UltraPIN: Inferring PIN entries via ultrasound

• Main Authors: LIU, Ximing, DENG, Robert H.
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2021
• Subjects: acoustic attack; authentication; doppler effect; PIN; Computer and Systems Architecture; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/6453; https://ink.library.smu.edu.sg/context/sis_research/article/7456/viewcontent/UltraPIN_Inferring_PIN_entries_via_ultrasound.pdf
• Institution: Singapore Management University

While PIN-based user authentication systems such as ATM have long been considered to be secure enough, they are facing new attacks, named UltraPIN, which can be launched from commodity smartphones. As a target user enters a PIN on a PIN-based user authentication system, an attacker may use UltraPIN to infer the PIN from a short distance (50 cm to 100 cm). In this process, UltraPIN leverages smartphone speakers to issue human-inaudible ultrasound signals and uses smartphone microphones to keep recording acoustic signals. It applies a series of signal processing techniques to extract high-quality feature vectors from low-energy and high-noise signals and then applies a combination of machine learning models to classify finger movement patterns during PIN entry and generate a ranked list of highly possible PINs as result. Rigorous experiments show that UltraPIN is highly effective and robust in PIN inference