13 ms·
The way people tilt their smartphone 'can give away passwords and pins'
- cosinetau 10y ago> They said they'd told all the major tech companies, like Google and Apple, about the risks but no-one has been able to come up with an answer so far. What about putting and end to tracking gestures?
- tboyd47 10y ago> We demonstrate how an inactive or even a minimised web page, using JavaScript, is able to listen to and silently report the device motion and orientation data about a user who is working on a separate tab or a separate app on the device. This is brilliant and well-explained. On page 6 of the PDF, the authors include a breakdown of the leakages they found in each browser family. The two that were most significant to me is Chrome's "Active/Other" leak on iPhones and Safari's "Locked" leak. I believe this means that malicious Javascript (1) on Google Chrome on an iPhone on an inactive tab, and (2) on mobile Safari while the screen is locked, can access tilt and motion data at a level of detail sufficient to deduce what the user is typing.
- jacquesm 10y agoAccelerometer data could be used too to figure out how long it took to move from one entry on a virtual keyboard to another reducing the search space considerably.
- plopz 10y agoIsn't Google Chrome on iPhones just a reskinned Safari since Apple doesn't allow other browsers to use their own engines?
- militantVagrant 10y agoBingo. It's not really Chrome at all. A better author would have pointed out that the iOS platform is flawed, its singular browser in any of its different wrappers is vulnerable in exactly the same way.
- tomglynch 10y agoWith machine learning these days I'm sure that accuracy will only increase too. > They say they cracked four-digit pins with 70% accuracy on the first guess and 100% by the fifth guess. I'd expect within a few months they could have 70% accuracy on the first guess for typing text/passwords.
- hex1848 10y agoYou can usually easily figure out someones connect the dots password simply by looking at the smudge marks on the screen.
- LeifCarrotson 10y agoSure, but you can't do that if you're a web page. This is about a malicious app or website listening to the accelerometer and gyro to determine what the user is typing on the keyboard into a separate app.
- collyw 10y agoI noticed this when holding my phone at an angle so the light made the smudges completely obvious.
- fao_ 10y agoThis is why I chose one that doubles back on itself in a non-obvious way. I've tested it by trying to teach people the password, it usually takes them quite a while to learn it, even when I do it really, really slowly and give them lots of tries
- ballenf 10y agoLast time I used this on Android, there were 9 points but I couldn't use any one more than once. You can double back in a very limited way, but the more complex patterns I wanted to use were impossible. I'm sure there's more written on this, but most patterns I've seen are just way too short. And hug the outer edge, are in-order, etc.
- koolba 10y agoI bet you could do this by analyzing a video of someone holding their phone too.
- andai 10y agoDid you see that video of analyzing microscopic (subpixel) changes in video to reconstruct audio vibrations?
- koolba 10y agoNo do you have a link? That sounds nuts. So by analyzing a video you can recreate missing audio?
- dsfyu404ed 10y agoYou're still limited by your video receiver and limited knowledge of what's going on the background. Using commodity hardware and visible spectrum light this technology shouldn't yet be used for more than very simple tasks. Even humans are very prone to "glass of juice" vs "gas the jews" type errors.
- jamessb 10y agoThere was a 2014 SIGGRAPH submission called "The Visual Microphone" [1]; it is also discussed in the 'research highlights'section of the Communications of the ACM [2]. [1]: https://people.csail.mit.edu/mrub/VisualMic/ https://people.csail.mit.edu/mrub/VisualMic/ [2]: https://cacm.acm.org/magazines/2017/1/211095-eulerian-video-magnification-and-analysis/fulltext https://cacm.acm.org/magazines/2017/1/211095-eulerian-video-...
- skamoen 10y agoAs a university project, I did something very similar, only using a malicious app. The app would monitor the device state, and record gyro data as soon as the screen was on, but the device was locked. We didn't have the time to properly implement a decent classifier, but the data collection was surprisingly effective.
- imjustsaying 10y agoBrilliant. Did you upload the source anywhere?
