Password Extraction via Reconstructed Wireless Mouse Trajectory

Abstract

Logitech made the following statement in 2009: "Since the displacements of a mouse would not give any useful information to a hacker, the mouse reports are not encrypted." In this paper, we prove the exact opposite is true -i.e., it is indeed possible to leak sensitive information such as passwords through the displacements of a Bluetooth mouse. Our results can be easily extended to other wireless mice using different radio links. We begin by presenting multiple ways to sniff unencrypted Bluetooth packets containing raw mouse movement data. We then show that such data may reveal text-based passwords entered by clicking on software keyboards. We propose two attacks, the prediction attack and replay attack, which can reconstruct the on-screen cursor trajectories from sniffed mouse movement data. Two inference strategies are used to discover passwords from cursor trajectories. We conducted a holistic study over all popular operating systems and analyzed how mouse acceleration algorithms and packet losses may affect the reconstruction results. Our real-world experiments demonstrate the severity of privacy leakage from unencrypted Bluetooth mice. We also discuss countermeasures to prevent privacy leakage from wireless mice. To the best of our knowledge, our work is the first to demonstrate privacy leakage from raw mouse data.

A Literature Survey on Password Extraction via Reconstructed Wireless Mouse Trajectory

“…This Survey represents a study of password extraction Methods [1] for different Indian scripts .This paper helps researchers and developers to understand history of the wireless mouse data leakage research work for Indian scripts. This survey will be helpful for researchers in this field.In this paper, an analysis of privacy leakage from unencrypted Bluetooth mouse traffic is carried out.…”

A Novel Security Architecture of Internet of Things

“…Because high security is essentially required to protect critical physical infrastructure and sensitive data [34]. Once a hacker/attacker gained access to unprotected device, cyber security system may be compromised [35].and it can lead to serious circumstances such as collecting the data from smart house can reveal the owner activities [36], [37], monitoring the power consumption can also disclose routine life [38]. Furthermore, false data injection [39]- [41], attacks up against data integrity [42], [43] and so on.…”

Lighting Two Candles With One Flame: An Unaided Human Identification Protocol With Security Beyond Conventional Limit

“…Password base authentication is one of the simplest form of authentication as it reduces the human effort to a great extent during the identity verification (Bonneau et al, 2012). Being usable, this factor of authentication has been challenged under different kind of threats over the times (Marechal, 2008) (Pinkas and Sander, 2002) (Kim et al, 2016) (Pan et al, 2016) (Halevi and Saxena, 2015) . Though most of these threats have been successfully handled (Manulis et al, 2016) (Kontaxis et al, 2013), there are a few, particularly those which involve human intelligence factor, are continuously challenging researchers in developing some efficient algorithm to tackle the breaches.…”