Understanding Shoulder Surfer Behavior and Attack Patterns Using Virtual Reality

Abstract

In this work, we explore attacker behavior during shoulder surfing. As such behavior is often opportunistic and difficult to observe in real world settings, we leverage the capabilities of virtual reality (VR). We recruited 24 participants and observed their behavior in two virtual waiting scenarios: at a bus stop and in an open office space. In both scenarios, participants shoulder surfed private screens displaying different types of content. From the results we derive an understanding of factors influencing shoulder surfing behavior, reveal common attack patterns, and sketch a behavioral shoulder surfing model. Our work suggests directions for future research on shoulder surfing and can serve as a basis for creating novel approaches to mitigate shoulder surfing. CCS CONCEPTS• Security and privacy → Human and societal aspects of security and privacy;

Don't Peek at My Chart: Privacy‐preserving Visualization for Mobile Devices

“…Accordingly, data privacy issues arise when people are viewing mobile data visualizations showing sensitive personal data in public areas (e.g., on a bus or a train), as shoulder surfers nearby can also easily peek at those visualizations displayed on the mobile device screen, which is commonly known as Shoulder Surfing as shown in Figure 1. Additionally, shoulder surfers are individuals who engage in shoulder surfing [ARA * 22]. Though it is possible to be more cautious when using mobile data visualizations in public space, prior research has shown that only 7% of people are aware of Shoulder Surfing cases in the wild [EKVZ * 17].…”