- maaaats 10y agoRelevant: A friend of mine analyzed lock patterns for her thesis. Got some press: https://arstechnica.com/security/2015/08/new-data-uncovers-the-surprising-predictability-of-android-lock-patterns/ https://arstechnica.com/security/2015/08/new-data-uncovers-t... The patterns are predictable, and can be further narrowed down if you now the hand they normally use.
- dafrankenstein2 10y agoher findings that females are more likely to use simple patterns is interesting..haha
- pbhjpbhj 10y agoThat surely is an interesting finding, especially if it can be confirmed. Null hypothesis: females in general are more trusting and [consider themselves more] trustworthy. As humans we tend to project our own morality on to others, thus expecting people to be less likely to try and attack their stuff and so being less desirous of strong protection?
- idanoeman 10y agoWouldn't the null hypothesis be no gender difference, with gender difference in either direction to be proven by experiment?
- pbhjpbhj 10y agoWe're using alternate definitions: I'm using "my null hypothesis", as in my zero-numbered hypothesis that I would then attempt to test for. You're using, presumably "the Null Hypothesis" as a specific hypothesis suggesting that two populations have no causal relationship [IIRC]. My null-ordered labelling just confused my hypothesis with a particular default used in some statisitical arenas AFAICT.
- AnimalMuppet 10y ago
- kinkora 10y agoInterestingly novel! In my university days, long before the days of tablets and smartphones, the computer labs were the usual place where people will congregate to do their assignments or basically kill time on the internet in between classes. One day, my mates and I noticed how annoyingly loud some people type on their keyboards and out of sheer boredom, we decided we could come up with an algorithm to determine what a person was typing simply from recording the sound of the keystrokes from our vantage point. Taking that sound clip, we graphed it out and we proceeded to hash out each "stroke" based on how loud it was in relation to the distance of where we were from the keyboard + the angle of the keyboard. Fun times ensued. ;)
- NoCoastCoder 10y agoAnd this worked? Seems hard to believe.
- nerdponx 10y agoI think I read about a similar "keylogging" technique in Popular Science at one point.
- trendia 10y agoResearchers recover typed text using audio recording of keystrokes (2005) [0] [0] http://www.berkeley.edu/news/media/releases/2005/09/14_key.shtml http://www.berkeley.edu/news/media/releases/2005/09/14_key.s...
- purrcat259 10y agoTurns out my ducky blues mechanocal keyboard has a big disadvantage when it comes to this then
- cmdrfred 10y agoIt would cut entropy down by a great deal if you even simply knew how long the password was.
- rangibaby 10y agoI saw an ATM before that scrambled the number pad on it's touchscreen so the numbers were in a different position every time. Would that work to mitigate this attack?
- dafrankenstein2 10y agothis may work for ATM because you are not using it several times a day, even in a week. but scrambling will make bad UX in smartphones.
- lostlogin 10y agoI can't remember when I last used an ATM (maybe 5 years ago?) and haven't seen the one near work used much so checked usage stats. It's more common here than I thought (as are cheques) but it's not used much. http://www.paymentsnz.co.nz/articles/nz-payments-stats-a-year-in-review http://www.paymentsnz.co.nz/articles/nz-payments-stats-a-yea...
- blazespin 10y agoWell, I think for 95% of the world this isn't required. But for the 5% who need the security, they'll put up with the UX.
- Orangeair 10y agoThere's an option to do this in many third party Android ROMs, which I personally take advantage of. I don't think it's really "terrible ux"; it hasn't been that hard to adjust to.
- mpeg 10y agoIn fact, if the numbers on the lockscreen are not scrambled, a low-tech version of this is to look at where the most prominent smudges are on the screen to find the PIN number :)
- castis 10y agoThis works particularly well with the pattern matching option on android devices.
- InitialLastName 10y agoThis is a great justification for fingerprint unlocking... I almost never need to enter my pin, either at home or (especially) in public.
- theoh 10y agoFingerprints are "something you have", but for multi-factor authentication you might also want to rely on "something you know". This news just indicates a problem of entering "something you know" into a device: it's definitely not a point in favour of fingerprint (they aren't simply alternatives)
- driverdan 10y agoSource with more details: https://blogs.ncl.ac.uk/security/author/b2031864/ https://blogs.ncl.ac.uk/security/author/b2031864/
- joveian 10y agoMuch better source, thanks!
