Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-driven thermal cameras used to obtain passwords

gla.ac.uk

Post reply on HN
Print view View original

41–50 of 88 posts

Re: AI-driven thermal cameras used to obtain passwords

#41

Post by SketchySeaBeast »

Semaphor wrote: post #36
cricalix wrote: post #10

Earlier quoted context omitted.

There are ATMs in Europe that will take the card, ask for what you want to do, ask the amount if it’s a withdrawal, and then ask for the PIN and dispense it. This reduces the time between typing and dispensing. No idea if it’s a significant enough reduction in the time versus card, pin, navigate to withdraw, dispense such that it would enable this attack.

What do ATMs elsewhere do? This is the only way I know.

The ATMs I regularly use authenticate THEN ask for what you want to do.

Re: AI-driven thermal cameras used to obtain passwords

#42

Post by teddyh »

Wowfunhappy wrote: post #38
teddyh wrote: post #28

Earlier quoted context omitted.

We should stop manually entered passwords. Using a password manager (like the one built into your web browser) with unique secure passwords is fine.

How do you authenticate the password manager?

The context was to stop entering passwords into web sites. The password manager is run locally.

Re: AI-driven thermal cameras used to obtain passwords

#43

Post by dijonman2 »

bilekas wrote: post #18
gluecode wrote: post #11

I wonder if ATM machines should have a keyboard cooling function to erase thermal signatures, immediately after each customer session.

This is actually a great point I hadn't even considered. I had heard of cretins using a small grease film like a tiny layer of vasolene etc on pinpads and then after the victim uses, they would shine a light on it to see.

Grease films are typically detected by the user. Better to dust the keys with a UV sensitive powder and inspect the ATM after pin entry.

Re: AI-driven thermal cameras used to obtain passwords

#44

Post by bheadmaster »

wongarsu wrote: post #33
pabs3 wrote: post #26

It is well past time to stop using passwords. We should be using TLS client certs (as in mutual TLS aka mTLS) or WebAuthn passkeys already. I prefer certs because they don't require support in the web application, but they have a terrible UI and browsers seem to be making that worse, so WebAuthn it is, I just wish WebAuthn would have a standardised HTTP header or TLS extension so it would be usable without JavaScript…

That's probably better. But moving entirely from "things I know" to "things I own" comes with its own set of security disasters waiting to happen. We are better off using those to augment the password than to replace it.

I don't think "things I own" is a bad security model in itself.

The ideal of authentication (to me) seems to be some kind of USB dongle with your private key baked in the hardware, that you can use to create digital signatures proving your identity. Short of stealing the dongle, there is no way anyone can steal your identity.

Re: AI-driven thermal cameras used to obtain passwords

#45

Post by dagw »

SanjayMehta wrote: post #35
wongarsu wrote: post #14

Earlier quoted context omitted.

That's how pin pads on doors work: you punch in the PIN, then immediately go through the door. And those pin pads are somewhat popular in commercial settings because it's easier to distribute knowledge than to distribute physical keys.

I haven't seen a PIN pad lock in years in secure facilities, everyone uses contactless cards.

At work we have both for many doors. You have to scan your card and then enter your PIN. This way someone can't just steal a card.

Re: AI-driven thermal cameras used to obtain passwords

#46

Post by 4gotunameagain »

somehnacct3757 wrote: post #30

My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…

what's easier, doing an elaborate dance every single time you touch an ATM, or cancelling your card and having the bank revert the transactions in the relatively slim chance of fraud ? :)

Re: AI-driven thermal cameras used to obtain passwords

#48

Post by MonkeyMalarky »

4gotunameagain wrote: post #46
somehnacct3757 wrote: post #30

My list of ATM defensive rituals grows even longer. For those who think time at ATM matters, consider a thermal camera like the one at the start of the video, concealed in the cabinet by fake panels. You enter your PIN, move your hand away to touch the screen seconds later, you're pwned. Thermal cam has your digits and vague sense of hand movements. Cover the keypad with your other hand, take detours when moving your…

what's easier, doing an elaborate dance every single time you touch an ATM, or cancelling your card and having the bank revert the transactions in the relatively slim chance of fraud ? :)

I just use the ATM inside my local bank branch. The same location, all the time.

Re: AI-driven thermal cameras used to obtain passwords

#49

Post by brk »

They appear to be using a somewhat costly handheld thermal camera, which likely has a FLIR Boson or equivalent sensor. Those are pretty bulky and expensive, making it hard to use this attack without hanging out near the keyboard/keypad you want to surveil.

A FLIR Lepton series[0], or similar, is much smaller, but still ~$160/ea., and even though it is "smaller", it's not as easy to hide in an ATM as a cheap pinhole camera. It is also much lower resolution and has lower thermal sensitivity. Which would most likely greatly reduce the places where you could deploy this equip in a leave-behind covert setup.

It looks like a neat proof of concept, but probably not a day to day risk the average person needs to be concerned about.

[0] https://www.digikey.com/en/products/detail/flir-lepton/500-0...

Re: AI-driven thermal cameras used to obtain passwords

#50

Post by alistairSH »

bheadmaster wrote: post #44
wongarsu wrote: post #33

Earlier quoted context omitted.

That's probably better. But moving entirely from "things I know" to "things I own" comes with its own set of security disasters waiting to happen. We are better off using those to augment the password than to replace it.

I don't think "things I own" is a bad security model in itself. The ideal of authentication (to me) seems to be some kind of USB dongle with your private key baked in the hardware, that you can use to create digital signatures proving your identity. Short of stealing the dongle, there is no way anyone can steal your identity.

Using your dongle example, how do you access important services away from home? Carry the dongle everywhere? If so, you risk losing the dongle.

Same with your phone as the "thing I own". That's great, until the phone dies/breaks/gets lost. Hopefully you have a tablet as backup, or the paper copy of your one-time codes in your wallet.

I don't have a good answer. I just hate the idea of needing to access banking services when traveling should my phone become unavailable.

Post reply on HN