Toward Robotic Robbery on the Touch Screen

Abstract

Despite the tremendous amount of research fronting the use of touch gestures as a mechanism of continuous authentication on smart phones, very little research has been conducted to evaluate how these systems could behave if attacked by sophisticated adversaries. In this article, we present two Lego-driven robotic attacks on touch-based authentication: a population statistics-driven attack and a user-tailored attack. The population statistics-driven attack is based on patterns gleaned from a large population of users, whereas the user-tailored attack is launched based on samples stolen from the victim. Both attacks are launched by a Lego robot that is trained on how to swipe on the touch screen. Using seven verification algorithms and a large dataset of users, we show that the attacks cause the system's mean false acceptance rate (FAR) to increase by up to fivefold relative to the mean FAR seen under the standard zero-effort impostor attack. The article demonstrates the threat that robots pose to touch-based authentication and provides compelling evidence as to why the zero-effort attack should cease to be used as the benchmark for touchbased authentication systems.

A survey on behavioral biometric authentication on smartphones

“…Although there are several advantages associated with the active authentication systems, there are different limitations and problems are facing it which are as follows [49,50,51,56,57]: • Noisy data: the sensed data that recorded by the sensors devices that used in active authentication systems is always affected by some level of impreciseness in measurements. • Non-universality: the active authentication system may not be able to collect meaningful data.…”

“…• Vulnerabilities: such as spoofing and robot attacks. for example Serwadda et al [57] developed two Lego-driven robotic attacks on touch-based authentication.…”

When Your Fitness Tracker Betrays You: Quantifying the Predictability of Biometric Features Across Contexts

“…Earlier work authenticates users while they are being shown controlled stimuli, such as images [13] or moving shapes [14]. Eberz [19] Touch dynamics Assisted manual imitation Perfect [20] Touch dynamics Automatic (robot) None [21] Touch dynamics Automatic (robot) Perfect [22] Gait Assisted manual imitation Perfect [2] ECG Signal generator Cross-device users while they perform standard computer tasks (reading, typing, browsing and watching videos) [15]. Their featureset consists of temporal features reflecting short-term speed and acceleration, spatial features that measure the steadiness of the gaze and the changes of the pupil diameter.…”

“…This approach significantly increased the system's false accept rate, although the baseline equal error rate is already much higher than that of related work. The authors also consider a targeted attack, for which they assume the attacker has obtained a perfect copy of (some) of the victim's feature vectors [21].…”

Gamification of Wearable Data Collection

“…Threat Scenario -Using gamification for attack: The idea behind this scenario is that a malicious entity puts a game on the app market such that users download and play it. Unbeknownst to the users, the game is instrumented to elicit user moves or actions that enable the capture of security-sensitive data such as behavioral biometric data (e.g., swipe patterns that could later be used to drive attacks such as that in [28]) or even more traditional authentication credentials (e.g., an unlock pattern). For a more focused exposition, we tailor the rest of the description to the pattern lock mechanism since this is the case studied in our experiments.…”