- Email: [email protected]
Hardening touchscreens against the shoulder-suffer threat
TECHNOLOGY ColorRings, has been developed by Olivier and Dunphy, along with colleagues David Kim and psychologist Pam Briggs at Northumbria University, also in Newcastle. It is based on the user remembering a sequence of pictorial icons instead of numbers. When entering this They make it easier for onlookers to spy your pass codes, but touch screens’ code, they are presented with a screen littered with different flexibility could be the source of easy-to-use, secure alternatives to PINs icons, including their four secret ones. By simply using one or more fingers to drag four different coloured circles – each representing one of four positions in the pass-code sequence – the user positions them so that each encircles the correct icon. What makes the system so resilient to snoopers is that each ring is large enough to encompass up to six icons, so a snooper will have no way of knowing which icon in each ring is part of the code. Even a spy dedicated enough to observe multiple logins would still have to quickly memorise dozens of different potentially correct icons and combinations each time, says Briggs. “It’s simple for the user but complex for the attacker,” she says. Some touch screens, such as Microsoft’s table-top system, called Surface, are capable of sensing pressure, offering an alternative route to secure passcode entry, says Olivier. His team has also developed a face-based authentication system. It requires –Spying won’t help you– the user to select a different known face in each of a sequence applications, shoulder surfing the bar needs to be raised so that of grids containing lots of faces. Duncan Graham-Rowe will only increase. New methods even if someone is watching you To foil shoulder surfers, the THE touch screen is fast-becoming of secure pass-code entry for enter a code, they can’t make use user places three fingers on each our favourite way to interact touch screens aim to tackle of it, says Patrick Olivier, also at grid, highlighting three rows or with computers, from sleek the problem. Newcastle University. columns of faces. But they subtly smartphones to the upcoming It’s not just a question of Reinventing the trusty fourapply additional pressure to tablet PCs. Brightly lit, responsive finding a dark corner and digit PIN is well-trodden ground the row in which the known screens are certainly pleasing to shielding the screen with your and already includes a range of face sits to make their actual use, but they also make it easier hand as you punch in your codes, alternatives, such as gaze-tracking selection, says Kim. “So the for “shoulder surfers” to spy your says Paul Dunphy, a computer or fingerprints, but such efforts user is not directly selecting secret pass codes. scientist at Newcastle University often require new hardware, says each face,” he says. Cellphone users typically spare in the UK. For one thing, this is Olivier. Now, with screens that Other groups are attempting little thought for such security often unpractical. “You need can detect multiple simultaneous to capitalise on the familiarity of issues, but as handsets become one hand to hold the phone,” he touches becoming the norm, new PIN systems. In one, developed by better equipped to deal with points out. But since smartphones possibilities are emerging, he says. Gridsure, near Cambridge in the mobile banking and e-commerce are used in all kinds of scenarios, One example of this, called UK, users first choose a particular
JON CHALLICOM/ALAMY
Touch screens: no friend of shoulder surfers
16 | NewScientist | 16 January 2010
For daily technology stories, visit www.NewScientist.com/technology
pattern of squares in a five-by-five grid, marking out a pattern they can easily remember. When required to enter this they are confronted with a similar grid, with each cell containing a random number (see diagram, right). To login they just punch in the numbers that appear in their chosen squares. The digits entered will change each time, while the
of two buttons – black or white, depending upon which colour that digit is. Then, the black and white pattern changes, and users must pick black or white again. After four such rounds, the system can identify which single digit corresponds to the sequence of colour changes. The drawback is that it therefore takes 16 presses to enter a four-digit PIN. Roth admits that this is an issue, but he says that recent trials using a smartphone show that the simple nature of the input means that people learn to perform the 16 presses quickly. “The fundamental difference is that with a traditional PIN the user always enters the same thing,” says Roth, whereas here their input changes each time. Given the resources, such as recordings of multiple logins, snoopers could potentially compromise any of these systems. “But that’s a much bigger hill to climb than someone shouldersurfing a normal PIN,” says Howes. Gadget lovers, rest assured. ■
