Touch Screen Password Guessing by Fingerprint Trace

Question

After eating some garlic bread at a friend's who is not security-aware, she managed to quickly determine the PIN code to unlock the screen of my Samsung SIII.

She figured this out by simply holding the device against the light and looking at the grease pattern my thumb left on the screen. It only took her 2 attempts to unlock the screen.

I guess she would not have been able to access my phone if I had kept the screen cleaner, or if the device could only be unlocked by pressing numbers, rather than dragging the finger to form a pattern.

Is this a common means of attack? Are finger dragging pattern passwords really more insecure than number touch passwords?

Answer 1

This is known as a 'Smudge Attack'

It really depends on how much you've used your phone since you've last unlocked it, but the general principle still stands. If you use the pattern feature of Android phones, this can be particularly obvious.

The University of Pennsylvania published a research paper on the topic and basically concluded that they could figure out the password over 90 percent of the time.

The study also found that “pattern smudges,” which build up from writing the same password numerous times, are particularly recognizable.

Furthermore:

“We showed that in many situations full or partial pattern recovery is possible, even with smudge ‘noise’ from simulated application usage or distortion caused by incidental clothing contact,”

While this is a plausible risk, It is not a particularly practical vulnerability as an attacker needs physical access to your phone. Using a PIN Code over a pattern may reduce the chance of this presenting a threat but it still exists depending on the strength of your PIN and the cleanliness of your hands/screen. However, these same researchers postulate another possible attack using the heat residue left by contact between your fingers and the screen which would be another problem altogether.

Obviously, cleaning your screen after every use is a practical (and not too difficult) defense against this specific attack. I'd expect that if you have used your phone (say to make calls/send a message/any kind of web browsing) it would also sufficiently obfuscate the patterns/codes. From examining my screen this seems to be the case.

Answer 2

One way to mitigate smudge attacks on smart phones is with an application called WhisperCore. It arranges the numbers vertically and it then asks you to wipe the screen in order to unlock the phone, obfuscating the original smudges.

If you use a pattern to lock your phone, after you input the correct pattern, it a screen full of stars. Swipe the highlighted stars to unlock the phone, again obfuscating the original smudge pattern.

Of course, the application basically works as a mandatory reminder to wipe your screen, but it's doing it in a way that makes less annoying to wipe your screen every time you unlock your phone.

Image source: Android Police

Answer 3

There was a paper (will try and find it) that gave a very good explanation of a security improvement:

Using one of the digits at least twice, in a pass code of more than 4 digits

Basically, the "swipe a pattern" option is very easy to see - even at a distance it can be shoulder surfed. Have a look at this paper for some interesting information on techniques.

A 4 digit pin is what most users end up choosing, if they use the pin option, so it is what most attackers will try, and holding the phone up to the light lets you see the pin quite clearly. If however you have a 6 digit pin where 2 of the digits are used twice, the attack space becomes quite challenging, as the attacker doesn't know whether you use a 4 digit pin, a 5 or even more - they are likely to start with a 4 and are more likely to lock the phone than get into it.

Answer 4

This would be a good reason for another method of unlocking that made the unlocking action different every time. For example, instead of the numbers 0-9 being laid out as:

7 8 9
4 5 6
1 2 3
  0

it might display them as:

3 5 7
1 2 4
6 9 0
  8

Instead of numbers, you could use shapes. Instead of just hitting the shapes or numbers, you could rearrange them into the correct pattern, though that would be less secure as it would be displaying the correct pattern immediately before it is unlocked; However, if the goal were to put the numbers in the matrix into an order where sums, etc. of certain rows were correct, that might be even more secure/less obvious to those that saw or recorded you performing the unlocking sequence.

Possibly for those only visually impaired, it could read the numbers out loud (through their headphones). For those that are visually impaired and hearing impaired, the phone could vibrate in a certain way when they touch different parts of the phone to determine which number is which, then they touch something once they know which number is where to enter the code. You could also have it lock the numbers into a certain orientation and only change on a predetermined schedule to make it less difficult to have to remember the new orientation, or even lock it completely, even though that would be susceptible to smudge attack.

Answer 5

I for one have always wiped my screen on my shirt after unlocking it specifically because of this (and because I find the finger swipe marks annoying.) But yes, this is very much a risk if you unlock it and don't at least continue to use it for a while to mess up the markings.

A pin code might help some, but you might still be able to see the spots touched which would greatly reduce the complexity of guessing the password. It's still a good idea to wipe the screen if there are visible markings.

Another good counter for this would be if they added a second quick step to trace another pattern that would make recognizing the pattern more difficult before unlocking.

Answer 6

I've wiped down my screen every time I turn it on for quite some time. It's partly due to this problem and partly to increase readability in the presence of glare. I was very interested to find out there is actual research out there on the topic.

While touch screens are especially prone to the problem of physical residue revealing secret information (despite the improvements that have been made in oleophobic screen coatings), the problem can also occur with other input methods. Fingerprints may be visible on the surface of (hardware) buttons, switches, or keypads, even without the use of specialized equipment.

Even if they're wiped down, however, there's a more permanent problem. I'm sure we've all seen text that has been rubbed off, membrane overlay that has ripped, or plating that is wearing down on a frequently used button:

In a security context, this type of problem likely means that the password is not being changed often enough, but I've seen real examples of it. Obviously it needs to be changed out before this degradation becomes visible to the naked eye. In higher security settings, though, that's probably not enough. Two possible remediations are to use very durable buttons and to even out the number of presses of every button either before or after entering the password.

Answer 7

I use all ten digits exactly once in a ten-digit pin on my tablet, versus a pattern. I also don't keep anything of particular value on my tablet (the only reason the password is there as a PIN is mandatory to save VPN configuration details with Android -- not including my user password).

Note: using a permutation of all ten digits exactly once does significantly cut down on the entropy. The # of permutations: 10! = 3 628 800, which is roughly equivalent to a 6.56 character-long pin, or about 3000 times easier than a 10 digit random pin.

Also, I find its fairly easy to eavesdrop a PIN on a touchpad when I use my tablet commuting on a subway, but find that this is a reasonable defense against smudge attacks.