A scary new hack created by researchers can accurately guess your password by listening to the sound of your fingers tapping the phone screen
- Academic researchers have found a new way to determine the passcodes used on smartphones and tablets.
- The technique they describe in a recent paper relies on the microphones found in most handheld devices to detect the sound waves users generate when they tap on their screens.
- The technique they created was able to guess nearly three-fourths of the four-digit PINs used within 10 tries in one test.
- Visit Business Insider's homepage for more stories.
Hackers may be able to figure out the passcode to your smartphone by just listening in.
Malware can be designed to take advantage of the microphones in handheld devices to compromise their users' passwords and PINs, researchers at the University of Cambridge in England and Sweden's Linköping University reported in a recent paper. The technique they describe, which relies on machine learning, isn't foolproof, but was able to accurately guess more than half of four-digit PINs used on Android tablets in one test case.
"We showed that the attack can successfully recover PIN codes, individual letters and whole words," researchers Ilia Shumailov, Laurent Simon, Jeff Yan, and Ross Anderson said in the paper, which was first reported by the Wall Street Journal on Wednesday. "We have shown a new acoustic side-channel attack on smartphones and tablets," they continued, and described how to exploit it effectively."
The paper has yet to be peer reviewed, but was published on a site Cornell University maintains for academic research studies.
The technique relies on sound waves and microphones
When people tap on the screens of their smartphones and tablets, they generate sound waves. Most contemporary handheld devices have multiple microphones that they use for voice calls, recording voice memos, and more.
The researchers used the devices' microphones to detect the soundwaves generated by passcode taps. By tracking which microphone heard the sound first - a difference that could be measured in fractions of a second - the software they created could make educated guesses about where on the screen the sound originated, allowing it to predict which key a user tapped.
The system they created was able to correctly guess a four-digit passcode 73% of the time after 10 tries in one test. In another test, it was able to identify 30% of passwords ranging from seven to 13 characters in length after 20 tries.
In order for hackers to exploit the vulnerability researchers found, they'd have to get their targets to install malware on their phones first, and the potential victims would have to allow that software to have access to their microphones. That could make the technique difficult to use in the real world, security researchers told the Journal. Most modern operating systems bar applications from using a device's microphone unless users allow it.Read more about digital security and privacy:
- Apple iPhones and iPads are still missing a feature that's critical for parents and workers. And it's even more baffling now that it's available on Apple TV.
- Apple is taking on Facebook and Google by doubling down on privacy, but the plan could backfire in an epic way
- President Trump's national emergency likely won't stop you from buying a Huawei phone, much less an iPhone. Here's what it means for you.
- Internet pioneer Paul Vixie thinks we're giving up both privacy and speed thanks to the way we've configured our internet connections
Receive a single WhatsApp every morning with all our latest news: click here.
Also from Business Insider South Africa:
- Take a look: South Africa's new R2 and R5 coins
- A 31-year-old South African innovator’s medicine-dispensing Pelebox just won another R470,000 international prize
- Here’s why the majority of homes being built in SA now are flats or townhouses
- These are the 10 most expensive streets in Gauteng - and nine of them are in the same suburb
- FNB’s eBucks will soon give you 15% back on KFC meals - as long as you aren't too rich, or too poor
- Earn less than R500,000 a year? SARS says you don't have to file returns - here's why you probably should