What are some ways to steal a password/PIN using this system?

Question

http://cups.cs.cmu.edu/soups/2007/posters/p147_lim.pdf

Essentially uses an on-screen keypad that does not show the complete keypad numbers at a time. The image is refreshed at the rate of the monitor's refresh rate. Since it refreshes so quickly, our eyes can put the images together and form the keypad but for a screen capture would only capture one of the images showing an incomplete keypad. The system relies on the fact that the spyware would have to take screenshots at the same rate as the refresh rate and therefore, would consume resources and risk discovery.

Answer 1

It will be harder, but not impossible.

The flaw in their solution is that they think one have to take screenshots at the same rate as the monitors refresh rate to get a complete image set. One only need a sample of each of the images.

You only need a program that takes 2-3 pictures a second (at a random interval) and check the difference between these. If an user uses 15 seconds to enter the pin, the spyware have maybe 30 to 50 pictures, this should be enough to joint to a picture that can be read by OCR. Combined with the mouse movement the spyware have your pin.

Answer 2

Apart from taking screenshots, you could also grab the images being displayed direcetly from the browser DOM, for the image element under the pointer, and average them out (doing effectively what the eye does).

This scheme is only another step in the man-in-the-browser arms race - it makes the site using it marginally harder for a general-purpose trojan to break, at the cost of accessibility.

The benefit to the site using it is that it is no longer the low-hanging fruit, so hopefully trojan authors will concentrate on other sites. But if an attacker is sufficiently motivated to put a workaround in for the specific site using it, or if the scheme becomes more widely deployed such that it's worth defeating more generally, it does not represent a solution.

Answer 3

Some ways immediately come to mind:

• Reconstruct the picture by overlaying the screen captures. Think of it as a salami attack, but with pieces of information instead of money: if the key positions remain the same after every click and it takes 20 seconds to click the pin, an attacker is bound to get a few usable screenshots, and by putting the images on top of each other it could form a picture of the virtual keypad
• Take screenshots at the same rate as the refresh rate. Yes, as you rightly state this would increase the chances of detection but not as much as you think in a world of ubiquitous fast networks and processors. As processors grow and networks get more bandwidth the resource cost of screenshot capturing tools goes down.
• Simply track the movement and clicks of the mouse. You don't need to see the screen to reconstruct the pin, you just have to know where the virtual keyboard exists and the layout of the keys, and a single screenshot would allow that. Of course, if you're clever you would design this so that the keyboard and key layout would change every time it is used. In fact, you could have the keys change positions after ever click
• Van Eck phreaking: Even though the refresh has been changed you could track the electromagnetic emissions of the screen and reconstruct the picture from that

That all being said, I don't think it's a bad idea. It could be tough for people with visual impairments to use, and it isn't a vast improvement, but it would make the attacker's job harder. The important thing would be to change the position, design, and layout of the keys after every click, otherwise an attacker is going to be able to reconstruct the keypad clicks.