In the News: Researchers develop sonar technology to steal smartphone passcodes

Image used under CCY 2.0 by Flickr user rizal.affif

Last month, researchers from Lancaster University in England released work detailing a new technique where a smartphone’s built-in speaker and microphone can act as a sonar system to steal the phone’s unlock pattern. Sonar (Sound Navigation and Ranging) uses sound propagation to detect the surrounding objects and their movements [1]. In this case, the development known as SonarSnoop essentially uses soundwaves to track the movement of a user’s finger across their phone screen. SonarSnoop is known as an “acoustic side-channel attack,” wherein the hack does not exploit weaknesses in the smartphone itself, but provides access to the target in an indirect way. In this case, the attack drastically cuts down on the number of attempts and combinations of lock patterns that a hacker requires (by an estimated 70%).

The attack is made possible when a user unknowingly installs a malicious app that allows their phone to emit a sound that is undetectable to the human ear. The sound is reflected off the objects surrounding the phone (such as fingers and the direction of their movement), and reflected back as an echo. This echo is then recorded by the app through the phone’s microphone, ultimately providing the hacker with information that can be easily translated into the lock pattern of the phone. While this technique was tested on Android phones – which infamously use the 3×3 swipe grid – the developers believe it will not be difficult to adapt to Apple products, such as iPhones and iPads [2].

Though the technique may seem overcomplicated for hackers to use with the intention of only gaining entry to an individual’s phone, developers maintain that this research can aid in the design of mobile devices with better security. As recently examined in a previous Digital Tattoo post, significant data beyond just your passcode can be collected from the way you swipe your phone.

What are your thoughts on SonarSnoop? Be sure to leave a comment in the discussion box below.

For more information, check out these articles:

SonarSnoop attack can steal smartphone unlock patterns

SonarSnoop Acoustic Side-Channel Attack Can Steal Touchscreen Interactions

SonarSnoop Framework Can Track Users Touch