SonarSnoop: active acoustic side-channel attacks

Abstract

We report the first active acoustic side-channel attack. Speakers are used to emit human inaudible acoustic signals and the echo is recorded via microphones, turning the acoustic system of a smart phone into a sonar system. The echo signal can be used to profile user interaction with the device. For example, a victim's finger movements can be inferred to steal Android unlock patterns. In our empirical study, the number of candidate unlock patterns that an attacker must try to authenticate herself to a Samsung S4 phone can be reduced by up to 70% using this novel acoustic side-channel. The attack is entirely unnoticeable to victims. Our approach can be easily applied to other application scenarios and device types. Overall, our work highlights a new family of security threats.

Side-Channel Sensing: Exploiting Side-Channels to Extract Information for Medical Diagnostics and Monitoring

“…For example, acoustics can reflect, and travel through a variety of mediums and at varying distances. Taking advantage of these properties, inaudible acoustics emitted from a smartphone can bounce off nearby moving objects, and the corresponding echo can carry target information used to infer the object's movements [26], [27]. An MDM scenario can be similarly applied to use emitted signals to detect the oscillation of a person's chest to infer heart and breathing rate [17].…”

“…The side-channel attack frameworks offer a more structured approach to the use of side-channels with the following concepts common to all instances of side-channel attacks (as depicted within Figure 2 ): System structure: the logical components [4] Method: named attack strategies including differential analysis correlation , and transformation to frequency or other domains [5] , [35] Modelling/Profiling: uses a training phase to characterise a target system before attacking [4] , or for developing a template based on extensive traces [36] Modality: includes timing [37] , [38] , power usage [5] , [10] , electromagnetic radiation [5] , [22] , magnetic field [30] , acoustic [20] , [27] , visible light [32] , infra-red [39] , and vibration [21] , [23] Access: level of physical access; invasive, semi-invasive, or non-invasive [5] , [40] Remote versus local: modalities that can be measured from a distance allow for remote sensing [5] , [22] Control: active modification to cause side-channel leakage (feeding in a particular input) [5] , [8] , [34] , or passively accepting leaked data [5] Subsequent sections identify examples of side-channel sensing in MDM and develop a corresponding systematic categorisation appropriate to the MDM domain.

FIGURE 2.

…”

“…Modality: includes timing [37] , [38] , power usage [5] , [10] , electromagnetic radiation [5] , [22] , magnetic field [30] , acoustic [20] , [27] , visible light [32] , infra-red [39] , and vibration [21] , [23]…”

Echo-ID: Smart User Identification Leveraging Inaudible Sound Signals

“…The column threshold (i.e., 3) is set empirically (by changing it randomly between 1 and 100) for detecting the changes occurring due to user's fingers and hand. A similar method is also used in [16] and [17] to track the finger movements and use them for detecting 2 − D gestures and snooping the unlock patterns of mobile devices, respectively. Figure 16 shows the newly generated matrix by comparing the columns of the correlation matrix shown in Figure 15 in accordance with the aforementioned method.…”

Work in Progress: On the In-Accuracy and Influence of Android Pattern Strength Meters

“…Android's graphical password has been studied in many contexts, including for security (e. g., smudges [8], [13], shoulder surfing [43], [4], [18], other side-channel attacks [50], [14], [48], [49]), user choice [37], [1], [28], selection aids [36], [15], and under modifications [3], [35]. As mentioned, there has been a number of proposals for pattern strength meters [1], [33], [31], which we will describe in more detail in the following section.…”