Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inferring Your Mobile Phone Password via WiFi Signals

fermatslibrary.com

Post reply on HN
Print view View original

51–60 of 69 posts

Re: Inferring Your Mobile Phone Password via WiFi Signals

#51

Post by program_whiz »

pslam wrote: post #41
program_whiz wrote: post #38

Read the section "limitations". Only works on 10 users right now, must be trained for the pattern "per user", phone must be sitting on stable surface, gesture must be performed as close to "the same" every time. This is just clickbait and "please fund our research" IMO.

What did you expect — a turn-key solution for sale? They claim no such thing. This is great research. They've demonstrated that it is in fact possible to obtain a passcode at a distance, at least in contrived conditions. The fact it's possible whatsoever is a significant result. Even without being able to obtain the exact passcode, this would yield the ability to guess a passcode in much better time than just random…

Ok I think my issue with this is that its akin to saying: Given the same users, in the same position, with the same hardware, performing the same gestures, we discovered the signals are consistent enough that a NNet can figure out a pattern. However, if the users, the hardware, the wifi router, the positions, the orientations, the conditions, or the gestures used change, you would need to retrain your NNet for that situation.

After working on a couple of "ambitious" projects that tried to use wifi or bluetooth signals to mine data, it turns out its not super reliable in real-world situations.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#52

Post by zkms »

gefh wrote: post #4

Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?

The easiest defence is to temporarily kill all the radios (wifi, bluetooth, LTE) while someone is entering a password.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#54

Post by adynatos »

LTE and HSDPA (and maybe older gens) have Channel Quality Indicator, which afaik has the same role as CSI. So I wonder if the same trick can be achieved with LTE signalling? To pull that off you would need access to a BTS, but today with open source stacks, like OpenBTS or OpenAirInterface,you could roll out your own.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#55

Post by flukus »

cortesoft wrote: post #29
mratzloff wrote: post #27

Earlier quoted context omitted.

Never use public wifi. I don't.

That is a large cost to pay.

Is it really? The biggest bandwidth user is cloud apps and if you care about privacy you wouldn't be using them anyway.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#56

Post by cortesoft »

libeclipse wrote: post #31
cortesoft wrote: post #29

Earlier quoted context omitted.

That is a large cost to pay.

It isn't really. Mobile data is a must from a security point of view. Combine it with a VPN and you have your out and about internet access sorted.

Mobile data is expensive and slower than WIFI. There is a reason people connect to a WIFI with their phones.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#57

Post by zrm »

danielhooper wrote: post #32
gefh wrote: post #4

Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?

The defence is definitely to not use public wifi. This technology works because they can identify small target windows (e.g. you just accessed a URL to login to your bank account) in which to make and process these measurements. Any kind of abnormal obfuscation of your device should introduce enough noise to prevent this attack from generating any meaningful data from the victim, but I'm running on assumption.

Couldn't this work against any wifi? Impersonating a public access point gives you some extra unencrypted information so you know the server IP and can more easily infer when a password is being entered, the same things you conceal by using a VPN over public wifi.

But what stops a passive wifi observer who can guess those things or already knows them?

Re: Inferring Your Mobile Phone Password via WiFi Signals

#58

Post by freyr »

It looks like they're inferring the right 6-digit password about 20% of the time on their first try, presumably using the Xiaomi phone. But if they can try 20 candidates before getting locked out, they can guess the 6-digit password about 50% of the time.

With the Samsung phone, which has a much lower 1-digit recovery rate, it seems that it would be closer to 6% on the first try, and 20% by the twentieth try.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#59

Post by dTal »

pmontra wrote: post #34
frandroid wrote: post #25

Earlier quoted context omitted.

Or scramble the numeric keypad on every try, but that would get annoying fast.

My bank did that with a JavaScript number pad. They went back to a standard password field with the new design of the site a couple of years ago. That made me feel less safe because I understood why the were complicating the input. Another strategy I've seen is to ask some random digits of a longer PIN, with a mask to fill out.

Some banks (e.g. Barclays) use a card reader that generates a unique key each time. Since this also requires that you have your card to log in, it's my understanding that this offers massively improved security.

Re: Inferring Your Mobile Phone Password via WiFi Signals

#60

Post by sundvor »

gefh wrote: post #4

Holy shit. From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off. What's the defense? Have your phone manage the passwords and unlock via fingerprint?

Touch typing? Should present significantly different to one finger key hunting.

Fingerprints and never using public WiFi would both be good strategies. (I use my fingerprint to log into my banking app when on mobile.)

Post reply on HN