a method for intercepting passwords used by users on tablets and smartphones through Google Glass, as well as other "smart" devices that can record video.
According to a CNN report, the “eavesdropper” can be a few meters away from his target and does not even need to see the screen in question - as long as he has an image of the victim. Specifically, for the purposes of the system, software was created that “maps” the movements/shadows of the user’s fingertips on a touchscreen on a tablet or smartphone. The algorithm “translates” these movements into the numbers that the victim pressed, thus composing the code. According to CNN, the algorithm was tested on codes on an iPad, Nexus 7 and iPhone 5.
At first glance, the whole system, although impressive, does not really pose a big "threat", for example, in terms of intercepting PINs for tablets and smartphones, as, in any case, the device itself would also need to be stolen. However, Xiwen Fu, one of the researchers, emphasizes that the risk posed by such a system is really great, as it could be used to intercept bank account numbers, e-banking codes, etc. - all it takes is someone equipped with the appropriate device (Google Glass is suitable as alternatively the perpetrator would be perceived, since he would "mark" the victim with his device's camera) and who has the victim in his field of vision. Nevertheless, Fu and his team experimented with a variety of devices (Google Glass, mobile camera, webcam, camcorder). In one case the software was able to work effectively on camcorder video taken from a distance of approximately 45 meters.
"The issue is the angle. For the 'attack' to be successful, the attacker must be able to change the angle to capture better video...if they see your finger, the password has been stolen," says Fu.
According to Google, Glass was designed with privacy in mind, and there are clear indicators when it's being used to record video. A company spokesperson told CNN that people tapping passwords at ATMs or laptops is nothing new, but Glass lights up when video is being recorded, so it's easy for people around to see.
The main weakness the system exploits is that numbers on a keyboard always appear in the same places. There are tools that change this (for example, displaying a 9 where a 1 would appear) but they are not widely used. The team's work aims to make such protections more mainstream.
The research will be presented in more detail at the Black Hat cybersecurity conference next month.
Source: secnews.gr
