Are Thermal Attacks Ubiquitous?

Abstract

Figure 1: Thermal images of graphical passwords entered on a smartphone's touchscreen (1 and 2) and a laptop's touchpad (3 and 4) were visually inspected by participants, who recovered 60.65% of touch gestures (2 and 4), and 23.61% of touch taps (1 and 3). Attacks against touchscreens are more accurate (87.04% vs 56.02%). The red circles/arrows illustrate the user's input.

Passphrases Beat Thermal Attacks: Evaluating Text Input Characteristics Against Thermal Attacks on Laptops and Smartphones

“…Previous work demonstrated the effectiveness of thermal attacks on PINs on different devices such as safes [20], smartphones [7,8], keyboards [8,12], cash machines [16], digital door locks, and payment terminals [19]. High-end thermal cameras as well as low-cost commercial cameras have been used in different research showing the real threat to users' privacy [7,8,16]. Both automated approaches [7,12] and visual inspection attacks by non-expert human attackers [8,20] were highly successful.…”

“…High-end thermal cameras as well as low-cost commercial cameras have been used in different research showing the real threat to users' privacy [7,8,16]. Both automated approaches [7,12] and visual inspection attacks by non-expert human attackers [8,20] were highly successful. Most of the research has investigated thermal attacks on PINs or patterns which are usually short entries.…”

“…Participants were asked to wait one minute in-between each two text entries to make sure heat trackers had decayed, and the thermal image was taken 4 seconds after entry. These decisions were inspired by prior work on thermal attacks [8]. Each participant entered a total of 40 entries (4 per category, half on the laptop and the other half on the smartphone).…”

“…Recent research has revealed that thermal cameras can be used to infer different types of passwords, such as text passwords [12] and PINs/Patterns [7,8]. This presents a threat to authentication on safes [20], smartphones [7,8], keyboards [8,12], cash machines [16], digital door locks, and payment terminals [19]. Attacks that use thermal cameras are often referred to as "thermal attacks" [7].…”

“…Attacks that use thermal cameras are often referred to as "thermal attacks" [7]. They were shown to be feasible using both high-end and low-cost commercial cameras [7,8], and were evaluated under threat models where attackers have access to automated image processing approaches [7,12] and where attackers are nonexperts that rely on visually inspecting the thermal images [8,12,20].…”