Malicious software hijacks your phone’s microphone and camera to record your PIN

New software could threaten the security of mobile banking

A research paper from the University of Cambridge has outlined how PIN numbers used on smartphones can be recorded by hijacking the device’s camera and microphones.

The news is especially worrying as the rise of mobile banking means that PIN numbers entered into smartphones are often used to secure more than just the phone’s basic functionality.

The researchers, Laurent Simon and Ross Anderson, used a custom piece of software called PIN Skimmer to grab the PIN numbers. This program hijacks phones’ microphones to detect when you tap the touchscreen and then syncs this with data from the camera to work out where on the screen you pressed.

For example, when right-handed individuals press a button in the top left hand corner of their phone’s screen they often tilt the phone towards their thumb with their supporting fingers. This changes position of the user’s face as recorded by the front-facing camera, giving the program a unique marker that corresponds with a number on screen.

The research was carried out on a pair of Android-powered smartphones, a Nexus S and Galaxy S3, and under test conditions PIN Skimmer was able to work out more than 50 per cent of four digit PIN numbers after five attempts and 60 per cent of eight digit numbers after ten attempts.

One step in the malware’s process even presents users with a game where they have to match pairs of icons that appear onscreen. The program can record data from the camera during the game and then use this as a reference guide, matching how the user appears in the camera to where they’ve touched the screen.

The researchers suggested methods of obstructing the malware, but noted that randomising the order in which numbers appear on an onscreen keypad would “cripple usability” whilst employing longer PIN number would affect “memorability and usability”.

More “drastic” solutions included getting rid of passwords altogether in favour of face recognition or fingerprint scanners, although neither of these methods are yet common.

"If you're developing payment apps [for mobiles], you'd better be aware that these risks exist," Professor Anderson told the BBC.

An illustration of how the position of the phone's camera is changed as users reach for different parts of the keyboard. Image credit: Laurent Simon/Ross Anderson/University of Cambridge  

Life and Style
ebookNow available in paperback
ebooks
ebookPart of The Independent’s new eBook series The Great Composers
Arts and Entertainment
Buttoned up: Ryan Reynolds with Helen Mirren in ‘Woman in Gold’
filmFor every box-office smash in his Hollywood career, there's always been a misconceived let-down. Now he says it's time for a reboot
News
people
News
Actress Julianne Moore wins the Best Actress in a Leading Role Award for 'Still Alice' during the 87th Annual Academy Awards in Hollywood, California
people
Sport
Ross Barkley
footballPaul Scholes says it's time for the Everton playmaker to step up and seize the England No 10 shirt
News
'We will fix it': mice in the 1970s children’s programme Bagpuss
science
Life and Style
2 Karl Lagerfeld and Choupette
fashion
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating
and  

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    Recruitment Genius: Field Engineer

    £15000 - £18000 per annum: Recruitment Genius: This company has 30 years of ex...

    Recruitment Genius: Customer Account Manager

    £27000 - £33000 per annum: Recruitment Genius: This fast growing cloud based I...

    Recruitment Genius: Front End Web Developer - Magento

    £28000 - £35000 per annum: Recruitment Genius: A Front End Web Developer is re...

    SThree: IT Recruitment Consultant

    £22500 - £30000 per annum + Commission: SThree: Sthree are looking for experie...

    Day In a Page

    War with Isis: Iraq declares victory in the battle for Tikrit - but militants make make ominous advances in neighbouring Syria's capital

    War with Isis

    Iraq declares victory in the battle for Tikrit - but militants make make ominous advances in neighbouring Syria
    Scientists develop mechanical spring-loaded leg brace to improve walking

    A spring in your step?

    Scientists develop mechanical leg brace to help take a load off
    Peter Ackroyd on Alfred Hitchcock: How London shaped the director's art and obsessions

    Peter Ackroyd on Alfred Hitchcock

    Ackroyd has devoted his literary career to chronicling the capital and its characters. He tells John Walsh why he chose the master of suspense as his latest subject
    Ryan Reynolds interview: The actor is branching out with Nazi art-theft drama Woman in Gold

    Ryan Reynolds branches out in Woman in Gold

    For every box-office smash in Ryan Reynolds' Hollywood career, there's always been a misconceived let-down. It's time for a rethink and a reboot, the actor tells James Mottram
    Why Robin Williams safeguarded himself against a morbid trend in advertising

    Stars safeguard against morbid advertising

    As film-makers and advertisers make increasing posthumous use of celebrities' images, some stars are finding new ways of ensuring that they rest in peace
    The UK horticulture industry is facing a skills crisis - but Great Dixter aims to change all that

    UK horticulture industry facing skills crisis

    Great Dixter manor house in East Sussex is encouraging people to work in the industry by offering three scholarships a year to students, as well as generous placements
    Hack Circus aims to turn the rule-abiding approach of TED talks on its head

    Hack Circus: Technology, art and learning

    Hack Circus aims to turn the rule-abiding approach of TED talks on its head. Rhodri Marsden meets mistress of ceremonies Leila Johnston
    Sevenoaks is split over much-delayed decision on controversial grammar school annexe

    Sevenoaks split over grammar school annexe

    If Weald of Kent Grammar School is given the go-ahead for an annexe in leafy Sevenoaks, it will be the first selective state school to open in 50 years
    10 best compact cameras

    A look through the lens: 10 best compact cameras

    If your smartphone won’t quite cut it, it’s time to invest in a new portable gadget
    Paul Scholes column: Ross Barkley played well against Italy but he must build on that. His time to step up and seize that England No 10 shirt is now

    Paul Scholes column

    Ross Barkley played well against Italy but he must build on that. His time to step up and seize that England No 10 shirt is now
    Why Michael Carrick is still proving an enigma for England

    Why Carrick is still proving an enigma for England

    Manchester United's talented midfielder has played international football for almost 14 years yet, frustratingly, has won only 32 caps, says Sam Wallace
    Tracey Neville: The netball coach who is just as busy as her brothers, Gary and Phil

    Tracey Neville is just as busy as her brothers, Gary and Phil

    The former player on how she is finding time to coach both Manchester Thunder in the Superleague and England in this year's World Cup
    General Election 2015: The masterminds behind the scenes

    The masterminds behind the election

    How do you get your party leader to embrace a message and then stick to it? By employing these people
    Machine Gun America: The amusement park where teenagers go to shoot a huge range of automatic weapons

    Machine Gun America

    The amusement park where teenagers go to shoot a huge range of automatic weapons
    The ethics of pet food: Why are we are so selective in how we show animals our love?

    The ethics of pet food

    Why are we are so selective in how we show animals our love?