Don’t Interrupt Me While I Type: Inferring Text Entered Through Gesture Typing on Android Keyboards

Abstract

We present a new side-channel attack against soft keyboards that support gesture typing on Android smartphones. An application without any special permissions can observe the number and timing of the screen hardware interrupts and system-wide software interrupts generated during user input, and analyze this information to make inferences about the text being entered by the user. System-wide information is usually considered less sensitive than app-specific information, but we provide concrete evidence that this may be mistaken. Our attack applies to all Android versions, including Android M where the SELinux policy is tightened.We present a novel application of a recurrent neural network as our classifier to infer text. We evaluate our attack against the “Google Keyboard” on Nexus 5 phones and use a real-world chat corpus in all our experiments. Our evaluation considers two scenarios. First, we demonstrate that we can correctly detect a set of pre-defined “sentences of interest” (with at least 6 words) with 70% recall and 60% precision. Second, we identify the authors of a set of anonymous messages posted on a messaging board. We find that even if the messages contain the same number of words, we correctly re-identify the author more than 97% of the time for a set of up to 35 sentences.Our study demonstrates a new way in which system-wide resources can be a threat to user privacy. We investigate the effect of rate limiting as a countermeasure but find that determining a proper rate is error-prone and fails in subtle cases. We conclude that real-time interrupt information should be made inaccessible, perhaps via a tighter SELinux policy in the next Android version.

A novel word-independent gesture-typing continuous authentication scheme for mobile devices

“…Researchers in [23] evaluate the use of screen interrupts (context-switches) that occur within the Android OS during gesture typing. They find that pauses in typing gestures can be identified via the interrupt frequency.…”

“…: by requiring the scheme to be trained on a word before it can be authenticated [5]. In [23] the authors investigate gesture-typing but focus on word identification rather than providing an authentication scheme.…”

Countermeasures for timing-based side-channel attacks against shared, modern computing hardware

“…Likewise, with the rapid advancements in mobile technology, researchers have been able to demonstrate even more sophisticated SCAs compromising smartphones (Spreitzer et al, 2016;Song et al, 2016;Sarwar et al, 2013;Owusu et al, 2012;Lange et al, 2011). For instance, new attacks (Simon et al, 2016;Aviv et al, 2012;Xu et al, 2012;Cai and Chen, 2011) enable adversaries to deduce keyboard input on touchscreens through "sensor readings from native apps" (Spreitzer et al, 2016;Kambourakis et al, 2016;Aviv et al, 2012). Because typing on various places on the screen creates different vibrations, data from Motion (Cai and Chen, 2011), a SCA on touch screen smartphones with soft keyboards data, can be employed by an attacker to deduce the keys being typed.…”

KeyDrown: Eliminating Software-Based Keystroke Timing Side-Channel Attacks

“…These timings show characteristic patterns of the user, which depend on several factors such as keystroke sequences on the level of single letters, bigrams, syllables or words as well as keyboard layout and typing experience [37]. Existing attacks train probabilistic classifiers like hidden Markov models or neural networks to infer known words or to reduce the password-guessing complexity [42,43,53].…”