4-digit PIN Research Articles

PIN Inference Attack: A Threat to Mobile Security and Smartphone-Controlled Robots

The proliferation of smartphones equipped with various sensors created a large user base, which includes robots (smartphone controlled) as well. The high processor enabled smartphones are used as software robots to track hour-to-hour activities of users using on-board motion sensors. The magnetometer, accelerometer, and gyroscope are non-permission based motion sensors. The logs of these sensors create discriminative patterns to identify users’ movements. This leverages an adversary to cause privacy threats using these non-permission based sensors without user consent. Recent works also highlighted the privacy threats due to the motion sensors in smartphones. Therefore, in this paper, we present a potential misuse of technology where smartphones can be hacked by PIN Inference attack endangering the mobile security. Once the smartphone is compromised, it may lead to various repercussions. We discuss one such case where after PIN is inferred the adversary incorrectly uses our robot made for corridor detection. With this example, we show the severity of the PIN-Inference attack as nowadays many user activities are governed by robots. We perform experiments to collect motion sensors’ data and infer 4-digit PIN of a smartphone. Our strategy is to detect every key pressed one by one constituting a 4-digit PIN. Our inference results are promising and prove that an adversary can make use of sensors’ data to infiltrate user’s sensitive information from smartphones. Our proposed model infers 84% of the PINs correctly within 40 attempts when tested on 50 PINs. Given real Android devices with different users, we can identify the PIN of smartphones by training our machine learning based model. We also compare our approach with existing state-of-the-art approaches to show the efficacy of our attack model.

Enforcement of Highly Secured Dynamic ATM Pin Entry

The proposes system carries implementing some real-time modifications to the existing systems. It implies with providing an additional special character along with the 4-digit pin rather than the conventional ATM pin. The special character ensures the implementation of a special mathematical algorithm which creates a dynamic security pin during each transaction, making each transaction highly secure. While the transaction is initiated, a set of special characters is displayed in the ATM screen. The display carries our special character (provided with our security pin) along with number of special characters. The count of the special character is to be noted and added along with the provided 4-digit security pin and entered. The importance of this algorithm is the count of the special character is varied dynamically during every transaction. It creates a new security pin during every transaction. The security pin entered during a transaction is stored in the bank server safely. It adds up a safety feature that, if somebody illicitly captures our security pin and illicitly try to enter it, it blocks the ATM and intimates the user. To help the blind person to access the ATM centres, a technique implemented for facial recognition and the transactions carryout securely. The facial recognition helps to initiate the transaction, following it the ATM provides voice command to help them to carry out the transactions with the braille keyboard.

Strengthen user authentication on mobile devices by using user\u2019s touch dynamics pattern

Mobile devices, particularly the touch screen mobile devices, are increasingly used to store and access private and sensitive data or services, and this has led to an increased demand for more secure and usable security services, one of which is user authentication. Currently, mobile device authentication services mainly use a knowledge-based method, e.g. a PIN-based authentication method, and, in some cases, a fingerprint-based authentication method is also supported. The knowledge-based method is vulnerable to impersonation attacks, while the fingerprint-based method can be unreliable sometimes. To overcome these limitations and to make the authentication service more secure and reliable for touch screen mobile device users, we have investigated the use of touch dynamics biometrics as a mobile device authentication solution by designing, implementing and evaluating a touch dynamics authentication method. This paper describes the design, implementation, and evaluation of this method, the acquisition of raw touch dynamics data, the use of the raw data to obtain touch dynamics features, and the training of the features to build an authentication model for user identity verification. The evaluation results show that by integrating the touch dynamics authentication method into the PIN-based authentication method, the protection levels against impersonation attacks is greatly enhanced. For example, if a PIN is compromised, the success rate of an impersonation attempt is drastically reduced from 100% (if only a 4-digit PIN is used) to 9.9% (if both the PIN and the touch dynamics are used).

CMAPS: A Chess-Based Multi-Facet Password Scheme for Mobile Devices

It has long been recognized, by both security researchers and human–computer interaction researchers, that no silver bullet for authentication exists to achieve security , usability , and memorability . Aiming to achieve the goals, we propose a Multi-fAcet Password Scheme (MAPS) for mobile authentication. MAPS fuses information from multiple facets to form a password, allowing MAPS to enlarge the password space and improve memorability by reducing memory interference, which impairs memory performance according to psychology interference theory. The information fusion in MAPS can increase usability, as fewer input gestures are required for passwords of the same security strength. Based on the idea of MAPS, we implement a Chess-based MAPS (CMAPS) for Android systems. Only two and six gestures are required for CMAPS to generate passwords with better security strength than 4-digit PINs and 8-character alphanumeric passwords, respectively. Our user studies show that CMAPS can achieve high recall rates while exceeding the security strength of standard 8-character alphanumeric passwords used for secure applications.

Towards the Use of Brain–Computer Interface and Gestural Technologies as a Potential Alternative to PIN Authentication

ABSTRACTThis article describes an exploratory study which examined the use of Brain–Computer Interface (BCI) and gestural technologies generated from a BCI headset as a novel potential alternative to a 4-digit PIN code for authentication. Unlike other input modalities, many of these tokens (i.e., “push,” “lift,” “excitement”), can overcome some of the security vulnerabilities associated with PIN authentication (e.g., observations from third parties). Participants engaged in a controlled study where they performed five, 4-token authentication tasks on a simulated authentication screen. The percentage of completed BCI and gestural input tasks, as well as input time and accuracy, was compared to the 4-digit PIN task. The results showed that while authentication using a BCI headset is currently not as complete, fast, or accurate as that of a 4-digit PIN code, users felt that such a system would represent greater security over PIN-based authentication. In addition, mental commands, which might be perceived as the most secure from the standpoint of inconspicuous detection, were found to offer disappointing results both in terms of completion percentage and completion time.

