Here is a new technique that should please hackers. It is possible to guess the password entered on a computer, smartphone and even an ATM. How? By analyzing the residues of heat left by the user’s fingers when entering the password. It works with a keyboard, smartphone screen, and also on the keys of an ATM.
This crazy idea comes from researchers at the University of Glasgow, Scotland. They developed a system called ThermoSecure.
Through this experiment, they sought to show that with thermal cameras, whose prices are falling and artificial intelligence, which is sometimes freely available — a clever hacker can create a system at a low cost to collect the passwords of a device in seconds. They called this threat “thermal attacks”.
The user must have entered the password a little time ago for this to work. It’s strange to unlock a device and then leave it, but that is necessarily the case with an ATM.
The hacker will use a thermal camera to take a picture of the keyboard or screen. In the image, the clearer an area appears, the less time it has been touched. By examining these areas, it is possible to determine the keys, letters or symbols used, as well as their order of entry. It compares the temperatures of the keys pressed to identify the order in which the keys were pressed. It is assumed that the lower the temperature of the key, the earlier it was pressed.
According to the researchers, even a novice who had been told how to decipher the thermal image could manage to find the password. However, the image must have been taken between 30 seconds and one minute after touching the surface.
However, the researchers decided to take it further and use a machine-learning technique to automate password prediction.
They took 1,500 thermal photos of keyboards from different angles to feed the machine. Keyboards that had just been used to type in passwords. With the help of probabilities, they could refine their model and achieve an efficiency of 86% in finding passwords 20 seconds after entering them.
The figure drops to 62% after one minute. We could say that the method isn’t always efficient. The percentage rises to 93% when they do not exceed eight characters. The algorithm consistently strikes the spot with six characters.
This strategy, which still involves being near the target, cannot be used for long with the new security systems that do not require passwords like the Fido protocol and Facial recognition implemented by Apple on its devices. In the future, other devices should also use these techniques for better security.
