Hacking Gesture-Based Security
Interesting research: Abdul Serwadda, Vir V. Phoha, Zibo Wang, Rajesh Kumar, and Diksha Shukla, “Robotic Robbery on the Touch Screen,” ACM Transactions on Information and System Security, May 2016.
Abstract: Despite the tremendous amount of research fronting the use of touch gestures as a mechanism of continuous authentication on smart phones, very little research has been conducted to evaluate how these systems could behave if attacked by sophisticated adversaries. In this article, we present two Lego-driven robotic attacks on touch-based authentication: a population statistics-driven attack and a user-tailored attack. The population statistics-driven attack is based on patterns gleaned from a large population of users, whereas the user-tailored attack is launched based on samples stolen from the victim. Both attacks are launched by a Lego robot that is trained on how to swipe on the touch screen. Using seven verification algorithms and a large dataset of users, we show that the attacks cause the system’s mean false acceptance rate (FAR) to increase by up to fivefold relative to the mean FAR seen under the standard zero-effort impostor attack. The article demonstrates the threat that robots pose to touch-based authentication and provides compelling evidence as to why the zero-effort attack should cease to be used as the benchmark for touch-based authentication systems.
Subscribe to comments on this entry
Clive Robinson • May 12, 2016 8:16 AM
I like this,
we present two Lego-driven robotic attacks on touch-based authentication
That alowes me to put another couple of lego kits “on the security budget” 😉
More importantly you can get the kids to help you and have fun at the same time 🙂
As the saying goes “get them young and you have got them for life”, thus get your kids into Security work and “thinking hinky” before they learn how to gut a rat in the biology lab. After all which is likely to be the more profitable life skill?