The way you tilt your mobile while you're using it could allow hackers to steal your pin numbers and passwords, according to new research.
Experts at Newcastle University analysed the movement of a smartphone as the keyboard was used. They say they cracked four-digit Android pins with 70% accuracy on the first guess and 100% by the fifth guess.
[...] Dr Maryam Mehrnezhad, from the university's school of computing science, said: "Most smartphones, tablets, and other wearables are now equipped with a multitude of sensors (gyroscope, rotation sensors, accelerometer, etc).
"But because mobile apps and websites don't need to ask permission to access most of them, malicious programmes can covertly 'listen in' on your sensor data." The team said it was able to identify 25 different sensors which come as standard on most devices.
[...] "And worse still, in some cases, unless you close them down completely, they can even spy on you when your phone is locked.
[...] The researchers found that everything you do - from clicking, scrolling and holding to tapping - led to people holding their phone in a unique way. So on a known webpage, the team was able to work out which part of the page the user was clicking on, and what they were typing, by the way it was tilted.
The pre-publication paper on arxiv adds examples of using iframes or additional tabs to capture sensor data when inputting passwords on webpages.
(Score: 3, Informative) by maxwell demon on Wednesday April 12 2017, @07:13AM (2 children)
When linking to arXiv, please link to the abstract page (I would have linked to a previous comment which explains in detail why, but the SN search function seems to be seriously broken).
The abstract link is: https://arxiv.org/abs/1602.04115 [arxiv.org]
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by kazzie on Wednesday April 12 2017, @08:51AM
As the submitter, I'll bear that in mind. I just used the PDF link that was cited by the BBC.
(Score: 0) by Anonymous Coward on Wednesday April 12 2017, @12:43PM
Try this one [soylentnews.org] or this one. [soylentnews.org]