Stealing PINs via mobile sensors: actual risk versus user perception

In this paper, we present the actual risks of stealing user PINs by using mobile sensors versus the perceived risks by users. First, we propose PINlogger.js which is a JavaScript-based side channel attack revealing user PINs on an Android mobile phone. In this attack, once the user visits a website controlled by an attacker, the JavaScript code embedded in the web page starts listening to the motion and orientation sensor streams without needing any permission from the user. By analysing these streams, it infers the user’s PIN using an artificial neural network. Based on a test set of fifty 4-digit PINs, PINlogger.js is able to correctly identify PINs in the first attempt with a success rate of 74% which increases to 86 and 94% in the second and third attempts, respectively. The high success rates of stealing user PINs on mobile devices via JavaScript indicate a serious threat to user security. With the technical understanding of the information leakage caused by mobile phone sensors, we then study users’ perception of the risks associated with these sensors. We design user studies to measure the general familiarity with different sensors and their functionality, and to investigate how concerned users are about their PIN being discovered by an app that has access to all these sensors. Our studies show that there is significant disparity between the actual and perceived levels of threat with regard to the compromise of the user PIN. We confirm our results by interviewing our participants using two different approaches, within-subject and between-subject, and compare the results. We discuss how this observation, along with other factors, renders many academic and industry solutions ineffective in preventing such side channel attacks.

Smart ATM Access and Security System using RFID and GSM Technology

The aim of this paper is to implement smart ATM card. Now-a-days we use ATM card frequently for shopping , cash withdrawal etc..A single user may have different bank accounts, so the user obviously have many ATM cards .For user friendly access , instead of many ATM cards we compact all into a single ATM card with enhanced security by providing OTP. We also avoid the problem of skimming. The enhanced security of money transaction in ATM system is carried out by RFID. After getting entry customer has to place ATM smart card in ATM machine. Then ATM machine will automatically generates a 4-digit code i.e. OTP. And that code will be message to the customer’s registered mobile number through GSM modem which is connected to ARM 7. Here customer has to enter this code. After entering OTP, System will check whether entered code is a valid one or not. And if it is valid, a list of bank displays, select a bank and it will ask for 4-digit ATM pin, which is fixed. If that 4-digit code match with the entered pin code then system is allowed for further accessing. ATM will show options like cash withdrawal, cash deposit etc..

Decoupling data-at-rest encryption and smartphone locking with wearable devices

Smartphones store sensitive and confidential data, e.g., business related documents or emails. If a smartphone is stolen, such data are at risk of disclosure. To mitigate this risk, modern smartphones allow users to enable data encryption, which uses a locking password to protect the data encryption key. Unfortunately, users either do not lock their devices at all, due to usability issues, or use weak and easy to guess 4-digit PINs. This makes the current approach of protecting confidential data-at-rest ineffective against password guessing attackers. To address this problem we design, implement and evaluate the Sidekick system — a system that uses a wearable device to decouple data encryption and smartphone locking. Evaluation of the Sidekick system revealed that the proposal can run on an 8-bit System-on-Chip, uses only 4 Kb/20 Kb of RAM/ROM, allows data encryption key fetching in less than two seconds, while lasting for more than a year on a single coin-cell battery.

Spyware Resistant Smartphone User Authentication Scheme

As smart phones are becoming widely used, a variety of services to store and use important information such as photos and financial information are now provided. User authentication to protect this information is increasingly important. The commonly used 4-digit PIN, however, is vulnerable to the Brute Force Attack, Shoulder-Surfing Attack, and Recording Attack. Various authentication techniques are being developed in order to solve these problems. However, the technique that provides perfect protection, even from the Recording Attack, is not yet known, and in most cases, a password can be exposed by multiple Recording Attacks. This paper proposes a new user authentication method that protects against a Recording Attack from spyware on the user's smart phone. The proposed method prevents password exposure by multiple Recording Attacks, is implemented on a real Android phone, and has been evaluated for usability.

Cheap and Easy PIN Entering Using Eye Gaze

PINs are one of the most popular methods to perform simple and fast user authentication.PIN stands for Personal Identification Number, which may have any number of digits or even letters.Nevertheless, 4-digit PIN is the most common and is used for instance in ATMs or cellular phones.The main advantage of the PIN is that it is easy to remember and fast to enter. There are, however,some drawbacks. One of them - addressed in this paper - is a possibility to steal PIN by a techniquecalled `shoulder surfing'. To avoid such problems a novel method of the PIN entering was proposed.Instead of using a numerical keyboard, the PIN may be entered by eye gazes, which is a hands-free,easy and robust technique.

Usability evaluation of randomized keypad

In this work, the usability of a randomized numeric keypad was examined and compared to the usability of a conventional numeric keypad. The comparison used completion time measurements and the error rate of short (4-digit) and long (8-digit) PINs to contrast efficiency and accuracy of the keypads. The results showed that the average completion time with a randomized keypad is longer than with a conventional keypad. Additionally, the number of errors with a randomized keypad was significantly higher than with a conventional keypad, particularly when using long PINs. Accordingly, a randomized numeric keypad is more applicable to tasks with short (4-digit) PINs.