Smartphone Password Vulnerability Discovered

A study from Nanyang Technological University, Singapore (NTU Singapore) has found a new security breach that hackers could use to guess your phone’s PIN code, using the phone’s physical sensors data.

Sensors in smartphones, like the accelerometer, gyroscope and proximity sensors represent a potential security vulnerability, according to electronics360.globalspec.com.

With a combination of information that was gathered from six different sensors from smartphones and state-of-the-art machine learning and deep learning algorithms, the researchers from NTU have succeeded in unlocking smartphones using the Android operating system with 99.5 percent accuracy within three tries when attempting to unlock a phone with one of the 50 most common PIN numbers.

Before this latest study, the best phone-cracking success rate was 74 percent for the 50 most common PIN numbers, but NTU’s technique can be used to guess all 10,000 possible combinations of four-digit PINs.

The team was led by Dr. Shivam Bhasin, senior research scientist at the Temasek Laboratories at NTU. The researchers used sensors in a smartphone to model which number had been pressed by the owner, based on how the phone was tilted and how much light is blocked by the thumb or fingers. 

The team took Android phones and installed a custom application that collected data from six sensors: accelerometer, gyroscope, magnetometer, proximity sensor, barometer and ambient light sensor. “When you hold your phone  and key in the PIN, the way the phone moves when you press one, five, or nine, is very different.  Likewise, pressing one with your right thumb will block more light than if you pressed nine,” explains Dr. Bhasin, who spent 10 months with his colleagues, Mr. David Berend and Dr. Bernhard Jungk, on the project.

The classification algorithm was trained with data that was collected from three people who each entered a random set of 70 four-digit pin numbers on a phone. At the same time, it recorded the relevant sensor reactions.

Using deep learning, the classification algorithm was able to give different weights of importance to each of the sensors, depending on how sensitive each was to the different numbers being pressed. This helps eliminate factors that it believes is less important and increases the success rate for PIN retrieval.

Even though each individual enters the security PIN on their phone differently, the scientists show that as data from more people is fed to the algorithm, success rates are improved.

While a malicious application might not be able to guess a PIN correctly right after installation, with machine learning it could collect data from thousands of users over time from each of their phones to learn their PIN entry pattern and then launch an attack later when the success rate is much higher.

Professor Gan Chee Lip, Director of the Temasek Laboratories at NTU, said this study shows how devices with seemingly strong security can be attacked with a side-channel, as a sensor data could be diverted by malicious applications to spy on user behavior and help access PIN, password information and more. “Along with the potential for leaking passwords, we are concerned that access to phone sensor information could reveal far too much about a user’s behavior. This has significant privacy implications that both individuals and enterprises should pay urgent attention to,” said Lip.

Dr. Bhasin believes it would be advisable for mobile operating systems to restrict access to the six sensors in the future so that users can actively choose to give permissions only to trusted apps that need them.

In order to keep your mobile devices secure, Dr. Bhasin says that users should have PINs with more than four digits with other authentication methods like one-time passwords, two-factor authentication and fingerprint or facial recognition.

I-HLS

You Might Also Read:

Mobile Battery Tracks You Online:

No Phone Is Safe from Hackers & Spies:
 

 

« GDPR Requirements, Deadlines And Facts
A Cyberattack Could Lead To A Nuclear Strike »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CyberArk Software

CyberArk Software

CyberArk is an established leader in privileged access management and offers the most complete set of Identity Security capabilities.

SiteGuarding

SiteGuarding

SiteGuarding provide website security tools and services to protect your website against malware and hacker exploits.

EY Advisory

EY Advisory

EY is a multinational professional services firm headquartered in the UK. EY Advisory service areas include Cybersecurity.

RIPS Technologies

RIPS Technologies

RIPS Technologies delivers automated security analysis for PHP applications as platform independent software or highly scalable cloud service.

Harel Mallac Technologies

Harel Mallac Technologies

Harel Mallac Technologies is a Mauritian organisation that has developed a strong network of ICT specialists with nodes across the African continent.

Cloudrise

Cloudrise

Cloudrise are elevating cloud security, data protection, and privacy through assessment, technology enablement, and process automation.

Lewis Brisbois

Lewis Brisbois

Lewis Brisbois offers legal practice in more than 40 specialties, and a multitude of sub-specialties including Data Privacy & Cybersecurity.

Clone Systems

Clone Systems

Clone Systems is an award winning global cloud based managed security as a service provider.

Qualcomm Technologies

Qualcomm Technologies

Qualcomm invents breakthrough technologies that transform how the world connects, computes and communicates.

Strike Graph

Strike Graph

The Strike Graph GRC platform enables Security Audits & Certifications.

ShardSecure

ShardSecure

ShardSecure Microshard technology eliminates data sensitivity, providing security, privacy and compliance beyond encryption.

Redhorse

Redhorse

Redhorse provides top-tier consulting to help clients address mission-critical government problems in National Security, Networking Technology, Energy and the Environment.

Redpoint Security

Redpoint Security

Redpoint Security is an application security consulting firm that is focused on all aspects of code security.

inWebo

inWebo

inWebo is the specialist in multi-factor strong authentication (MFA). We guarantee the security of data and identities in a digital world with increasingly important economic and political stakes.

BluSapphire

BluSapphire

BluSapphire is an industry-first, purpose-built, cloud-native, Hybrid XDR platform powered by AI and big data analytics.

Inroad Technologies

Inroad Technologies

Inroad Technologies provide IT services that help keep your business computers, servers and networks secure and trouble-free.