Passphrases Beat Thermal Attacks: Evaluating Text Input Characteristics Against Thermal Attacks on Laptops and Smartphones

Abstract

We investigate the effectiveness of thermal attacks against input of text with different characteristics; we study text entry on a smartphone touchscreen and a laptop keyboard. First, we ran a study (N=25) to collect a dataset of thermal images of short words, websites, complex strings (special characters, numbers, letters), passphrases and words with duplicate characters. Afterwards, 20 different participants visually inspected the thermal images to attempt to identify the text input. We found that long and complex strings are less vulnerable to thermal attacks, that visual inspection of thermal images reveals different parts of the entered text (36% on average and up to 82%) even if the attack is not fully successful, and that entering text on laptops is more vulnerable to thermal attacks than on smartphones. We conclude with three learned lessons and recommendations to resist thermal attacks.

ThermoSecure: Investigating the Effectiveness of AI-Driven Thermal Attacks on Commonly Used Computer Keyboards

“…Even if the order of the keys is unknown, it is possible to significantly reduce the search space, requiring fewer attempts to guess a password. Furthermore, our study and studies from prior work [1,3,4,23] have shown that the order of entries can be leaked within a certain time frame.…”

“…While most previous work on thermal attacks considered smaller search spaces (e.g., 10 keys on an ATM keypad or a mobile touchscreen [1,3,4,23,31]), our work focuses on thermal attacks against keyboards, which are relatively understudied. In contrast to the work by Kaczmarek et al [13], our model is able to determine the order of entries by comparing the temperatures of the heat traces at the different keys and uses the information obtained from the thermal image to probabilistically decode multiple hypothesized passwords ranked by probability of correctness.…”

“…This input can range from day-to-day input on said devices, to sensitive input such as passwords, PINs, credit card numbers, and more. These types of attacks are referred to as thermal attacks [1,3,4].…”

“…Previous work has studied thermal attacks against ATMs [23], keyboards [3,4,13], smartphone touchscreens [1,3], and laptop touchpads [3]. It was shown that thermal attacks can be successful if the resulting thermal images are visually inspected by non-experts [3,4] or if they are analyzed using simple image processing techniques as done by Mowery et al [23] and Abdelrahman et al [1].…”

“…Previous work has studied thermal attacks against ATMs [23], keyboards [3,4,13], smartphone touchscreens [1,3], and laptop touchpads [3]. It was shown that thermal attacks can be successful if the resulting thermal images are visually inspected by non-experts [3,4] or if they are analyzed using simple image processing techniques as done by Mowery et al [23] and Abdelrahman et al [1]. While previous work showed high success rates ranging from 72% to 100% [1] when thermal images of passwords are taken 30-60 seconds after user input in controlled conditions, we argue that higher accuracy under different contexts can be achieved by leveraging deep learning techniques.…”