PatternListener

Abstract

Pattern lock has been widely used for authentication to protect user privacy on mobile devices (e.g., smartphones and tablets). Several attacks have been constructed to crack the lock. However, these approaches require the attackers to either be physically close to the target device or be able to manipulate the network facilities (e.g., WiFi hotspots) used by the victims. Therefore, the effectiveness of the attacks is significantly impacted by the environment of mobile devices. Also, these attacks are not scalable since they cannot easily infer unlock patterns of a large number of devices.Motivated by an observation that fingertip motions on the screen of a mobile device can be captured by analyzing surrounding acoustic signals on it, we propose PatternListener 1 , a novel acoustic attack that cracks pattern lock by analyzing imperceptible acoustic signals reflected by the fingertip. It leverages speakers and microphones of the victim's device to play imperceptible audio and record the acoustic signals reflected by the fingertip. In particular, it infers each unlock pattern by analyzing individual lines that compose the pattern and are the trajectories of the fingertip. We propose several algorithms to construct signal segments according to the captured signals for each line and infer possible candidates of each individual line according to the signal segments. Finally, we map all line candidates into grid patterns and thereby obtain the candidates of the entire unlock pattern. We implement a PatternListener prototype by using off-the-shelf smartphones and thoroughly evaluate it using 130 unique patterns. The real experimental results demonstrate that PatternListener can successfully exploit over 90% patterns within five attempts.

A Systematic Literature Review on the Security Attacks and Countermeasures Used in Graphical Passwords

“…The recorded audio undergoes processing, removing static noise, and is then used for calculations to measure relative movement and infer pattern lines. The inferred pattern lines are used to generate candidate patterns, which are ranked and provided to the attacker [11] [59].…”

“…• Restricting Microphone Usage: One approach to mitigating sonar attacks is to restrict microphone usage in the background during pattern drawing [59]. By limiting access to the microphone, acoustic signals cannot be captured, preventing attackers from determining fingertip motions on the screen.…”

Password-Stealing without Hacking: Wi-Fi Enabled Practical Keystroke Eavesdropping

“…Similarly, KeyListener [39] performs KI on touchscreen based on different attenuation of the signals (generated by phone speaker) at the two microphones. PatternListener [73] compromises pattern locks by using acoustic signals reflected from fingertips to measure their relative movement and infer the pattern lines. These methods can be deemed as acoustic version of OKI.…”

“…Mobile devices (e.g., smartphones and tablets), along with their software applications, have been increasingly adopted to identify human users in modern societies [5,17]. Consequently, stealing passwords from these devices becomes almost like identify theft, hence attracting diversified eavesdropping attacks, either direct [42,70] or indirect [2,36,37,43,53,69,73]. Bearing no need to have a visual on the target screen, the indirect attacks often incur a much higher risk as they leverage side-channels to infer passwords in a stealthy manner.…”

“…Bearing no need to have a visual on the target screen, the indirect attacks often incur a much higher risk as they leverage side-channels to infer passwords in a stealthy manner. Typical side-channels considered by prior works include acoustic [36,73], electromagnetic emission [31], indirect vision [11,53,57,69], and motion sensors [9,37,43]. Though they have demonstrated successes for particular scenarios, these successes often rely on strong assumptions [34], including i) eavesdropping devices are in proximity to the victim device (e.g., in centimeter scale or within line-of-sight region) [11,31,36,37,43,53], ii) rogue software have been implanted to the victim device [9,37,73], and iii) the content to eavesdrop has linguistic structure [2,37,43,69].…”