Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers backdoor the human brain, successfully extract sensitive data

extremetech.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Hackers backdoor the human brain, successfully extract sensitive data

#61

Post by anologwintermut »

The research(both in this paper and the previous one at Usenix security 2012) is over hyped bullshit. The experiment was: remember this pin number to enter at the end of the experiment and then we show you numbers and look for a recognition signal. Or they check that you recognize an image of your bank.

This is just image/text recognition research from 1980's and 90's neuroscience regurgitated as security publications with far shittier experimental methodology and consumer equipment.

At no point did they actually demonstrate they got access to secrets you knew. E.g. your real PIN number and they certainly didn't demonstrate they could do so surreptitiously. There is no reason to believe you could actually do this and these experiments tell us nothing we didn't already know from actual real experiments done by real clinical researchers: you can use the p300 signal to tell if someone recognizes a specified stimulus.

Re: Hackers backdoor the human brain, successfully extract sensitive data

#62

Post by fooqux »

PeterisP wrote: post #43
Centigonal wrote: post #5

This is an awfully contrived title for an article that could be summarized as "people can find out whether or not you recognize something shown to you by monitoring electrical activity along the scalp."

If you manage to hack out a list of all 4-digit numbers that you recognize, it's trivial to bruteforce which of those numbers are for your cards or for some other security PINs. Also, it has other practical uses - think of it as a better-than-polygraph test for questions of type "have you seen this person" or "does this account-password belong to you".

>If you manage to hack out a list of all 4-digit numbers that you recognize, it's trivial to bruteforce which of those numbers are for your cards or for some other security PINs.

While correct, I think you're missing something huge.

I'm not sure how long it takes for your brain to recognize a 4-digit number as something you "know". Absolute fastest would be something around 32/second, as I believe that's about as fast as your brain can view an image (movie frame rate). However, I'm reasonably sure it's much slower than this, and we haven't even factored in how long it takes the computer hooked up to your brain to recognize a change. So for the purposes of this argument, I'm going to say about one PIN per second.

So, for a 4 digit PIN, you can spend 9999 seconds to "hack" the mark's brain, and then try all those combinations that showed a recognition pattern. Or you could just brute force all 9999 permutations, likely at a much faster than 1 per second, without needing physical access to the mark, and without all sorts of crazy hardware.

Re: Hackers backdoor the human brain, successfully extract sensitive data

#63

Post by Chris2048 »

aa0 wrote: post #31
Aardwolf wrote: post #20

Summon the tinfoil hats!

I'm pretty sure schizophrenia or Parkinson's would be more effective. The interrogators can just pull the hat off. What you want is brain "static"

A person suffering from death would also be mostly immune to this kind of attack.

Re: Hackers backdoor the human brain, successfully extract sensitive data

#65

Post by atondwal »

fooqux wrote: post #62
PeterisP wrote: post #43

Earlier quoted context omitted.

If you manage to hack out a list of all 4-digit numbers that you recognize, it's trivial to bruteforce which of those numbers are for your cards or for some other security PINs. Also, it has other practical uses - think of it as a better-than-polygraph test for questions of type "have you seen this person" or "does this account-password belong to you".

>If you manage to hack out a list of all 4-digit numbers that you recognize, it's trivial to bruteforce which of those numbers are for your cards or for some other security PINs. While correct, I think you're missing something huge. I'm not sure how long it takes for your brain to recognize a 4-digit number as something you "know". Absolute fastest would be something around 32/second, as I believe that's about as fas…

Consider an ASCII password of unknown length.

Now you just show your mark each symbol to check if it's a part of the password, which would drastically and usefully reduce your search space (unless it a password that uses almost all ASCII characters, but those are extremely rare...).

Re: Hackers backdoor the human brain, successfully extract sensitive data

#66

Post by PeterisP »

atondwal wrote: post #65
fooqux wrote: post #62

Earlier quoted context omitted.

>If you manage to hack out a list of all 4-digit numbers that you recognize, it's trivial to bruteforce which of those numbers are for your cards or for some other security PINs. While correct, I think you're missing something huge. I'm not sure how long it takes for your brain to recognize a 4-digit number as something you "know". Absolute fastest would be something around 32/second, as I believe that's about as fas…

Consider an ASCII password of unknown length. Now you just show your mark each symbol to check if it's a part of the password, which would drastically and usefully reduce your search space (unless it a password that uses almost all ASCII characters, but those are extremely rare...).

No, the proposed method can't check if it's a part of the password, it can check if it's a part of a password/something the person has ever known. All alphanumerics would be included naturally.

The reason for PIN's is that if your pin is '8243', then that number will provoke a "recognition" response much different than, say, '8244' which (to you) is just a random number with no specific associations.

Re: Hackers backdoor the human brain, successfully extract sensitive data

#69

Post by singingfish »

asifjamil wrote: post #37
singingfish wrote: post #34

Earlier quoted context omitted.

EEG is much easier to collect data from. Fmri needs a big machine and lots of helium, so it's impractical for daily use.

Perhaps it's more practical and better with temporal resolution, but it depends on how concerned you are with spatial resolution too (which EEG is quite poor with).

That's the point of this article. The experiment routes around the lack of good spatial resolution in the data. It's like a much more sophisticated, much less easy to game polygraph.

Re: Hackers backdoor the human brain, successfully extract sensitive data

#70

Post by prof_hobart »

PeterisP wrote: post #45
prof_hobart wrote: post #38

Earlier quoted context omitted.

Couldn't you just do one digit at a time (is your first digit 1?, etc)? It would take less than a minute at 1 second per digit that way.

No, since all isolated digits would have similar responses. The attack vector is not "is x your PIN?" but it's "is pattern xyzw meaningful to your brain whatsoever?"

My reading of the article is that if you show someone something that is significant to them, such as "Is the first digit of your PIN the number 1?", then it'll trigger a measurable response, and the first graph in the article is "1st digit PIN"

So I'm not sure where you're reading that it wouldn't work using the single digit approach.

Post reply on HN