ClearShot: Eavesdropping on Keyboard Input from Video

Balzarotti, Davide; Cova, Marco; Vigna, Giovanni

doi:10.1109/sp.2008.28

Cited by 96 publications

(64 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some of the early work in this area rely on video footage filmed using a camera directly facing the screen or the keyboard [4,16]. Latest work shows that this limit can be lifted by exploiting spatial-temporal dynamics of the hands during typing [23].…”

Section: *Corresponding Authors: Zhanyong Tang and Zheng Wangmentioning

confidence: 99%

“…For example, Figure 2 (c) will be transformed to Figure 2 (d) to obtain a fingertip movement trajectory from the user's perspective. 4 Identify and Rank Candidate Patterns: In this step, our software automatically maps the tracked fingertip movement trajectory to a number of candidate patterns (Section IV-D). We rank the candidate patterns based on a heuristic described in Section IV-D2.…”

Section: Overview Of Our Attackmentioning

confidence: 99%

“…To collect the patterns, we have distributed over 1,000 survey forms and collected back 215 valid forms, resulting in 120 unique patterns 4 . Our participants include 95 females and 120 males who were undergraduate or postgraduate students in our institution.…”

Section: A Data Collectionmentioning

confidence: 99%

See 2 more Smart Citations

Cracking Android Pattern Lock in Five Attempts

Ye¹,

Tang²,

Fang³

et al. 2017

Proceedings 2017 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Abstract-Pattern lock is widely used as a mechanism for authentication and authorization on Android devices. This paper presents a novel video-based attack to reconstruct Android lock patterns from video footage filmed using a mobile phone camera. Unlike prior attacks on pattern lock, our approach does not require the video to capture any content displayed on the screen. Instead, we employ a computer vision algorithm to track the fingertip movements to infer the pattern. Using the geometry information extracted from the tracked fingertip motions, our approach is able to accurately identify a small number of (often one) candidate patterns to be tested by an adversary. We thoroughly evaluated our approach using 120 unique patterns collected from 215 independent users, by applying it to reconstruct patterns from video footage filmed using smartphone cameras. Experimental results show that our approach can break over 95% of the patterns in five attempts before the device is automatically locked by the Android operating system. We discovered that, in contrast to many people's belief, complex patterns do not offer stronger protection under our attacking scenarios. This is demonstrated by the fact that we are able to break all but one complex patterns (with a 97.5% success rate) as opposed to 60% of the simple patterns in the first attempt. Since our threat model is common in day-to-day life, this paper calls for the community to revisit the risks of using Android pattern lock to protect sensitive information.

show abstract

Section: *Corresponding Authors: Zhanyong Tang and Zheng Wangmentioning

confidence: 99%

Section: Overview Of Our Attackmentioning

confidence: 99%

See 1 more Smart Citation

Cracking Android Pattern Lock in Five Attempts

Ye¹,

Tang²,

Fang³

et al. 2017

Proceedings 2017 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…This also provides malicious entities with a potential opportunity for observing the password entry. Such an attack could be accomplished either through casual non-technical attacks like shoulder surfing or sophisticated attacks such as Balzarotti, Cova, and Vigna's video based tech-nique [6] or the audio logging technique introduced by Zhuang, Zhou, and Tygar [7].…”

Section: Related Workmentioning

confidence: 99%

Exploring Mobile Proxies for Better Password Authentication

Saxena

Voris

2012

Information and Communications Security

View full text Add to dashboard Cite

Abstract. Traditional textual password authentication techniques have numerous well documented security and usability flaws, yet have seen near universal deployment due to their desirable efficiency properties. As a result, many users who may prefer alternative authentication approaches are forced to use passwords or PINs on a daily basis due to a lack of control over third party servers. This work explores the use of a mobile device as a proxy for password management in an attempt to improve remote password authentication without making changes to remote servers. A universal proxy-based authentication framework is presented which allows users to employ a method of their own choice to authenticate locally to their mobile devices (e.g., biometrics or graphical passwords). The framework is also compatible with many communication channels between the mobile proxy and local terminal (e.g., Bluetooth or audio). To demonstrate the practicality of this general framework, a concrete implementation using an "out-of-band" audio channel, called PIN-Audio, is also provided. While existing password management solutions may provide a reasonable level of security for commonplace services, PINAudio is recommended for a user-friendly deployment for security critical applications, such as online banking.

show abstract

“…Regarding security, passwords evaluate to poor in security measures; they are not resilient to physical observation as they can be automatically observed by key loggers or through a high quality video recording of the keyboard [5]. Also, passwords are vulnerable to dictionary attacks and guessing attacks, not resilient to leaks from other verifiers and most importantly, they are not resilient to phishing attacks.…”

Section: Introductionmentioning

confidence: 99%