Malicious software hijacks your phone’s microphone and camera to record your PIN

New software could threaten the security of mobile banking

A research paper from the University of Cambridge has outlined how PIN numbers used on smartphones can be recorded by hijacking the device’s camera and microphones.

The news is especially worrying as the rise of mobile banking means that PIN numbers entered into smartphones are often used to secure more than just the phone’s basic functionality.

The researchers, Laurent Simon and Ross Anderson, used a custom piece of software called PIN Skimmer to grab the PIN numbers. This program hijacks phones’ microphones to detect when you tap the touchscreen and then syncs this with data from the camera to work out where on the screen you pressed.

For example, when right-handed individuals press a button in the top left hand corner of their phone’s screen they often tilt the phone towards their thumb with their supporting fingers. This changes position of the user’s face as recorded by the front-facing camera, giving the program a unique marker that corresponds with a number on screen.

The research was carried out on a pair of Android-powered smartphones, a Nexus S and Galaxy S3, and under test conditions PIN Skimmer was able to work out more than 50 per cent of four digit PIN numbers after five attempts and 60 per cent of eight digit numbers after ten attempts.

One step in the malware’s process even presents users with a game where they have to match pairs of icons that appear onscreen. The program can record data from the camera during the game and then use this as a reference guide, matching how the user appears in the camera to where they’ve touched the screen.

The researchers suggested methods of obstructing the malware, but noted that randomising the order in which numbers appear on an onscreen keypad would “cripple usability” whilst employing longer PIN number would affect “memorability and usability”.

More “drastic” solutions included getting rid of passwords altogether in favour of face recognition or fingerprint scanners, although neither of these methods are yet common.

"If you're developing payment apps [for mobiles], you'd better be aware that these risks exist," Professor Anderson told the BBC.

An illustration of how the position of the phone's camera is changed as users reach for different parts of the keyboard. Image credit: Laurent Simon/Ross Anderson/University of Cambridge  

Sport
England's women celebrate after their 3rd place play-off win against Germany
Women's World CupFara Williams converts penalty to secure victory and bronze medals
Arts and Entertainment
Ricardo by Edward Sutcliffe, 2014
artPortraits of LA cricketers from notorious suburb go on display
News
newsHillary Clinton comments on viral Humans of New York photo of gay teenager
Arts and Entertainment
The gang rape scene in the Royal Opera’s production of Gioachino Rossini’s Guillaume Tell has caused huge controversy
music
Life and Style
ebookNow available in paperback
ebooks
ebookA delicious collection of 50 meaty main courses
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating
and  

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    Recruitment Genius: Support and Development Engineer

    £20000 per annum: Recruitment Genius: The leading provider of Employee Managem...

    Recruitment Genius: Creative Designer

    £15000 - £25000 per annum: Recruitment Genius: This Kent based design consulta...

    Recruitment Genius: IT Gazetteer Consultant

    £25000 - £34000 per annum: Recruitment Genius: Are you looking to work for an ...

    Recruitment Genius: Regional Support Manager

    Negotiable: Recruitment Genius: This role's responsibility also include operat...

    Day In a Page

    The Greek referendum exposes a gaping hole at the heart of the European Union – its distinct lack of any genuine popular legitimacy

    Gaping hole at the heart of the European Union

    Treatment of Greece has shown up a lack of genuine legitimacy
    Number of young homeless in Britain 'more than three times the official figures'

    'Everything changed when I went to the hostel'

    Number of young homeless people in Britain is 'more than three times the official figures'
    Compton Cricket Club

    Compton Cricket Club

    Portraits of LA cricketers from notorious suburb to be displayed in London
    London now the global money-laundering centre for the drug trade, says crime expert

    Wlecome to London, drug money-laundering centre for the world

    'Mexico is its heart and London is its head'
    The Buddhist temple minutes from Centre Court that helps a winner keep on winning

    The Buddhist temple minutes from Centre Court

    It helps a winner keep on winning
    Is this the future of flying: battery-powered planes made of plastic, and without flight decks?

    Is this the future of flying?

    Battery-powered planes made of plastic, and without flight decks
    Isis are barbarians – but the Caliphate is a dream at the heart of all Muslim traditions

    Isis are barbarians

    but the Caliphate is an ancient Muslim ideal
    The Brink's-Mat curse strikes again: three tons of stolen gold that brought only grief

    Curse of Brink's Mat strikes again

    Death of John 'Goldfinger' Palmer the latest killing related to 1983 heist
    Greece debt crisis: 'The ministers talk to us about miracles' – why Greeks are cynical ahead of the bailout referendum

    'The ministers talk to us about miracles'

    Why Greeks are cynical ahead of the bailout referendum
    Call of the wild: How science is learning to decode the way animals communicate

    Call of the wild

    How science is learning to decode the way animals communicate
    Greece debt crisis: What happened to democracy when it’s a case of 'Vote Yes or else'?

    'The economic collapse has happened. What is at risk now is democracy...'

    If it doesn’t work in Europe, how is it supposed to work in India or the Middle East, asks Robert Fisk
    The science of swearing: What lies behind the use of four-letter words?

    The science of swearing

    What lies behind the use of four-letter words?
    The Real Stories of Migrant Britain: Clive fled from Zimbabwe - now it won't have him back

    The Real Stories of Migrant Britain

    Clive fled from Zimbabwe - now it won’t have him back
    Africa on the menu: Three foodie friends want to popularise dishes from the continent

    Africa on the menu

    Three foodie friends want to popularise dishes from the hot new continent
    Donna Karan is stepping down after 30 years - so who will fill the DKNY creator's boots?

    Who will fill Donna Karan's boots?

    The designer is stepping down as Chief Designer of DKNY after 30 years. Alexander Fury looks back at the career of 'America's Chanel'