“Authentication systems need to be easy for the user but complex for the attacker” all-important pattern remains only in the user’s head, says Gridsure’s CEO, Stephen Howes. Elsewhere, Volker Roth at the Free University of Berlin in Germany has come up with a hybrid approach using four-digit PINs. When entering numbers, users are shown a numerical keypad on which half the keys are coloured white and the other half black, seemingly at random. Instead of pressing these keys, the user is required to press one
Hidden patterns Even if a snooper notes the characters you enter, your pass code need not be compromised Choose a four-brick pattern from the grid of 25 squares
When entering the pass code, the grid is populated with random digits (right). By following the pattern above, someone watching you enter the code – in this case, 2356 – would not gain enough information to decipher your unique pattern
4 1 6 3 9
2 2 1 4 3
9 8 6 4 9
5 8 5 7 1
6 4 8 2 5
6 2 4 1 6 1 4
4 9 1 2 2
9 8 2 8 3 2
ABC
5
GHI
JKL
7
8
8 5 3 5 7
1 4 6 3 9 3
DEF
6
MNO
9
PQRS
TUV
WXYZ
*
0
#
The next time you enter your code, a new grid of numbers is generated. The PIN changes, but the pattern does not
Shh, a roving ‘bugnet’ may be listening in has to compromise your favoured device with a microphone-tapping spyware virus to monitor virtually all of your conversations, transmitting them whenever the device links to the internet (Computers & Security, HUGH WHITAKER/CULTURA/CORBIS
THE notion that a hacker could eavesdrop on you by commandeering your smartphone or your computer’s microphone is not new. But such bugging attempts could soon become far more powerful, even giving attackers the ability to monitor a target’s utterances almost anywhere they go – even if that target is nowhere near any of their own gadgets. As people embrace smartphones and notebook computers, which can remain more-or-less permanently connected to the internet, they have unwittingly ensured that they are never far from a potential electronic eavesdropper, warn Ryan Farley and Xinyuan Wang at George Mason University in Fairfax, Virginia. One side effect of this boom in connectedness is that a hacker only
Is that an innocent phone or a corrupted traitor in your hand?
DOI: 10.1016/j.cose.2009.12.002). But the pair suspect that because hackers have become adept at managing vast networks of compromised computers – called botnets – a new menace may emerge: attackers could extend their audio surveillance to any computer or phone that their target regularly comes into contact with. “It does not have to be under the control of the victim,” says Ryan. Using knowledge of their target’s lifestyle, a combination of social engineering and phishing could be employed to compromise the computers or devices of those they come near to. “That could be a Wi-Fi-connected laptop of a stranger who’s often close to the victim in a coffee shop, or a supposedly idle computer in a conference room the
victim uses frequently,” says Wang. Once such computers have been added to this roving eavesdropping network, dubbed a “bugnet”, they could then be controlled to transmit live audio on demand, such as when the target is expected to be nearby. The researchers wrote software for PC and Mac computers to demonstrate their bugnet concept. One security expert, speaking on condition of anonymity, reckoned the bugnet attack demonstrated is currently too crude to pose a serious threat. “Their infection-point either used an unpatched version of Windows XP, or a tailored installer on Mac OS X,” he says. It is unlikely any worthwhile target will used Windows unpatched, and few Apple Mac users would voluntarily install unknown software, he adds. Paul Marks
16 January 2010 | NewScientist | 17
JON CHALLICOM/ALAMY
Touch screens: no friend of shoulder surfers
16 | NewScientist | 16 January 2010
For daily technology stories, visit www.NewScientist.com/technology
pattern of squares in a five-by-five grid, marking out a pattern they can easily remember. When required to enter this they are confronted with a similar grid, with each cell containing a random number (see diagram, right). To login they just punch in the numbers that appear in their chosen squares. The digits entered will change each time, while the
