Smartphone PIN revealed by camera and microphone

The PIN for a smartphone can be
revealed by its camera and
microphone, researchers have
warned.
Using a programme called PIN Skimmer a
team from the University of Cambridge
found that codes entered on a number-
only soft keypad could be identified.
The software watches your face via the
camera and listens to clicks through the
microphone as you type.
The tests were carried out on the Google
Nexus-S and the Galaxy S3 smartphones.
"We demonstrated that the camera,
usually used for conferencing or face
recognition, can be used maliciously," say
the report's authors Prof Ross Anderson
and Laurent Simon.
According to the research, the
microphone is used to detect "touch-
events" as a user enters their PIN. In
effect, it can "hear" the clicks that the
phone makes as a user presses the
virtual number keys.
The camera then estimates the
orientation of the phone as the user is
doing this and "correlates it to the
position of the digit tapped by the user".
"We watch how your face appears to
move as you jiggle your phone by
typing," said Ross Anderson, professor of
security engineering at Cambridge
University.
"It did surprise us how well it worked,"
he told the BBC.
When trying to work out four-digit PINs
the programme was successful more
than 50% of the time after five
attempts. With eight-digit PINs the
success rate was 60% after 10 attempts.
Many smartphone users have a pincode
to lock their phone but they are
increasingly used to access other types of
applications on a smartphone, including
banking apps.
This raises the question of which
resources should remain accessible on a
phone when someone is entering a
sensitive PIN, say the report's authors.
Randomise keys
"For instance when a call comes in, the
user needs to hear the ring tone while
unlocking his phone; otherwise he may
assume the caller has hung up."
One suggestion to prevent a PIN being
identified is to use a longer number but
the researchers warn this affects
"memorability and usability".
"Randomising" the position of numbers
on the keypad is also suggested but the
researchers believe this would "cripple
usability on phones".
Getting rid of passwords altogether and
using fingerprints or face recognition are
offered as more drastic solutions.
"If you're developing payment apps,
you'd better be aware that these risks
exist," warns Prof Anderson.