Malicious software hijacks your phone’s microphone and camera to record your PIN

New software could threaten the security of mobile banking

A research paper from the University of Cambridge has outlined how PIN numbers used on smartphones can be recorded by hijacking the device’s camera and microphones.

The news is especially worrying as the rise of mobile banking means that PIN numbers entered into smartphones are often used to secure more than just the phone’s basic functionality.

The researchers, Laurent Simon and Ross Anderson, used a custom piece of software called PIN Skimmer to grab the PIN numbers. This program hijacks phones’ microphones to detect when you tap the touchscreen and then syncs this with data from the camera to work out where on the screen you pressed.

For example, when right-handed individuals press a button in the top left hand corner of their phone’s screen they often tilt the phone towards their thumb with their supporting fingers. This changes position of the user’s face as recorded by the front-facing camera, giving the program a unique marker that corresponds with a number on screen.

The research was carried out on a pair of Android-powered smartphones, a Nexus S and Galaxy S3, and under test conditions PIN Skimmer was able to work out more than 50 per cent of four digit PIN numbers after five attempts and 60 per cent of eight digit numbers after ten attempts.

One step in the malware’s process even presents users with a game where they have to match pairs of icons that appear onscreen. The program can record data from the camera during the game and then use this as a reference guide, matching how the user appears in the camera to where they’ve touched the screen.

The researchers suggested methods of obstructing the malware, but noted that randomising the order in which numbers appear on an onscreen keypad would “cripple usability” whilst employing longer PIN number would affect “memorability and usability”.

More “drastic” solutions included getting rid of passwords altogether in favour of face recognition or fingerprint scanners, although neither of these methods are yet common.

"If you're developing payment apps [for mobiles], you'd better be aware that these risks exist," Professor Anderson told the BBC.

An illustration of how the position of the phone's camera is changed as users reach for different parts of the keyboard. Image credit: Laurent Simon/Ross Anderson/University of Cambridge  

Life and Style
ebookNow available in paperback
ebooks
ebookPart of The Independent’s new eBook series The Great Composers
Arts and Entertainment
Books should be for everyone, says Els, 8. Publisher Scholastic now agrees
booksAn eight-year-old saw a pirate book was ‘for boys’ and took on the publishers
Life and Style
Mary Beard received abuse after speaking positively on 'Question Time' about immigrant workers: 'When people say ridiculous, untrue and hurtful things, then I think you should call them out'
tech
Life and Style
Most mail-order brides are thought to come from Thailand, the Philippines and Romania
life
News
i100
Life and Style
tech
Voices
Margaret Thatcher, with her director of publicity Sir Gordon Reece, who helped her and the Tory Party to victory in 1979
voicesThe subject is being celebrated by the V&A museum, triggering some happy memories for former PR man DJ Taylor
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating
and  

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    Ashdown Group: Head of IT - Hertfordshire - £90,000

    £70000 - £90000 per annum + bonus + car allowance + benefits: Ashdown Group: H...

    Ashdown Group: Application Support Analyst - SQL Server, T-SQL

    £28000 - £32000 per annum + Excellent benefits: Ashdown Group: Application Sup...

    Ashdown Group: Systems Analyst / Data Analyst (SQL Server, T-SQL, data)

    £28000 - £32000 per annum + Excellent benefits: Ashdown Group: Systems Analyst...

    Ashdown Group: European Recruitment Manager - Cheshire - up to £48,000

    £40000 - £48000 per annum + bonus and benefits: Ashdown Group: European Recrui...

    Day In a Page

    General Election 2015: Chuka Umunna on the benefits of immigration, humility – and his leader Ed Miliband

    Chuka Umunna: A virus of racism runs through Ukip

    The shadow business secretary on the benefits of immigration, humility – and his leader Ed Miliband
    Yemen crisis: This exotic war will soon become Europe's problem

    Yemen's exotic war will soon affect Europe

    Terrorism and boatloads of desperate migrants will be the outcome of the Saudi air campaign, says Patrick Cockburn
    Marginal Streets project aims to document voters in the run-up to the General Election

    Marginal Streets project documents voters

    Independent photographers Joseph Fox and Orlando Gili are uploading two portraits of constituents to their website for each day of the campaign
    Game of Thrones: Visit the real-life kingdom of Westeros to see where violent history ends and telly tourism begins

    The real-life kingdom of Westeros

    Is there something a little uncomfortable about Game of Thrones shooting in Northern Ireland?
    How to survive a social-media mauling, by the tough women of Twitter

    How to survive a Twitter mauling

    Mary Beard, Caroline Criado-Perez, Louise Mensch, Bunny La Roche and Courtney Barrasford reveal how to trounce the trolls
    Gallipoli centenary: At dawn, the young remember the young who perished in one of the First World War's bloodiest battles

    At dawn, the young remember the young

    A century ago, soldiers of the Empire – many no more than boys – spilt on to Gallipoli’s beaches. On this 100th Anzac Day, there are personal, poetic tributes to their sacrifice
    Dissent is slowly building against the billions spent on presidential campaigns – even among politicians themselves

    Follow the money as never before

    Dissent is slowly building against the billions spent on presidential campaigns – even among politicians themselves, reports Rupert Cornwell
    Samuel West interview: The actor and director on austerity, unionisation, and not mentioning his famous parents

    Samuel West interview

    The actor and director on austerity, unionisation, and not mentioning his famous parents
    General Election 2015: Imagine if the leading political parties were fashion labels

    Imagine if the leading political parties were fashion labels

    Fashion editor, Alexander Fury, on what the leaders' appearances tell us about them
    Phumzile Mlambo-Ngcuka: Home can be the unsafest place for women

    Phumzile Mlambo-Ngcuka: Home can be the unsafest place for women

    The architect of the HeForShe movement and head of UN Women on the world's failure to combat domestic violence
    Public relations as 'art'? Surely not

    Confessions of a former PR man

    The 'art' of public relations is being celebrated by the V&A museum, triggering some happy memories for DJ Taylor
    Bill Granger recipes: Our chef succumbs to his sugar cravings with super-luxurious sweet treats

    Bill Granger's luxurious sweet treats

    Our chef loves to stop for 30 minutes to catch up on the day's gossip, while nibbling on something sweet
    London Marathon 2015: Paula Radcliffe and the mother of all goodbyes

    The mother of all goodbyes

    Paula Radcliffe's farewell to the London Marathon will be a family affair
    Everton vs Manchester United: Steven Naismith demands 'better' if Toffees are to upset the odds against United

    Steven Naismith: 'We know we must do better'

    The Everton forward explains the reasons behind club's decline this season
    Arsenal vs Chelsea: Praise to Arsene Wenger for having the courage of his convictions

    Michael Calvin's Last Word

    Praise to Wenger for having the courage of his convictions