Researchers Develop New Way To Steal Passwords Using Google Glass 116
mpicpp writes with a story about researchers who have developed a way to steal passwords using video-capturing devices.Cyber forensics experts at the University of Massachusetts in Lowell have developed a way to steal passwords entered on a smartphone or tablet using video from Google's face-mounted gadget and other video-capturing devices. The thief can be nearly ten feet away and doesn't even need to be able to read the screen — meaning glare is not an antidote. The security researchers created software that maps the shadows from fingertips typing on a tablet or smartphone. Their algorithm then converts those touch points into the actual keys they were touching, enabling the researchers to crack the passcode. They tested the algorithm on passwords entered on an Apple iPad, Google's Nexus 7 tablet, and an iPhone 5.
That does it (Score:2, Insightful)
Time to trademark a 'No Glass Allowed' symbol.
Re:That does it (Score:5, Funny)
Time to trademark a 'No Glass Allowed' symbol.
Better make it "No Cameras Allowed". Which, incidentally, also means "No Smartphones or Tablets Allowed", since they all have cameras... which would actually eliminate the risk of passwords being stolen as they're entered into a smartphone or tablet, since no smartphones or tablets are allowed. Problem solved!
Re: (Score:3)
Better make it "No Cameras Allowed". Which, incidentally, also means "No Smartphones or Tablets Allowed", since they all have cameras... which would actually eliminate the risk of passwords being stolen as they're entered into a smartphone or tablet, since no smartphones or tablets are allowed. Problem solved!
Shut up, glasshole.
Jealous, much? Actually, I don't have Google Glass... but I'm hoping to get one for Christmas this year. Neener neener!
Re: (Score:3)
Of course if you are entering a password whilst using an augmented reality device only you can see what you are doing and why you are doing it. So only way to defeat all those countless surveillance cameras http://www.telegraph.co.uk/tec... [telegraph.co.uk] , http://www.nbcnews.com/id/4416... [nbcnews.com]. Perhaps google glass isn't the problem perhaps the problem already exists.
Re: (Score:2)
No one is surprised that you aspire to being a glasshole.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Time to patten the laptop keyboard password protector
Or just go with a fingerprint reader.
Re: (Score:2)
Yeah because its so easy to change next time [popular web service] has a security breach and your fingerprint is in the hands of criminals.
Re: (Score:2)
These glassholes who whine about Google Glass are not very bright.
Re: (Score:3)
Any video capture device, like every smartphone, security camera, and other form of video camera on the planet can be used for this.
Re: (Score:1)
Yeah if you had it on all the time and mounted on your face. Oh wait, that is just Google glass.
Re: (Score:2)
Yeah if you had it on all the time and mounted on your face.
There are no such requirements for this method of password stealing to work.
Watching them enter the passcode. (Score:5, Funny)
TLDR - Researchers steal passwords by watching them being entered.
This is why genital recognition is needed. (Score:2, Funny)
The fact that the device is out in the open when the password is entered is the problem here.
There's one technology that solves this problem, and that technology is genital recognition. It works like a password, but it depends on the unique pattern exhibited by each individual's genitalia.
When a password needs to be entered, the user puts the phone down his or her pants/skirt/dress/whatever, and presses the screen against his or her genitalia. The pattern is then analyzed and compared against known data poi
Re: (Score:2)
My previous system relied on a specially designed bicycle seat; but if you can do it with a capacitive screen phone, that's probably a patent-able improvement.
Re: (Score:3)
Bicycle seats do not make contact with one's genitals, regardless of gender.
You would think that but:
https://www.google.com/search?q=World+Naked+Bike+Ride&num=30&newwindow=1&safe=off&source=lnms&tbm=isch&sa=X&ei=xSK7U_LMO8n0oATDrYKgDw&ved=0CAgQ_AUoAQ&biw=961&bih=460 [google.com]
There is not a can of lysol or bottle of purell to be had in that city on the day after the event...
Re: (Score:1)
Have you tried? The resolution of the digitizer should be able to detect very small inputs. Maybe you have defective unit?
I just might do this (Score:2)
Re: (Score:1)
This is a most excellent idea. However, a method may be developed to circumcise this process by implementing "bulge recognition" software.
Re: (Score:1)
Presumably this involves some kind of nano-sensor for you? :P
Re: (Score:2)
How well does this work for randomized keypad layouts?
