Academic researchers have found a new way to determine the passcodes used on smartphones and tablets.
- The technique they describe in a recent paper relies on the microphones found in most handheld devices to detect the sound waves users generate when they tap on their screens.
- The technique they created was able to guess nearly three-fourths of the four-digit PINs used within 10 tries in one test.
Hackers may be able to figure out the passcode to your smartphone by just listening in.
Malware can be designed to take advantage of the microphones in handheld devices to compromise their users’ passwords and PINs, researchers at the University of Cambridge in England and Sweden’s Linkping University reported in a recent paper . The technique they describe, which relies on machine learning, isn’t foolproof, but was able to accurately guess more than half of four-digit PINs used on Android tablets in one test case.
“We showed that the attack can successfully recover PIN codes, individual letters and whole words,” researchers Ilia Shumailov, Laurent Simon, Jeff Yan, and Ross Anderson said in the paper, which wasfirst reported by the Wall Street Journal on Wednesday . “We have shown a new acoustic side-channel attack on smartphones and tablets,” they continued, and described how to exploit it effectively.”
The paper has yet to be peer reviewed, but was published on a site Cornell University maintains for academic research studies.
The technique relies on sound waves and microphones
When people tap on the screens of their smartphones and tablets, they generate sound waves. Most contemporary handheld devices have multiple microphones that they use for voice calls, recording voice memos, and more.
The researchers used the devices’ microphones to detect the soundwaves generated by passcode taps. By tracking which microphone heard the sound first a difference that could be measured in fractions of a second the software they created could make educated guesses about where on the screen the sound originated, allowing it to predict which key a user tapped.
The system they created was able to correctly guess a four-digit passcode 73% of the time after 10 tries in one test. In another test, it was able to identify 30% of passwords ranging from seven to 13 characters in length after 20 tries.
In order for hackers to exploit the vulnerability researchers found, they’d have to get their targets to install malware on their phones first, and the potential victims would have to allow that software to have access to their microphones. That could make the technique difficult to use in the real world, security researchers told the Journal. Most modern operating systems bar applications from using a device’s microphone unless users allow it.