Inferring Your Mobile Phone Password via WiFi Signals
fermatslibrary.com
Inferring Your Mobile Phone Password via WiFi Signals
1–10 of 69 posts
Re: Inferring Your Mobile Phone Password via WiFi Signals
#2Direct link to PDF without the (infuriating) popups/overlays: http://delivery.acm.org/10.1145/2980000/2978397/p1068-li.pdf
Re: Inferring Your Mobile Phone Password via WiFi Signals
#3Some weeks back I read a post here about detecting people in rooms by measuring how the physical body interferes with the wifi signals. I wouldn't have imagined someone could extract useful information at this small of a scale. wow!
Re: Inferring Your Mobile Phone Password via WiFi Signals
#4Holy shit.
From a brief scan it looks like the paper concentrates on recovering a numeric pin, but these attacks never get worse, only better, so I assume full keyboard access is not too far off.
What's the defense? Have your phone manage the passwords and unlock via fingerprint?
Re: Inferring Your Mobile Phone Password via WiFi Signals
#5Moral of this (and every other) story: Never, ever connect to a free, public wifi.
ETA: This was meant to be glib, given the frequency of such stories seen on HN, and the many children below are quite correctly pointing out that the real moral is https://news.ycombinator.com/item?id=13645694
Re: Inferring Your Mobile Phone Password via WiFi Signals
#6Direct link to PDF without the (infuriating) popups/overlays: http://delivery.acm.org/10.1145/2980000/2978397/p1068-li.pdf
popped by the comments just to find something like this (but the link doesnt work)! thanks anyway!
Re: Inferring Your Mobile Phone Password via WiFi Signals
#7For those who want more information on CSI (Channel State Information):
http://dhalperi.github.io/linux-80211n-csitool/
This allows you to use a custom firmware developed for the Intel 5300 wireless adapter and read the CSI values with each packet.
Every 802.11n implementation that I am aware of keeps a CSI vector (IQ values, typically as integers) within the wifi chip. Both the Wifi AP and STA do this. The CSI vector is updated with every packet, using the training data at the beginning of the packet. (802.11 is CSMA [2] so there is a fixed transmission to start the packet)
In other words, Intel has this nice tool for one of their (now somewhat dated) chips. But CSI is not restricted to Intel chips. Atheros chips have a decent but limited CSI readback method, not quite as nice as Intel's [3]. But CSI has been used for experiments on all major wifi chips out there.
With 802.11n this is used to determine the quality of signal likely to be received on each sub-carrier within the signal.
CSI is useful for many other things: RF experiments, indoor position sensing, and now apparently also password cracking.
[2] https://en.wikipedia.org/wiki/Carrier_sense_multiple_access_...
Re: Inferring Your Mobile Phone Password via WiFi Signals
#8Moral of this (and every other) story: Never, ever connect to a free, public wifi. ETA: This was meant to be glib, given the frequency of such stories seen on HN, and the many children below are quite correctly pointing out that the real moral is https://news.ycombinator.com/item?id=13645694
It would seem that that's not the moral of the story: it looks like your device doesn't even have to connect to the wifi. It appears that this is more like using wifi as radar to detect finger movements.
Re: Inferring Your Mobile Phone Password via WiFi Signals
#9Moral of this (and every other) story: Never, ever connect to a free, public wifi. ETA: This was meant to be glib, given the frequency of such stories seen on HN, and the many children below are quite correctly pointing out that the real moral is https://news.ycombinator.com/item?id=13645694
It would seem that that's not the moral of the story: it looks like your device doesn't even have to connect to the wifi. It appears that this is more like using wifi as radar to detect finger movements.
Yes, I think a passive listener in promiscuous mode would work. And more listeners located around the room would be even better, if their signals could be very precisely correlated in time.
In more detail: CSI is available to the _receiver_ of the wifi packet. In other words:
• Your phone can determine CSI for all AP broadcasts. (Useful for indoor positioning)
• The AP can determine CSI for any packet sent to it. Thus your phone would have to be associated. (Or, at least trying to associate.)
• A passive listener in promiscuous mode should still work -- maybe -- though I couldn't say for certain. The CSI value would not be identical to what the AP receives since the listener is in a different physical location and is not synchronized to the AP. The CSI data is In-phase and Quadrature values which can only be interpreted in relation to the clock that is being used to sample the radio signal. But maybe this approach manages to get around clock sync issues somehow.
• If your finger locations change without any wifi packet transmission, there is no way to detect that.
I'd say the best mitigation is to turn off wifi while typing your password. Then turn it on just before hitting "Submit" or "Enter" or whatever.
Re: Inferring Your Mobile Phone Password via WiFi Signals
#10Moral of this (and every other) story: Never, ever connect to a free, public wifi. ETA: This was meant to be glib, given the frequency of such stories seen on HN, and the many children below are quite correctly pointing out that the real moral is https://news.ycombinator.com/item?id=13645694
It would seem that that's not the moral of the story: it looks like your device doesn't even have to connect to the wifi. It appears that this is more like using wifi as radar to detect finger movements.
So then its probably a pretty good idea to randomize the number keypad for the lock screen, which I do. Does this defeat that, I can't think of a way it does..