Re: (Score:3)
TLDR - Researchers steal passwords by watching them being entered.
Solution: EVERYBODY PANIC!
Or.
Put the goddamn phone down in public, pay attention, and hell, start an old fashioned conversation once in a while.
You are welcome on my lawn, but watch your step. We don't allow the dogs the use of our indoor plumbing.
I've always thought (Score:5, Interesting)
Re: (Score:2)
Re:I've always thought (Score:4, Insightful)
That's why you'd have it opt-in. Let the security-conscious lead the way.
Re: (Score:2)
If you let muppets choose, then that's where it usually falls apart.
Re: (Score:2)
Re: (Score:2)
not always just in highly secure facilities.
In France the bank associated to the national post office -one you wouldn't expect recruiting geniuses- does present such a variable keypad when you want to access your account, and even more: you must move the mouse over each digit without clicking, basically following a path (a bit like on some phone unlock interfaces) but one that is different each time...
Re: (Score:3)
Being able to customize the keyboard based on the current input required is one of the best feature of virtual keyboards. I thought everyone would be randomizing the keyboard for the "password" field by now.
Re: (Score:2)
I thought everyone would be randomizing the keyboard for the "password" field by now.
You thought everyone would want to be reduced to the level of "hunt and peck" they were at the very first the time they saw a keyboard EVERY single time they needed to enter a password?
And what does it get you as a defense vs "google glass attack"? Well, not only do they have to see you enter the password from some oblique angle but for one instant during entry or before they need to see your 'one time virtual keyboard' or
Re: (Score:2)
1,2,3,4,5? That's amazing, I got the same combination on... aw, forget it.
Re: (Score:2)
Some do.
But they are a pain to use, since most of us do password entry with some muscle memory, and on a smart phone nobody which one opens and unlocks 100 times a day nobody is going to want to have to exert that much effort.
Re: (Score:2)
If you're doing it by muscle memory, you can do it with your hand covered. Problem solved.
Re: (Score:2)
On a physical keypad maybe. Not the one on my phone, where the slighest bit of alignment can result in a bad entry.... trebly true if we're talking passphrases using the alpha numeric keyboard.
Muscle memory is an assist, not a complete solution.
WildStar does this (Score:2)
The MMO WildStar uses a randomized keypad for their two-factor authenticator input.
After a while, you get pretty good at it.
Re: (Score:1)
That's horrible use case. It really should not matter if the hacker can get your used one time token after you have entered it. Of course, it's bigger deal if they are not actually one time tokens like in Wildstar (you can use the token until it expires), but that should be fixed by making them one time tokens.
Oh yeah, and their reasoning was that it would protect users against drive-by Javascript keylogger [wildstar-online.com] (on desktop client).
Re: (Score:2)
electronic keypads should randomize the numeric order and that the device should not mirror the letter typed on the inout line or on the keypad.
OR... you could just walk around as you type throwing off their algorithm and not introduce another overly complicated and insanely annoying security feature that would simply push people into not securing their devices at all.
Re: (Score:2)
electronic keypads should randomize the numeric order and that the device should not mirror the letter typed on the inout line or on the keypad.
I used to work at a secure facility with a keypad like this. It was the first stage to getting into the building. You would hit a button and the digits would randomize. I eventually got to the point where I could look at the pad and input my 6 digit code within about 2 seconds. It took me about 2-3 weeks to get that down pat. After that, I would only mess up about once or twice a month.
Re: (Score:2)
The spare parts stores at our manufacturing plant uses a keypad like this too.
Re: (Score:2)
I can only agree when you have a keypad that only has one code (one user), and you use it daily. Otherwise the used keys get worn out, which can help possible intruders. For a 4 digit PIN you will have 4!=24 possibilities instead of 10^4=10000, and even less when one digit occurs twice.
Google Glass only? (Score:5, Insightful)
Re:Google Glass only? (Score:4, Informative)
Re: (Score:2)
Stop stealing my name, please. :^P
Re: (Score:2)
And why limit it to just passwords? There's a whole onscreen keyboard there to be watched.
Re: (Score:2)
Try taking a handheld camera and hold it at people who are typing their phone or ATM pincode and see what happens... (Warning damage yo your face may occur). The problem is that you can't pretend it is off like you can with a google glass.
Re: (Score:3)
Step 1: Put on a dress shirt (or any shirt with a pocket on the front).