of two buttons – black or white, depending upon which colour that digit is. Then, the black and white pattern changes, and users must pick black or white again. After four such rounds, the system can identify which single digit corresponds to the sequence of colour changes. The drawback is that it therefore takes 16 presses to enter a four-digit PIN. Roth admits that this is an issue, but he says that recent trials using a smartphone show that the simple nature of the input means that people learn to perform the 16 presses quickly. “The fundamental difference is that with a traditional PIN the user always enters the same thing,” says Roth, whereas here their input changes each time. Given the resources, such as recordings of multiple logins, snoopers could potentially compromise any of these systems. “But that’s a much bigger hill to climb than someone shouldersurfing a normal PIN,” says Howes. Gadget lovers, rest assured. ■
“Authentication systems need to be easy for the user but complex for the attacker” all-important pattern remains only in the user’s head, says Gridsure’s CEO, Stephen Howes. Elsewhere, Volker Roth at the Free University of Berlin in Germany has come up with a hybrid approach using four-digit PINs. When entering numbers, users are shown a numerical keypad on which half the keys are coloured white and the other half black, seemingly at random. Instead of pressing these keys, the user is required to press one
Hidden patterns Even if a snooper notes the characters you enter, your pass code need not be compromised Choose a four-brick pattern from the grid of 25 squares
When entering the pass code, the grid is populated with random digits (right). By following the pattern above, someone watching you enter the code – in this case, 2356 – would not gain enough information to decipher your unique pattern
4 1 6 3 9
2 2 1 4 3
9 8 6 4 9
5 8 5 7 1
6 4 8 2 5
6 2 4 1 6 1 4
4 9 1 2 2
9 8 2 8 3 2
ABC
5
GHI
JKL
7
8
8 5 3 5 7
1 4 6 3 9 3
DEF
6
MNO
9
PQRS
TUV
WXYZ
*
0
#
The next time you enter your code, a new grid of numbers is generated. The PIN changes, but the pattern does not
Shh, a roving ‘bugnet’ may be listening in has to compromise your favoured device with a microphone-tapping spyware virus to monitor virtually all of your conversations, transmitting them whenever the device links to the internet (Computers & Security, HUGH WHITAKER/CULTURA/CORBIS
THE notion that a hacker could eavesdrop on you by commandeering your smartphone or your computer’s microphone is not new. But such bugging attempts could soon become far more powerful, even giving attackers the ability to monitor a target’s utterances almost anywhere they go – even if that target is nowhere near any of their own gadgets. As people embrace smartphones and notebook computers, which can remain more-or-less permanently connected to the internet, they have unwittingly ensured that they are never far from a potential electronic eavesdropper, warn Ryan Farley and Xinyuan Wang at George Mason University in Fairfax, Virginia. One side effect of this boom in connectedness is that a hacker only
Is that an innocent phone or a corrupted traitor in your hand?
DOI: 10.1016/j.cose.2009.12.002). But the pair suspect that because hackers have become adept at managing vast networks of compromised computers – called botnets – a new menace may emerge: attackers could extend their audio surveillance to any computer or phone that their target regularly comes into contact with. “It does not have to be under the control of the victim,” says Ryan. Using knowledge of their target’s lifestyle, a combination of social engineering and phishing could be employed to compromise the computers or devices of those they come near to. “That could be a Wi-Fi-connected laptop of a stranger who’s often close to the victim in a coffee shop, or a supposedly idle computer in a conference room the
victim uses frequently,” says Wang. Once such computers have been added to this roving eavesdropping network, dubbed a “bugnet”, they could then be controlled to transmit live audio on demand, such as when the target is expected to be nearby. The researchers wrote software for PC and Mac computers to demonstrate their bugnet concept. One security expert, speaking on condition of anonymity, reckoned the bugnet attack demonstrated is currently too crude to pose a serious threat. “Their infection-point either used an unpatched version of Windows XP, or a tailored installer on Mac OS X,” he says. It is unlikely any worthwhile target will used Windows unpatched, and few Apple Mac users would voluntarily install unknown software, he adds. Paul Marks
16 January 2010 | NewScientist | 17