The ideal data that cybercriminals target to compromise mobile devices is user personal identification numbers (PINs). While it’s tempting to consider these PINs secure — especially if they’re regularly changed and don’t occupy the “1111” or “1234” space — researchers from the Nanyang Technological University (NTU) in Singapore have discovered a shortfall in mobile application security: sensor data. Now it’s possible for what devices see, hear and feel to help cybercriminals gain total device access.
Listening In
As noted by Bleeping Computer, most modern mobile operating systems, including iOS and Android, don’t ask for user permission to collect sensor data. The result? Newly installed apps can easily access accelerometer, gyroscope, magnetometer, proximity sensor, barometer and ambient light data. Seems like a hodgepodge of useless information, right? Not quite.
Researchers created a custom Android app that included a sensor data-gathering algorithm. Once installed on test devices, the application gathered device tilt and ambient light data captured when users entered their PINs. Using that data, the algorithm then attempted to predict device PINs from a list of the 50 most common. The result was 99.5 percent accuracy on the first try. However, when using the list of all 10,000 possible four-digit PINs, success dropped to 83.7 percent over 20 tries.
This still marks a significant mobile application security risk. Using a combination of deep learning and agile methodology, the algorithm was able to assign specific weights to sensor data and improve accuracy over time by learning how different users enter their PINs.
PIN Pushback
As noted by the NTU research, current mobile application security makes it possible for attackers to leverage side-channel methods that subvert even strong device security. So how can users stay safe? Start with longer PINs, which increases the amount of data needed by the algorithm to successfully guess user passcodes. Dr. Shivam Bhasin of NTU suggested that, in addition to extra-long PINs, users should also leverage other security methods including two-factor authentication or biometric scans that can’t be subverted by sensor data collection.
Enhancing Mobile Application Security
Ideally, mobile device operating systems will begin regulating sensor permissions, either disabling access by default or giving users the ability to allow or block access on-demand. Given current the current security climate, however — such as the burgeoning Internet of Things (IoT) market, which values speed over security — users shouldn’t expect significant security changes in the near future.
The more likely scenario is grudging device-maker acknowledgment that sensor data could be an issue, coupled with dismissal of the test-app scenario as a viable real-world vector. But as evolving malware and network attacks demonstrate, cybercriminals often enjoy marked success by leveraging supposedly low-risk threat vectors such as air-gapped devices or SCADA systems. As a result, mobile sensor data could quickly roll up the attacker priority list.
Bottom line? Mobile application security has a blind spot. While per-app sensor control isn’t available (yet), users can reduce their risk with longer PINs and two-factor authentication.