Step 2: Start your camera video recording and put it on your pocket (camera facing out, of course).
Step 3: Wait in line behind the person and position yourself so that you have a good view but also so that it's not obvious what you are doing. Pretend to be looking at something else. (Look at your watch or a book or something.)
Step 4: Review the footage later and get the person's password or PIN.
Wouldn't be hard to do, really.
Re: (Score:2)
You could easily set up a telescope and camera on a balcony on an elevated point overlooking target area.
Cover your input (Score:5, Insightful)
Re:Cover your input (Score:4, Funny)
Damn you! When I tried to cover my hand with the other one, my phone dropped to the floor...
Re: (Score:2)
Re: (Score:2)
So, what? You approach well endowed women of the appropriate height, say "Excuse me for a second", and place your phone on their voluminous cleavage, freeing both hands for securely entering your password?
That's ingenious!
Re: (Score:2)
Re: (Score:1)
For the last couple of years I have been completely covering any input I give to a phone unlock or ATM PIN given. With cameras everywhere, this was only a matter of time.
Should have picked a better pin than 0000.
Sensationalistic title and duh! (Score:5, Insightful)
As the video points out, this is not limited to Google Glass, any video capturing device will work. But beyond that, this is really kind of obvious. Yeah, video recording someone entering their password on a touch device will give you a fairly accurate idea of what that password is. Record, playback at 1/4 speed, password. I would bet that security camera footage might even be better to work with due to the angle. The custom software I suppose is a nice achievement, but I would guess it's not all that necessary.
Re: (Score:2)
Re: (Score:2)
Seems rather the opposite. We're very good at noticing when someone is looking at us (a leftover from being prey I suspect), but I always see people standing, holding their phone angled slightly (pointed nicely at any laptops at nearby tables). Add a fake game screen while the camera runs for extra stealth.
Re: (Score:2)
Except with Glass it's easier to do it by casually looking in the direction of the person. I'm fairly certain if someone has their smartphone or camcorder pointed in your direction steadily it's a little more obvious than someone just looking past you who happens to be wearing Glass.
Except with every other inexpensive video only device on market, and especially those designed for the task, it is even easier and more stealthy than Glass. ... and I'm sure all those and more can be found cheaper elsewhere.
Ex. http://www.newegg.com/Camcorde... [newegg.com]
Those start around $10.
For $45 you can get a pair of sunglasses that look very much like average sunglasses and have a 720p video recorder. http://www.newegg.com/Product/... [newegg.com]
This is not a Google Glass hack in any way, shape, or form. It would not surpr
Re: (Score:2)
In other news, professional behavioral psychologists teach a new dog old tricks.
http://blogs.mcafee.com/consumer/smartphone-pin-codes
http://www.syssec.rub.de/media/emma/veroeffentlichungen/2014/06/30/GraphNeighbors-Sicherheit14.pdf
Re:Sensationalistic title and duh! (Score:4, Funny)
Re: (Score:1)
nope but Gummy bears can fool the iPhone sensor. even better the smooth surfaces provide several finger prints to pull from.
Re: (Score:2)
"Here, hold this wrench a second"
s/Google Glass/a camera. (Score:1)
News Flash! (Score:2)
This just in, video cameras can record you entering passwords, more at 11.
Re: (Score:2)
Based on the buff pattern of his hand, he jerks off lefty.
He needs better lube.
Foiled By Password Safes (Score:2)
"Read out says CTRL+v, boss."
"Don't be stupid! It has to be Shift!"
Let me fix that for you (Score:4, Insightful)
Researchers Develop New Way To Steal Passwords Using a video camera
Easy... (Score:2)
Change your on-screen keyboard layout. Then they'll need to see the screen to figure out what letter is at each position.
Who would hae thought? (Score:1)
That you can capture passwords with a camera.
WTF .. This place is really gone to the dumps..
TOTC (Score:1)
Is this the "think of the children" glass-killer ?
Google - R u listening (Score:1)
It seems so simple... (Score:2)
Why doesn't someone just modify the snippet of code in the OS that displays the touch keys on the phone/tablet screen to place them in a new random order each time you unlock the device so that when you enter the PIN to unlock the device you never use the same finger placement pattern twice? That would also prevent analysis of scratches/smudges on the surface of the device as a means of cracking it.
I know, I know, users would probably complain.
Simple Fix (Score:2)
Use Dvorak.
Problem solved.