- tomjakubowski 10y agoInteresting how the blog post is from Feburary 2016, while the news story covering it is dated April 2017.
- tomjakubowski 10y agoThe authors' paper link is to a closed access journal, but a preprint is thankfully available here: https://arxiv.org/abs/1602.04115 https://arxiv.org/abs/1602.04115
- abecedarius 10y agoNice hack. I've been using my phone for less and less over the years, out of security concerns, since it's my 2fa device and I sometimes check email with it. After the Broadcom wifi thing I even stopped carrying it around. I guess it's past time to buy a dedicated 2fa device.
- ZeroManArmy 10y agoWhere would you buy one? I'd love to have one myself.
- skibble 10y agoYubiKeys are supposed to be great. I don't have one myself — been mulling it over, but not sure if I need one since I have an authenticatior app on my phone. If anyone thinks I should though I'm all ears!
- wruza 10y agoIf 2fa through SMS, then maybe any dumbphone is okay? Google 1st: https://security.stackexchange.com/questions/150153/is-a-dumbphone-mobile-more-secure-for-basic-phone-calls-than-a-smartphone https://security.stackexchange.com/questions/150153/is-a-dum...
- pmiller2 10y agoSMS itself isn't all that secure.
- JadeNB 10y ago> SMS itself isn't all that secure. But isn't the point of 2FA that it's OK to have each of the factors individually be (relatively) insecure—passwords being about as insecure as imagineable for most users—as long as no-one is likely to have access to both of them? Thus, it's OK if someone can read your texts, as long as they don't also know your passwords.
- SerLava 10y agoI wonder if you could hold the phone flat in one hand and press the buttons with the other hand to defeat this. Or wobbling while entering it one-handed.
- AstralStorm 10y agoYou still get timing data from the taps.
- SerLava 10y agoRandom delay?
- tapmap 10y agoThis is why using fingerprint sensors makes sense. Impossible to guess this.
- nols 10y agoFingerprints have plenty of their own issues though. http://www.theverge.com/2016/5/2/11540962/iphone-samsung-fingerprint-duplicate-hack-security http://www.theverge.com/2016/5/2/11540962/iphone-samsung-fin...
- AstralStorm 10y agoPretty easy to come by a set of them locally though.
- dwighttk 10y agoHow about not letting javascript run when the phone is locked? Heck, on my phone I'd be fine with not letting it run when the browser tab isn't active. What use case am I not thinking of here?
- andai 10y agoDistributed mining ;)
- reitanqild 10y agoOn desktop FF I have an extension that prevents JavaScript from running in background tabs unless whitelisted. Saves a lot of CPU if I have google search result in background tabs.
- winter_blue 10y agoWhat is this extension called? I use FF, and I'd love to turn this on for most of my background tabs (except for a few like GMail).
- reitanqild 10y agoNot in front of my computer now. If you check back tomorrow I might have added it here or to my profile. : )
- reitanqild 10y agoSuspend tab by Piri (piro_or) is the one on my laptop at least. In the description it also mentions other extensions, especially suspend-background-tabs looks like something I might be using on one of my/someone elses machine.
- dwighttk 10y agoalso, I'm realizing that I've told people "you don't need to quit apps in iOS, it takes care of memory itself" but quitting browsers sounds like it is a good idea now.
- stefs 10y ago"Obviously most hackers wear hoodies and stand in dark rooms" finally!
- deleted 10y ago[deleted]
- tmsldd 10y agoQuick Fix: at OS level, temporarily disable all sensors while typing on the virtual keyboard.
- seccess 10y agoThis attack has been known since at least 2011: https://www.usenix.org/legacy/event/hotsec11/tech/final_files/Cai.pdf?wptouch_preview_theme=enabled https://www.usenix.org/legacy/event/hotsec11/tech/final_file...
- canuckintime 10y agoBlackberry released an excellent app[1] for Android phones that helps solve this. Any option for iOS? Can someone recommend a good 4way privacy screen protector? [1] http://www.theverge.com/2017/3/23/15038364/blackberry-privacy-shade-app-smartphone-feature http://www.theverge.com/2017/3/23/15038364/blackberry-privac...
