a Lightning connector, and there was no good way to ensure that connection remained solid. Dropped the thing the same day I got it, and it broke. Haven't tried one since. It's also hard to use them if you have any kind of a case on your phone. If I had one that worked via Bluetooth or Wifi, or was built into a phone case, or had a longer cable that I could route around my existing case, then I might give it another try. Short of that, I'm looking forward to the standalone model.
- deleted 10y ago[deleted]
- givinguflac 10y agoMost of this risk is mitigated with finger print auth like Touch ID. Though, nothing is perfect.
- fnordfnordfnord 10y agoFingerprint auth exposes you to court-ordered unlocking though.
- knodi123 10y agonot necessarily, if you use several sequential fingerprints in a certain order, and have a hard lockout after X failures. My phone knows 6 of my fingerprints already; shouldn't be hard to get that additional level of "something you know" in addition to "something you are".
- knodi123 10y agoI wonder why someone would downvote this without reply? It's a perfectly reasonable suggestion, would be trivial to implement, and would be both a password and a biometric. That's two-factor authentication. Somebody's a real humbug.
- Shivetya 10y agowith Apple's rumored removal of a separate home button then multitouch unlock / swipe unlock can become a thing. Then how do you prove the user enabled the feature? With one finger recognition they can just compel you to try each finger and it should work. Still manufacturers need to add distress recognition. use the wrong finger and it dumps all of them requiring pin only
- omginternets 10y agoBiometrics aren't cryptographically secure. You can't deterministically derive a key from biometric data. Moreover, you can't rotate your keys.
- 10y ago
- ralf07 10y agoEasy fix. Number pad should come up with numbers in different random order each time.
- bch 10y agoThat'll break for people who use "shapes" on the keypad.
- knodi123 10y agocan't fix everything in one go. but a shape plus a fingerprint ought to keep out anyone except cat burglars and security researchers, at least for the moment.
- jasonkostempski 10y agoThat solution is even easier, take away the shapes option.
- function_seven 10y agoIt's not an option. It's what some people implement themselves when coming up with a PIN. Like "square" (4578) or "Z" (1379) or "triangle" (2792), etc. That being said, I don't think the loss of shape ability would be that big of a deal. Neither do I think this is something that needs to be defended against.
- Dylan16807 10y agoIt is an option. Make them use a randomized keypad when setting the pin, and make them enter it three times.
- function_seven 10y agoSorry, my phrasing was confusing. I meant that the pattern input isn't an "option" that phones provide, the way GP comment interpreted it. ("Take away the shapes option") Rather that it is a way some people use keypads. I didn't intend to say a randomized keypad isn't an option.
- randyrand 10y agoThe video they showed seems faked. Why do his other presses and swipes he makes after entering the password not show up in the thermal image? Why would they fake this?
- modzu 10y agono shit
- make3 10y agoLG phones have this optional feature to scramble the digits on the software touchpad so they aren't in the regular order (but a random one). This would be a start I feel; they would need to also actually get a picture of the software keypad instead of just an IR picture your screen however long after
- Markoff 10y agouseless attack since many phones are already randomizing number pad each time is displayed
- godmodus 10y agoIsn't this used for skimming ATMs? What's new about this?
- lathiat 10y agoWithout comment on this specific article, there was a video of this doing the rounds last year using a FLIR ONE on a card terminal. I subsequently saw another video debunking it. It only worked if you super cooled the pin pad, there was evidence of that in the original video; it was totally un-workable with a normal room temperature keypad. I imagine though it's likely highly variable though depending on the thermal conductivity and emissivity of the surface being touched, as well as the actual room temperature and the quality of the thermal sensor. EDIT: This random video seems to agree with the above, again, no idea how credible. Highly variable on factors. https://www.youtube.com/watch?v=8Vc-69M-UWk https://www.youtube.com/watch?v=8Vc-69M-UWk
- lithos 10y agoWhy haven't lock screens gone with floating/moving numbers yet. Or at least a pin pad that randomizes number positions. MMOs have had this 'comfort' feature since the late 90s as a antikeylogger feature.
- msimpson 10y agoGood thing I always carry my phone in the back of my jeans. Hot pocket, FTW.