Smartphones have remained the primary domain of experimentation for cybercriminals as they are always finding out ways to exploit and crack smartphones mainly Android devices. Apparently, researchers at Singapore based Nanyang Technology University or NTU Singapore, have identified a brand new way with which cyber-crooks can compromise a smartphone, which involves the use of device’s sensors.
Believe it or not but the very own sensors of a smartphone could provide cyber-criminals the key to cracking your device. Researchers found that 99.5% of the time the method worked and their device got unlocked. It is worth noting that the researchers tested the method thrice and monitored the data from six sensors installed on an Android smartphone. They were able to correctly guess the 4-digit PIN code for the device.
Researchers tried to identify the PIN code through exploiting sensors installed inside Android smartphones by letting three people enter a varied range of 4-digit number sequences (about 70 times) randomly and then applied machine learning to the sequences in order to predict the pin code. The team tested six sensors including the magnetometer, accelerometer, gyroscope, ambient light sensor, barometer and proximity sensor. They noted that when combined with the accelerometer, the gyroscope gave much accurate information and the team hit 10,000 4-digit combos of codes every time. The smartphone they tested had one of 50 most commonly used PIN codes.
10 records where the keys 0-8-5-2 were pressed for two different sensors. Red
dots signalize the time where the display was touched, while green dots signal the
release. (Screenshot grab: NTU)
Finally, they managed to guess the PIN code with 100% accuracy, which is a ground-breaking discovery since previously in a similar research the Newcastle University, UK, researchers could guess PIN code of a smartphone with 70% accuracy.
The team opined that the discovery highlights a critical flaw in smartphone security that is posed by the built-in sensors. Since the sensors inside the phone do not need user permissions for storing data and are always open for being accessed by apps, therefore, these can easily jeopardize phone’s security.
The researchers believe their work highlights a significant flaw in smartphone security, as using the sensors within the phones require no permissions to be given by the phone user and are openly available for all apps to access.
The project’s lead researcher Shivam Bhasin wrote: “When you hold your phone and key in the PIN, the way the phone moves when you press 1, 5, or 9, is very different. Likewise, pressing 1 with your right thumb will block more light than if you pressed 9.”
The discovery is also alarming since researchers claim that presence of malicious applications on smartphones is an issue of concern because if these apps record sensor data then the information can be used to hack into the device. Therefore, to prevent your smartphone from being hacked, it is recommended by NTU researchers that longer codes must be used instead of 4-digits. Furthermore, a backup system in the device such as a fingerprint or facial recognition is also helpful but in the end, it all depends upon smartphone makers to identify ways of locking down data stored by the sensors.
As researchers wrote in their paper [PDF]:
“Limiting the maximum operating frequency of the sensors can reduce the attack feasibility. Alternatively, disabling sensors while sensitive operations like PIN entry can also prevent such attacks. However, these are just temporary fixes, and sensors access in smartphones must be rethought, in general.”
It was quite amusing that although a different code was entered by every individual on the phone the experiment also proved that the higher data is fed to the algorithm the better would be the success rate. This means, if a malicious app is unable to accurately guess the PIN right after getting installed, it can eventually guess the correct code using machine learning, which would help in learning the PIN entry pattern.
Therefore, Dr. Bhasin urges that mobile operating systems must be modified so that access to these six sensors could be restricted and users are able to choose to give permissions to trusted apps only. Dr. Bhasin and his colleagues Mr. David Berene and Mr. Bernhard Jungk spent 10 months on the research project and published their findings in Cryptology ePrint archive on Dec 6.
