Eavesdropping user credentials via GPU side channels on smartphones

Abstract

Graphics Processing Unit (GPU) on smartphones is an effective target for hardware attacks. In this paper, we present a new side channel attack on mobile GPUs of Android smartphones, allowing an unprivileged attacker to eavesdrop the user's credentials, such as login usernames and passwords, from their inputs through onscreen keyboard. Our attack targets on Qualcomm Adreno GPUs and investigate the amount of GPU overdraw when rendering the popups of user's key presses of inputs. Such GPU overdraw caused by each key press corresponds to unique variations of selected GPU performance counters, from which these key presses can be accurately inferred. Experiment results from practical use on multiple models of Android smartphones show that our attack can correctly infer more than 80% of user's credential inputs, but incur negligible amounts of computing overhead and network traffic on the victim device. To counter this attack, this paper suggests mitigations of access control on GPU performance counters, or applying obfuscations on the values of GPU performance counters. CCS CONCEPTS• Security and privacy → Systems security; • Human-centered computing → Ubiquitous and mobile computing.

Uncovering User Interactions on Smartphones via Contactless Wireless Charging Side Channels

“…Data normalization. As mentioned in §IV-B, a keystroke may last from 0.05 to 0.2 seconds on average [76]. Similarly, users may spend different duration on each interface, and the smartphone could launch an app at different speeds.…”

“…Next, considering each activity may last a different length of time in every attempt (e.g., a single keystroke may take 0.05-0.2 second [76]), it also normalizes each activity attempt into the same length of time via property-preserving up-sampling (e.g., nearest neighbor interpolation [55]) or down-sampling (e.g., decimation factor [33]) algorithms.…”

“…Impacts from different users. Considering previous studies have found that users spend different amounts of time for each keystroke [76], WISERS normalizes each keystroke trace to reduce such impacts on recovering keystrokes. To evaluate its performance, we have conducted an IRB-approved user study.…”

Acoustic Keystroke Leakage on Smart Televisions

“…Prior work uses side-channels such as electromagnetic emanations [24], [60], reflections [7], smartphone accelerometers [37], [45], timing [58], and performance counters [67] to infer keystrokes on personal computers and mobile devices.…”