Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-driven thermal cameras used to obtain passwords

gla.ac.uk

Post reply on HN
Print view View original

11–20 of 88 posts

Re: AI-driven thermal cameras used to obtain passwords

#12

Post by agent008t »

codetiger wrote: post #4
jbj wrote: post #3

Earlier quoted context omitted.

not if that machine is an ATM

So in case of ATMs we now need to make sure we soft touch some random buttons to ensure this trick doesn't work.

I have already seen some ATMs that shuffle the numbers on the numberpad around for each PIN entry. It is inconvenient for muscle memory, but prevents this kind of attack.

Re: AI-driven thermal cameras used to obtain passwords

#13

Post by chrischen »

gluecode wrote: post #11

I wonder if ATM machines should have a keyboard cooling function to erase thermal signatures, immediately after each customer session.

I've always just used my credit card holder (metal) to punch in numbers, due to this heat thing. They were doing this with pins before this technique.

Re: AI-driven thermal cameras used to obtain passwords

#14

Post by wongarsu »

SanjayMehta wrote: post #6

This is just silly: how many people punch in their PIN number and then leave immediately? I guess these researchers haven't ever withdrawn money from an ATM.

That's how pin pads on doors work: you punch in the PIN, then immediately go through the door. And those pin pads are somewhat popular in commercial settings because it's easier to distribute knowledge than to distribute physical keys.

Re: AI-driven thermal cameras used to obtain passwords

#17

Post by [deleted] »

cricalix wrote: post #10
amelius wrote: post #2

Fortunately most people stay at the machine after typing their password. Anyway perhaps now is a good time to get some 2fa hardware token.

There are ATMs in Europe that will take the card, ask for what you want to do, ask the amount if it’s a withdrawal, and then ask for the PIN and dispense it. This reduces the time between typing and dispensing. No idea if it’s a significant enough reduction in the time versus card, pin, navigate to withdraw, dispense such that it would enable this attack.

[deleted]

Re: AI-driven thermal cameras used to obtain passwords

#18

Post by bilekas »

gluecode wrote: post #11

I wonder if ATM machines should have a keyboard cooling function to erase thermal signatures, immediately after each customer session.

This is actually a great point I hadn't even considered. I had heard of cretins using a small grease film like a tiny layer of vasolene etc on pinpads and then after the victim uses, they would shine a light on it to see.
Post reply on HN