There are several different methods for unlocking a touchscreen device, ranging from the simple swipe across the screen to entering a numerical code in order to access the system’s apps. Regardless the method, they all involve one common element: hand motion.
This is proving to be a problem, you see, because today’s smartphone-supplied-accelerometers can actually observe and record the hand motion of an adjacent smartphone user, to allow a nearby thief the ability to more accurately guess the code used to unlock a particular gadget.
And it’s not a specific smartphone or tablet we’re talking about here: all major brands that feature this security feature are at risk.
The hand motion used to unlock a smart device can be observed and recorded from afar using an accelerometer found in most modern-day smartphones. (Via: androidwidgetcenter.com)
Taking a closer look
Dr. Adam J Aviv is a visiting professor at Swarthmore College (Pennsylvania). He’s also the lead author of “Practicality of Accelerometer Side Channels on Smartphones”, which was co-written with Benjamin Sapp, Matt Blaze, and Jonathan M. Smith. The paper describes how the accelerometer can be used for mischievous purposes.
From the team’s abstract:
Modern smartphones are equipped with a plethora of sensors that enable a wide range of interactions, but some of these sensors can be employed as a side channel to surreptitiously learn about user input. In this paper, we show that the accelerometer sensor can also be employed as a high-bandwidth side channel; particularly, we demonstrate how to use the accelerometer sensor to learn user tap and gesture-based input as required to unlock smartphones using a PIN/password or Android’s graphical password pattern. Using data collected from a diverse group of 24 users in controlled (while sitting) and uncontrolled (while walking) settings, we develop sample rate independent features for accelerometer readings based on signal processing and polynomial fitting techniques.
The sensor in question is the accelerometer that logs phone movements in three dimensions: up and down, side to side, and forward and back. It’s primarily used in games to steer or guide things like cars, balls, etc.
During the study, the team altered the component’s purpose to record the unlocking gesture movements of nearby gadget holders (sitting). They then developed a prediction model that showed the sensor was able to classify the PIN entered 43% of the time and pattern 73% of the time within 5 attempts when selecting from a test set of 50 PINs and 50 patterns.
Worth noting is that the accelerometer’s accuracy suffered when users walked around with the gadgets; doing this created a lot more “noise,” which, according to Dr. Aviv, made it harder to pick out the unlock patterns.
Why are people able to do this?
The problem is that data gathered by sensors are not subject to the same controls that govern other phone functions. A good case in point: apps. A user needs to grant the program permission to collect data while the app is in use. On the flip side, users do not have to grant permission to the component of a device — in this case, an accelerometer — to gather data, even if the information that gets grabbed has nothing to do with the app they’re using.
Along with Dr. Aviv’s paper, researchers are also starting to look at the sort of data that can be gathered by other smartphone sensors, including gyroscopes, orientation sensors, and more.
“We are starting to realize that the way we interact with these devices affects the security of these devices,” he said. “The fact that we hold them in our hands is different to the way we use traditional computers and that actually can leak information to sensors in the device.”
Read Dr. Aviv’s paper for yourself (free to download).
Story via bbc.co.uk
Advertisement
