Latest in Gear

Image credit: kasinv via Getty Images

Your phone's motion sensors can give away PINs and passwords

Apparently, hackers can decipher your passwords by the way the phone moves as you type.
1384 Shares
Share
Tweet
Share
Save

Sponsored Links

kasinv via Getty Images

You could be the most careful mobile user ever, but hackers can still steal your PINs and passwords simply by spying on your phone's motion sensors. A team of cyber researchers from the UK's Newcastle University have demonstrated how easy it is to steal a four-digit PIN by analyzing the way your phone tilts and moves as you type. You might think your phone's movements are random, but they apparently create distinct patterns. During their tests, they were able to crack four-digit PINs on the first guess 70 percent of the time and 100 percent of the PINs they used by the fifth guess.

Lead author Dr. Maryam Mehrnezhad explained:

"Most smart phones, tablets, and other wearables are now equipped with a multitude of sensors, from the well-known GPS, camera and microphone to instruments such as the gyroscope, proximity, NFC, and rotation sensors and accelerometer.

But because mobile apps and websites don't need to ask permission to access most of them, malicious programs can covertly 'listen in' on your sensor data and use it to discover a wide range of sensitive information about you such as phone call timing, physical activities and even your touch actions, PINs and passwords.

More worrying, on some browsers, we found that if you open a page on your phone or tablet which hosts one of these malicious code and then open, for example, your online banking account without closing the previous tab, then they can spy on every personal detail you enter.

And worse still, in some cases, unless you close them down completely, they can even spy on you when your phone is locked."

To conduct the tests, the team trained an artificial neural network with data collected from people who actively key in PINs to access various accounts. They then used a javascript exploit delivered through a browser on the phone as a point of entry. So long as a user clicks the malware's link, it can collect data from motion sensors.

The team already told tech titans and browser makers that sensors can be a vulnerability. Apple and Firefox issued patches to prevent anyone from collecting sensor data last year. Google also knows about the issue, but it's still looking into a fix. The researchers are now expanding their research to include personal fitness trackers, which are typically a treasure trove of motion sensor data. They want to find out how their sensors can be used to spy on your activities and how the data collected from wearables can pose a risk to your privacy.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
1384 Shares
Share
Tweet
Share
Save

Popular on Engadget

Engadget's 2019 Back-to-School Guide

Engadget's 2019 Back-to-School Guide

View
Porn bots are now storming Twitter's trending topics

Porn bots are now storming Twitter's trending topics

View
Online sneaker reseller StockX faces lawsuit over data breach

Online sneaker reseller StockX faces lawsuit over data breach

View
SiriusXM's student plan only costs $4 per month

SiriusXM's student plan only costs $4 per month

View
An old Instagram hoax is back, and it's duping celebrities

An old Instagram hoax is back, and it's duping celebrities

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr