"Smudge Attacks"

Some researchers from the University of Pennsylvania released an interesting paper (pdf) on touchscreens and smudges.

Anyone who has handled a touch screen of any sort knows that humans are greasy, oily creatures who leave a trail of secretions wherever our fingers tread and there's not much we can do about it, short of wearing finger condoms.




What might not have occurred to many people is that the trails of person-slime you leave behind could be a security risk, as aptly demonstrated in the above paper. They hypothesized that touchscreen devices using graphical passwords could be hacked by reading the smudge pattern. Smudges left on the screen could be examined to show the password "shape" as well as the order it is drawn in - as easily as taking a well-angled photograph and cranking the contrast. Their results were impressive: for one smudge scenario the whole pattern could be identified 68% of the time, with a partial identification 92% of the time. The experiment with "less than ideal" (left) smudging resulted in a 37% identification of part of the password pattern.



You know the future is here when people can gain access to your personal information by photographing your dirty phone.

Almost anything that uses physical contact to input security codes is fairly easily hacked in this way. Keypads, for example, get worn out in patterns, or you can dust for fingerprints or put residue on the keys and check which ones have been worn clean. (This is completely ignoring "sniffing" techniques like keyloggers or simple peeking) I am also reminded of an old CSI Miami episode involving a bluetooth laser keyboard.
I think the lesson to take away from this is change your password frequently and clean your screen often. Or keep it really, really dirty.
-----

Completely unrelated to the above, I was pleased to see the hypothetical attacker in the paper referred to as "she". (Remember, they as a neutral pronoun is informal and therefore doesn't often turn up in such publications)

0 things about

"Smudge Attacks"

Post a Comment

Copyright 2012 Phile not Found. See About
Powered by Blogger

"Whenever you find that you are on the side of the majority, it is time to pause and reflect."