Smartphone Password Vulnerability Discovered

A study from Nanyang Technological University, Singapore (NTU Singapore) has found a new security breach that hackers could use to guess your phone’s PIN code, using the phone’s physical sensors data.

Sensors in smartphones, like the accelerometer, gyroscope and proximity sensors represent a potential security vulnerability, according to electronics360.globalspec.com.

With a combination of information that was gathered from six different sensors from smartphones and state-of-the-art machine learning and deep learning algorithms, the researchers from NTU have succeeded in unlocking smartphones using the Android operating system with 99.5 percent accuracy within three tries when attempting to unlock a phone with one of the 50 most common PIN numbers.

Before this latest study, the best phone-cracking success rate was 74 percent for the 50 most common PIN numbers, but NTU’s technique can be used to guess all 10,000 possible combinations of four-digit PINs.

The team was led by Dr. Shivam Bhasin, senior research scientist at the Temasek Laboratories at NTU. The researchers used sensors in a smartphone to model which number had been pressed by the owner, based on how the phone was tilted and how much light is blocked by the thumb or fingers. 

The team took Android phones and installed a custom application that collected data from six sensors: accelerometer, gyroscope, magnetometer, proximity sensor, barometer and ambient light sensor. “When you hold your phone  and key in the PIN, the way the phone moves when you press one, five, or nine, is very different.  Likewise, pressing one with your right thumb will block more light than if you pressed nine,” explains Dr. Bhasin, who spent 10 months with his colleagues, Mr. David Berend and Dr. Bernhard Jungk, on the project.

The classification algorithm was trained with data that was collected from three people who each entered a random set of 70 four-digit pin numbers on a phone. At the same time, it recorded the relevant sensor reactions.

Using deep learning, the classification algorithm was able to give different weights of importance to each of the sensors, depending on how sensitive each was to the different numbers being pressed. This helps eliminate factors that it believes is less important and increases the success rate for PIN retrieval.

Even though each individual enters the security PIN on their phone differently, the scientists show that as data from more people is fed to the algorithm, success rates are improved.

While a malicious application might not be able to guess a PIN correctly right after installation, with machine learning it could collect data from thousands of users over time from each of their phones to learn their PIN entry pattern and then launch an attack later when the success rate is much higher.

Professor Gan Chee Lip, Director of the Temasek Laboratories at NTU, said this study shows how devices with seemingly strong security can be attacked with a side-channel, as a sensor data could be diverted by malicious applications to spy on user behavior and help access PIN, password information and more. “Along with the potential for leaking passwords, we are concerned that access to phone sensor information could reveal far too much about a user’s behavior. This has significant privacy implications that both individuals and enterprises should pay urgent attention to,” said Lip.

Dr. Bhasin believes it would be advisable for mobile operating systems to restrict access to the six sensors in the future so that users can actively choose to give permissions only to trusted apps that need them.

In order to keep your mobile devices secure, Dr. Bhasin says that users should have PINs with more than four digits with other authentication methods like one-time passwords, two-factor authentication and fingerprint or facial recognition.

I-HLS

You Might Also Read:

Mobile Battery Tracks You Online:

No Phone Is Safe from Hackers & Spies:
 

 

« GDPR Requirements, Deadlines And Facts
A Cyberattack Could Lead To A Nuclear Strike »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Blue Solutions

Blue Solutions

Blue Solutions is a consultancy-led, accredited software distributor who provides IT solutions and support to small and medium enterprises.

Conceptivity

Conceptivity

Conceptivity provide risk management solutions in the areas of Supply Chain Security, Cyber Security and Critical Infrastructure Protection.

idappcom

idappcom

idappcom provides unique industry approved software solutions for auditing and enhancing the threat recognition and response capabilities of your corporate security defences.

Alpine Security

Alpine Security

Alpine Security provides penetration testing, security assessments and cybersecurity training services.

LinkShadow

LinkShadow

LinkShadow is a next-generation cybersecurity solution that provides unparalleled detection of even the most sophisticated threats.

Ukrainian Academy of Cyber Security (UACS)

Ukrainian Academy of Cyber Security (UACS)

UACS is a professional non-profit public organization established to promote the development of an extensive network and ecosystem of education and training in the field of cyber security.

SecurityGate

SecurityGate

SecurityGate.io is the only Integrated Risk Management platform built for OT/ICS cybersecurity.

Wontok

Wontok

Wontok deliver innovative value-added data security services that fill the gaps left in traditional security solutions.

Easy Dynamics

Easy Dynamics

Easy Dynamics is a leading technology services provider with a core focus in Cybersecurity, Cloud Computing, and Information Sharing.

Rhymetec

Rhymetec

Rhymetec are an industry leader in cloud security, providing innovative cybersecurity and data privacy services to the modern-day SaaS business.

Cybersecurity Dubai

Cybersecurity Dubai

Protect your business from cyber-attacks with Cybersecurity Dubai, your partner in online security solutions.

DV Cyber Security

DV Cyber Security

DV Cyber (formerly A76) is an innovative cyber security company vertically focused on Threat Intelligence and Cyber Security Research.

Nerds On Site

Nerds On Site

Nerds On Site provide on-site & in-home IT and technical support, managed IT services, and cyber security through our collaborative team of highly-trained IT and Security professionals.

Cysmo Cyber Risk

Cysmo Cyber Risk

Cysmo is an innovative cyber risk assessment platform specifically designed for the needs of the German insurance industry.

Clear Ridge Defense

Clear Ridge Defense

Clear Ridge was founded in April 2015 with the mission and vision to support Joint, Service Cyber Components, and commercial clients in specialized cyber support.

Lenze

Lenze

Lenze are an experienced partner for automation systems, digitalization and cyber security.