- dwighttk 10y agoThat app makes it a little harder for a stranger to read what's on your screen, it doesn't have anything to do with browser access to the accelerometer and other sensors.
- canuckintime 10y agoHeh, I tend to tilt my device a particular way to avoid prying eyes when typing in a password so I assumed a direct connection but others probably don't behave the same way
- dwighttk 10y agothere won't be an iOS app that can do that unless you jailbreak
- wh-uws 10y agoThis attack and an annoyance that I see on Android from time to time could be easily mitigated if in Chrome if they would simply ship permissioning for access to hardware devices. There is this annoying popup add that infects the ad networks of a few websites that first smashes the history of the tab and then vibrates your phone and has a page with a bunch of red warning text telling you that you have a virus, your phone is "damaged" and trying to get you to download some crappy virus scamware. No way in hell a random website should be able to make your phone vibrate without your permission much less tell how its moving with the accelerometer. I've google around a lot there is NO WAY to disable this :/
- trakout 10y agoChrome will soon require an SSL cert in order for web services to use the device orientation API, which is a step in the right direction, but ultimately doesn't help in prevention.
- deleted 10y ago[deleted]
- stefanve 10y agoBlackBerry solved this with their picture code lock http://n4bb.com/blackberry-10-getting-picture-password-unlock-screen/ http://n4bb.com/blackberry-10-getting-picture-password-unloc...
- anotheryou 10y agothis was proofed 2011 already https://www.extremetech.com/mobile/92946-a-wiggly-approach-to-smartphone-keylogging# https://www.extremetech.com/mobile/92946-a-wiggly-approach-t...
- Adverblessly 10y agoSorry for digressing from the main topic of the article, but isn't anyone else bothered by this terrible graph from the article https://cdn.arstechnica.net/wp-content/uploads/2015/08/alp-length-breakdown2-640x319.png https://cdn.arstechnica.net/wp-content/uploads/2015/08/alp-l... ? For example, the bar for Men's shopping password length is 3x-4x longer than for Women's, but in reality the value (in tiny font) is only ~8% greater (the others are ~4% and ~10%).
- carapace 10y ago(I remember reading that a phone on a desk could be used to figure out what you type on a keyboard on the same desk.)
- hbk1966 10y agoSimple solution to the codes, just place the numbers in random locations. I know Runescape used to do this with bank pins.
- ziikutv 10y agoThanks captain obvious!
- deleted 10y ago[deleted]
- ge96 10y agoI kind of can't wait till everything is biologically linked, I don't know if it's a good idea/cost effective. There's usually that scene in horror movies, removing eyeballs, removing hands/fingers etc... for biometric security. Still the thought of someone snatching my wallet and swiping away at my cards. Where as if the card wasn't "active" unless my hand was the one holding it, I don't know how... finger print, pulse, heat, embedded RFID chip activates the card... I don't know. think DNA-linked money too, but someone could steal your hair... I don't know, I'm just not going to carry more than $20.00 on me in any form of money. random thought too: when everyone has their own API and this replaces social media, why would that happen I don't know. If people had custom readers to pull in a person's data.
- nippoo 10y agoThe solution to this - for PINs and passwords at least - is to scramble the keyboard layout. It's slow, but if you're typing in a 6-digit PIN it doesn't take that long.
- avip 10y agoUnbait yourself: >Based on a test set of fifty 4-digit PINs
- ge96 10y agoI thought you just make the key board random every stroke and the human has to pick the right, next letter so it's not predictable with a known pattern. edit: I like that "Obviously hackers wear hoodies..." hahaha, I like to wear a mask, and see as little as possible, while I mash on the keys hacking into the NSA. edit: it's not funny though when you happen to see your server logs and you see various attempts to break in using wordpress-access attacks like forget the one xmlrc or something... I don't use Wordpress but man... gotta keep an eye on those logs. Also tracked one of the ips, lead to some site called BoltCloud, looks legit, with a login but... I don't know... not sure if you can bounce attacks from a server without that server's permission.