Beware, Your Hands Reveal Your Secrets!

Shukla, Diksha; Kumar, Rajesh; Serwadda, Abdul; Phoha, Vir V.

doi:10.1145/2660267.2660360

Cited by 121 publications

(77 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some of the early work in this area rely on video footage filmed using a camera directly facing the screen or the keyboard [4,16]. Latest work shows that this limit can be lifted by exploiting spatial-temporal dynamics of the hands during typing [23]. Despite the success of video-based attacks on PIN-and textbased passwords, no work so far has exploited video-based side-channels to crack pattern lock.…”

Section: *Corresponding Authors: Zhanyong Tang and Zheng Wangmentioning

confidence: 99%

“…Our approach is to generate a set of candidate patterns for each of the Android pattern grids and the attacker can simply decide which set of candidate patterns to use after seeing the target device (at the time the layout of the grid will become available). However, unlike prior work on video-based attacks on keystroke based authentication [23], our approach does not require having knowledge of the console's geometry. In other words, the size of the screen or the position of the pattern grid on the screen does not affect the accuracy of our attack.…”

Section: Examples Of Filming Scenariosmentioning

confidence: 99%

“…Examples of these attacks include video-based attacks on keystroke-based authentication [23,33], sensor-based attacks for pattern lock [34]. Authentication methods that combine different authentication methods [10,19,25] to constantly checks the user's identity could be a solution.…”

Section: B Implicationsmentioning

confidence: 99%

“…Our work is inspired by the work presented by Shukla et al [23] on video-based attacks of PIN-based passwords. In addition to addressing the new challenges highlighted in Section I, our work differs to their approach in two ways.…”

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Cracking Android Pattern Lock in Five Attempts

Ye¹,

Tang²,

Fang³

et al. 2017

Proceedings 2017 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Abstract-Pattern lock is widely used as a mechanism for authentication and authorization on Android devices. This paper presents a novel video-based attack to reconstruct Android lock patterns from video footage filmed using a mobile phone camera. Unlike prior attacks on pattern lock, our approach does not require the video to capture any content displayed on the screen. Instead, we employ a computer vision algorithm to track the fingertip movements to infer the pattern. Using the geometry information extracted from the tracked fingertip motions, our approach is able to accurately identify a small number of (often one) candidate patterns to be tested by an adversary. We thoroughly evaluated our approach using 120 unique patterns collected from 215 independent users, by applying it to reconstruct patterns from video footage filmed using smartphone cameras. Experimental results show that our approach can break over 95% of the patterns in five attempts before the device is automatically locked by the Android operating system. We discovered that, in contrast to many people's belief, complex patterns do not offer stronger protection under our attacking scenarios. This is demonstrated by the fact that we are able to break all but one complex patterns (with a 97.5% success rate) as opposed to 60% of the simple patterns in the first attempt. Since our threat model is common in day-to-day life, this paper calls for the community to revisit the risks of using Android pattern lock to protect sensitive information.

show abstract

Section: *Corresponding Authors: Zhanyong Tang and Zheng Wangmentioning

confidence: 99%

Section: Examples Of Filming Scenariosmentioning

confidence: 99%

Section: B Implicationsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Cracking Android Pattern Lock in Five Attempts

Ye¹,

Tang²,

Fang³

et al. 2017

Proceedings 2017 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Although new methods are proposed to increase their I/O capability, their security is less addressed with most authentication methods being the same as those for smartphones (e.g., [3,5,11,14]). Recent studies further raised the security concern for smartwatches (e.g., [12,15]). …”

Section: Introductionmentioning

confidence: 99%

An empirical study of touch-based authentication methods on smartwatches

Zhao

Qiu

Yang

et al. 2017

Proceedings of the 2017 ACM International Symposium on Wearable Computers

View full text Add to dashboard Cite

The emergence of smartwatches poses new challenges to information security. Although there are mature touch-based authentication methods for smartphones, the effectiveness of using these methods on smartwatches is still unclear. We conducted a user study (n=16) to evaluate how authentication methods (PIN and Pattern), UIs (Square and Circular), and display sizes (38mm and 42mm) affect authentication accuracy, speed, and security. Circular UIs are tailored to smartwatches with fewer UI elements. Results show that 1) PIN is more accurate and secure than Pattern; 2) Pattern is much faster than PIN; 3) Square UIs are more secure but less accurate than Circular UIs; 4) display size does not affect accuracy or speed, but security; 5) Square PIN is the most secure method of all. The study also reveals a security concern that participants' favorite method is not the best in any of the measures. We finally discuss implications for future touch-based smartwatch authentication design.

show abstract

Securing PIN‐based authentication in smartwatches with just two gestures

Guerar

Migliardi

Palmieri

et al. 2019

Concurrency and Computation

View full text Add to dashboard Cite

Summary Smartwatches are becoming increasingly ubiquitous as they offer new capabilities to develop sophisticated applications that make daily life easier and more convenient for consumers. The services provided include applications for mobile payment, ticketing, identification, access control, etc. While this makes modern smartwatches very powerful devices, it also makes them very attractive targets for attackers. Indeed, PINs and Pattern Lock have been widely used in smartwatches for user authentication. However, such authentication methods are not robust against various forms of cybersecurity attacks, such as side channel, phishing, smudge, shoulder surfing, and video‐recording attacks. Moreover, the recent adoption of hardware‐based solutions, like the Trusted Execution Environment (TEE), can mitigate only partially such problems. Thus, the user's security and privacy are at risk without a strong authentication scheme in place. In this work, we propose 2GesturePIN, a new authentication framework that allows users to authenticate securely to their smartwatches and related sensitive services through solely two gestures. 2GesturePIN leverages the rotating bezel or crown, which are the most intuitive ways to interact with a smartwatch, as a dedicated hardware. 2GesturePIN improves the resilience of the regular PIN authentication method against state‐of‐the‐art cybersecurity attacks while maintaining a high level of usability.

show abstract

Beware, Your Hands Reveal Your Secrets!

Cited by 121 publications

References 13 publications

Cracking Android Pattern Lock in Five Attempts

Cracking Android Pattern Lock in Five Attempts

An empirical study of touch-based authentication methods on smartwatches

Securing PIN‐based authentication in smartwatches with just two gestures

Contact Info

Product

Resources

About