Stay Cool! Understanding Thermal Attacks on Mobile-based User Authentication

Abdelrahman, Yomna; Khamis, Mohamed; Schneegaß, Stefan; Alt, Florian

doi:10.1145/3025453.3025461

Cited by 102 publications

(115 citation statements)

References 46 publications

Supporting

Mentioning

114

Contrasting

Order By: Relevance

“…Graphical passwords such as Android lock patterns are particularly vulnerable to smudge attacks [29,40]. Furthermore, many knowledge-based schemes are also vulnerable to thermal attacks, where heat traces resulting from the user's interactions with the interface are exploited to find the password [1].…”

Section: Knowledge Factormentioning

confidence: 99%

“…Multimodal authentication was shown to be highly resilient to shoulder surfing [19]. Furthermore, thermal and smudge attacks normally require the attacker to inspect the interface after the user had left [1,3]. Our architecture complicates these attacks by relying on the user's mobile device for input.…”

Section: Multifactor Authenticationmentioning

confidence: 99%

“…When exchanging sensitive data with a public display (e.g., login credentials), users are prone to several types of threats. Namely, adversaries can uncover a user's password in public space through: (1) Shoulder surfing attacks: observing the user while authenticating [14], (2) Thermal attacks: exploiting the heat traces resulting from the user's interaction with the interface [1,24], and (3) Smudge attacks: exploiting the oily residues left after authenticating on touchscreens [3]. While the latter two risks were demonstrated to be feasible, shoulder surfing was shown to occur in daily contexts [14].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

GTmoPass

Khamis

Hasholzner

Bulling

et al. 2017

Proceedings of the 6th ACM International Symposium on Pervasive Displays

Self Cite

View full text Add to dashboard Cite

As public displays continue to deliver increasingly private and personalized content, there is a need to ensure that only the legitimate users can access private information in sensitive contexts. While public displays can adopt similar authentication concepts like those used on public terminals (e.g., ATMs), authentication in public is subject to a number of risks. Namely, adversaries can uncover a user's password through (1) shoulder surfing, (2) thermal attacks, or (3) smudge attacks. To address this problem we propose GTmoPass, an authentication architecture that enables Multi-factor user authentication on public displays. The first factor is a knowledge-factor: we employ a shoulder-surfing resilient multimodal scheme that combines gaze and touch input for password entry. The second factor is a possession-factor: users utilize their personal mobile devices, on which they enter the password. Credentials are securely transmitted to a server via Bluetooth beacons. We describe the implementation of GTmoPass and report on an evaluation of its usability and security, which shows that although authentication using GTmoPass is slightly slower than traditional methods, it protects against the three aforementioned threats.

show abstract

Section: Knowledge Factormentioning

confidence: 99%

Section: Multifactor Authenticationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

GTmoPass

Khamis

Hasholzner

Bulling

et al. 2017

Proceedings of the 6th ACM International Symposium on Pervasive Displays

Self Cite

View full text Add to dashboard Cite

show abstract

“…In external side channel attacks, an attacker can exploit side channels outside a device. Three example external side channel attacks are residue-based attacks [1][2][3][4][5], Wi-Fi-based attacks [26], and vision-based attacks [6-12, 27, 28]. Intensive research efforts have been made to mitigate these side channel attacks in the past decades.…”

Section: Related Workmentioning

confidence: 99%

“…Sensitive information like the passwords entered on mobile devices can be stolen by attackers by exploiting the soft keyboard. For example, in residue-based attacks [1][2][3][4][5], the tapped keys can be inferred from the oily or heat residues left on the touch screen, the order of which can also be determined by measuring the heat residue left on the touched positions. In computer visionbased attacks [6][7][8][9][10][11][12], the interaction between the hand and the keyboard is exploited.…”

Section: Introductionmentioning

confidence: 99%

Privacy Enhancing Keyboard: Design, Implementation, and Usability Testing

Ling

Borgeest

Sano

et al. 2017

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

To protect users from numerous password inference attacks, we invent a novel context aware privacy enhancing keyboard (PEK) for Android touch-based devices. Usually PEK would show a QWERTY keyboard when users input text like an email or a message. Nevertheless, whenever users enter a password in the input box on his or her touch-enabled device, a keyboard will be shown to them with the positions of the characters shuffled at random. PEK has been released on the Google Play since 2014. However, the number of installations has not lived up to our expectation. For the purpose of usable security and privacy, we designed a two-stage usability test and performed two rounds of iterative usability testing in 2016 and 2017 summer with continuous improvements of PEK. The observations from the usability testing are educational: (1) convenience plays a critical role when users select an input method; (2) people think those attacks that PEK prevents are remote from them.

show abstract