Computer security experts have developed a system capable of guessing computer and smartphone users’ passwords in seconds by analysing the traces of heat their fingertips leave on keyboards and screens.
AI-driven ‘thermal attack’ reveals password
Researchers from the University of Glasgow developed the system, called ThermoSecure, to demonstrate how falling prices of thermal imaging cameras and rising access to machine learning are creating new risks for ‘thermal attacks.’
Thermal attacks can occur after users type their passcode on a computer keyboard, smartphone screen or ATM keypad before leaving the device unguarded.
A passerby equipped with a thermal camera can take a picture that reveals the heat signature of where their fingers have touched the device.
The brighter an area appears in the thermal image, the more recently it was touched.
By measuring the relative intensity of the warmer areas, it is possible to determine the specific letters, numbers or symbols that make up the password and estimate the order in which they were used.
From there, attackers can try different combinations to crack users’ passwords.
Previous research by Dr Mohamed Khamis, who led the development of ThermoSecure, has already demonstrated that non-experts can successfully guess passwords simply by looking carefully at thermal images taken between 30 and 60 seconds after surfaces were touched.
In a paper published in the journal ACM Transactions on Privacy and Security, Dr Khamis and the authoring team explain how they set out to harness machine learning to make the attack process more accurate.
To do so, they took 1,500 thermal photos of recently-used QWERTY keyboards from different angles.
Then, they trained an artificial intelligence model to effectively read the images and make informed guesses about the passwords from the heat signature clues using a probabilistic model.
Through two user studies, they found that ThermoSecure was capable of revealing 86% of passwords when thermal images are taken within 20 seconds, and 76% when within 30 seconds, dropping to 62% after 60 seconds of entry.
They also found that within 20 seconds, ThermoSecure was capable of successfully attacking even long passwords of 16 characters, with a rate of up to 67% correct attempts.
As passwords grew shorter, success rates increased – 12-symbol passwords were guessed up to 82% of the time, eight-symbol passwords up to 93% of the time, and six-symbol passwords were successful in up to 100% of attempts.
The post AI-driven ‘thermal attack’ reveals password in seconds appeared first on Payments Cards & Mobile.
