If you find that mobile phone devices have considerable security, this may not be entirely true. According to research from the Nanyang Technological University in Singapore, smartphones present a significant vulnerability.
The researchers themselves managed to unlock smartphones using a combination of information gathered from six different sensors and state-of-the-art deep learning and machine learning algorithms.
They managed to unlock an Android device with 99.5% accuracy in just three attempts , a phone that had one of the 50 most common PIN numbers. So far, the best phone hack success rate was 74% for the 50 most common PIN numbers.
Now the technique can be used to guess any one of 10,000 possible four-digit PIN combinations.
How does it work
The researchers used sensors on a smartphone to find out which number had been pressed by its users, based on how the phone was tilted and how much light the phone was blocking.
The researchers believe their work highlights a significant flaw in smartphone security, as the use of sensors inside phones does not require permissions for the phone user and they are available for all applications to access.
The team took Android phones and installed a custom app that collected data from six sensors: accelerometer, gyroscope, magnetometer, proximity sensor, barometer, and ambient light sensor.
“When a user enters the PIN, the way the phone moves when they press 1, 5 or 9 is very different. Likewise, pressing 1 with the right thumb will block more light than pressing 9,” he explains. Dr. Bhasin, who led the project.
The classification algorithm was trained on data collected from three people, each of whom entered a random set of 70 four-digit pin numbers into a phone. At the same time, the relevant sensor reactions were recorded.
Malicious apps with learning capabilities
Known as deep learning, the classification algorithm was able to give different importance weights for each of the sensors, depending on how sensitive each was to the different numbers being pressed, which helps eliminate the factors that it judges that they are less important and the success rate for PIN recovery increases.
Although each person enters the security PIN on their phone differently, the scientists showed that as more people’s data is fed into the algorithm over time, the success rates improved.
Therefore, even if a malicious application does not guess a PIN immediately, using machine learning it could collect data and launch an attack later , when the success rate is much higher.
“In addition to the potential for leaked passwords, we are concerned that accessing information from the phone’s sensor may reveal too much about a user’s behavior. This has significant privacy implications that individuals and businesses need to pay urgent attention to.” the researchers alert.
To keep mobile devices safe, Dr. Bhasin advises users to have a PIN longer than four digits , along with other authentication methods such as one-time passwords, such as fingerprint or facial recognition.
References: ‘There Goes Your PIN. Exploiting Smartphone Sensor Fusion Under Single and Cross User Setting ‘. David Berend, Bernhard Jungk and Shivam Bhasin. Physical Analysis and Cryptographic Engineering, Temasek Laboratories Nanyang Technological University, Singapore.
