4 ms·

Using Machine Learning to Guess Pins from Video

throwoutway 5y ago
>This works even if the person is covering the pad with their hands. That is incredible! It's not just ATM PINs this could apply to. It's not a stretch of the imagination to expect a state intelligence agency monitoring an embassy or a dissenter's apartment keypad and applying techniques like this
- PeterisP 5y ago
  IIRC there was a paper on recovering text, including passwords, from the keypress sound variation recorded by a microphone on the table next to the keyboard (e.g. in a compromised phone).
isoprophlex 5y ago
This is why scrambling keypad numbers isn't a totally user-hostile idea: https://twitter.com/tresdessert/status/1436767546460487680?s=20 https://twitter.com/tresdessert/status/1436767546460487680?s...
- pastage 5y ago
  The surveyed users had an accuracy of 8% doing the prediction manually in the same settings on an 5 digit pin. So scrambling seems like a good idea if you are going to use a PIN.
- PeterisP 5y ago
  Well, if the numbers were scrambled, then the user would need to look at them - so a video from the same perspective would record both the numbers and how they get entered, and it would not help in any way.
pastage 5y ago
https://arxiv.org/abs/2110.08113v1 https://arxiv.org/abs/2110.08113v1 I like that they include time estimates on this "several months of data acquisition", as they themselves nite this is bith fast and slow.
jaclaz 5y ago
I don't get it, really. They are comparing this with (good ol') card skimmers, but with those you get BOTH the data on the card (magnetic stripe or chip/whatever, i.e. you can - in theory - clone the card at leisure) AND the PIN, with these attack you ONLY get the PIN (possibly 4 times out of 10), so you need to somehow rob the user "on the spot" either by dexterity or at - say - gunpoint to get the card, it would be easier to just go for the money the customer just got from the ATM, you will have 10/10 success.
- franga2000 5y ago
  You'd be impressed how good some people are at stealing items off you in plain sight. There was a dude on a DEFCON talk I believe who could steal the watch right off of people's wrists and most people only noticed like a minute later - and they were paying attention. A skilled pickpocket could steal a card and be able to withdraw cash up to your limit at a back alley ATM compared. Theft is easy to conceal and deny, robbery (esp. armed robbery) is the exact opposite. As for skimmers, do any ATMs these days even accept magstripe? EMV cards are extremely difficult to clone so skimmers seem a bit useless.
  - jaclaz 5y ago
    Rest assured, I have some familiarity with pickpocketing[1], at least here (Italy) there is a hard limit on ATM's draws (it depends on the actual card of course) typically 500 Euro per day on ATM's of the same bank that issued the card or 250 on other banks. So you go to the ATM and draw 500 Euro from it, I then can choose, after having setup the camera, the AI (or whatever), a powerful computer to run it, etc. between pickpocketing the card, and then be able to draw - on average - 40% of either 250 or 500 Euro or pickpocketing the 500 Euro directly. (of course I cannot wait "tomorrow" as in the meantime you will have realized that you card is missing and blocked it). So, as I see it, this approach is only somehow an advantage if you draw less than or around 40% of 250 Euro, 100 Euro or so. [1] not direct experience but it was more or less "invented" in Italy, the first (unofficial) official school for pickpocketing assertedly dating back to 1864: https://www.fabriziosalce.it/la-scuola-per-borsaioli-del-balon/ https://www.fabriziosalce.it/la-scuola-per-borsaioli-del-bal...
DarthNebo 5y ago
I remember there being an app which could do the same for your phone using the Accelerometer/IMU readings & another approach which used the mics as well to pick up touch events
gingerlime 5y ago
I don’t know why I can’t get money from the ATM with apple pay. Wouldn’t it be more secure? No card. No pin. Alternatively maybe a TOTP with a seed via a QR code and entered on the pad? Surely there are better ways than a static pin…
- coolgeek 5y ago
  Because ATMs existed 30 years before Apple Pay? Because it would cost a great deal of money to add Apple Pay functionality to ATMs? Because adding other options increases the surface area of potential attacks - with technologies that are not within the scope of control of the ATM industry? And why just Apple Pay? Why not other options? When it comes to the financial system, consumer convenience is one of the lowest priorities.

>This works even if the person is covering the pad with their hands. That is incredible! It's not just ATM PINs this could apply to. It's not a stretch of the imagination to expect a state intelligence agency monitoring an embassy or a dissenter's apartment keypad and applying techniques like this

PeterisP 5y ago
IIRC there was a paper on recovering text, including passwords, from the keypress sound variation recorded by a microphone on the table next to the keyboard (e.g. in a compromised phone).

isoprophlex 5y ago

This is why scrambling keypad numbers isn't a totally user-hostile idea: https://twitter.com/tresdessert/status/1436767546460487680?s=20 https://twitter.com/tresdessert/status/1436767546460487680?s...

pastage 5y ago
The surveyed users had an accuracy of 8% doing the prediction manually in the same settings on an 5 digit pin. So scrambling seems like a good idea if you are going to use a PIN.
PeterisP 5y ago
Well, if the numbers were scrambled, then the user would need to look at them - so a video from the same perspective would record both the numbers and how they get entered, and it would not help in any way.

pastage 5y ago

https://arxiv.org/abs/2110.08113v1 https://arxiv.org/abs/2110.08113v1 I like that they include time estimates on this "several months of data acquisition", as they themselves nite this is bith fast and slow.

jaclaz 5y ago

I don't get it, really. They are comparing this with (good ol') card skimmers, but with those you get BOTH the data on the card (magnetic stripe or chip/whatever, i.e. you can - in theory - clone the card at leisure) AND the PIN, with these attack you ONLY get the PIN (possibly 4 times out of 10), so you need to somehow rob the user "on the spot" either by dexterity or at - say - gunpoint to get the card, it would be easier to just go for the money the customer just got from the ATM, you will have 10/10 success.

franga2000 5y ago
You'd be impressed how good some people are at stealing items off you in plain sight. There was a dude on a DEFCON talk I believe who could steal the watch right off of people's wrists and most people only noticed like a minute later - and they were paying attention. A skilled pickpocket could steal a card and be able to withdraw cash up to your limit at a back alley ATM compared. Theft is easy to conceal and deny, robbery (esp. armed robbery) is the exact opposite. As for skimmers, do any ATMs these days even accept magstripe? EMV cards are extremely difficult to clone so skimmers seem a bit useless.
- jaclaz 5y ago
  Rest assured, I have some familiarity with pickpocketing[1], at least here (Italy) there is a hard limit on ATM's draws (it depends on the actual card of course) typically 500 Euro per day on ATM's of the same bank that issued the card or 250 on other banks. So you go to the ATM and draw 500 Euro from it, I then can choose, after having setup the camera, the AI (or whatever), a powerful computer to run it, etc. between pickpocketing the card, and then be able to draw - on average - 40% of either 250 or 500 Euro or pickpocketing the 500 Euro directly. (of course I cannot wait "tomorrow" as in the meantime you will have realized that you card is missing and blocked it). So, as I see it, this approach is only somehow an advantage if you draw less than or around 40% of 250 Euro, 100 Euro or so. [1] not direct experience but it was more or less "invented" in Italy, the first (unofficial) official school for pickpocketing assertedly dating back to 1864: https://www.fabriziosalce.it/la-scuola-per-borsaioli-del-balon/ https://www.fabriziosalce.it/la-scuola-per-borsaioli-del-bal...

DarthNebo 5y ago

I remember there being an app which could do the same for your phone using the Accelerometer/IMU readings & another approach which used the mics as well to pick up touch events

gingerlime 5y ago

I don’t know why I can’t get money from the ATM with apple pay. Wouldn’t it be more secure? No card. No pin. Alternatively maybe a TOTP with a seed via a QR code and entered on the pad? Surely there are better ways than a static pin…

coolgeek 5y ago
Because ATMs existed 30 years before Apple Pay? Because it would cost a great deal of money to add Apple Pay functionality to ATMs? Because adding other options increases the surface area of potential attacks - with technologies that are not within the scope of control of the ATM industry? And why just Apple Pay? Why not other options? When it comes to the financial system, consumer convenience is one of the lowest priorities.