![]() ![]() Further, tapping on a phone screen produces a sound that can be recorded on each of a phone’s multiple microphones. When a user taps on the screen in different locations, the phone itself rotates slightly in ways that can be measured by the three-axis micromechanical gyroscopes found in most current phones. Rather, we combined information from the phone’s gyroscope and its microphones. ![]() In one recent project, we developed an app that could determine what letters a user was typing on a mobile phone’s on-screen keyboard-without reading inputs from the keyboard. And by combining readings from two or more devices, it’s often possible to do things that users, phone designers and app creators alike may not expect. They are stuffed with sensors, usually including at least one accelerometer, a gyroscope, a magnetometer, a barometer, up to four microphones, one or two cameras, a thermometer, a pedometer, a light sensor and a humidity sensor.Īpps can access most of these sensors without asking for permission from the user. Mobile devices are perfect targets for this sort of attack from an unexpected direction. They enable malicious applications to snoop on other applications’ data in the computer memory. The recent Meltdown and Spectre vulnerabilities that exploit design flaws in computer processors, are also side-channel attacks. ![]() There have been many other attacks through the years using all sorts of different approaches. The cryptosystem designers hadn’t imagined that an attacker would take that approach, so their system was vulnerable to it. One of the first side-channel attacks was identified back in 1996 by cryptographer Paul Kocher, who showed he could break popular and supposedly secure cryptosystems by carefully timing how long it took a computer to decrypt an encrypted message. Similarly, people designing software and hardware make assumptions about what hackers might do. It’s just not cost-effective to engineer defenses against those threats, because they’re assumed to be extremely uncommon. They’re not designed to keep people safe in cars driven off a cliff or smashed by huge rocks dropped on them. Cars, for instance, are designed to protect their occupants from crashes with other cars, buildings, guardrails, telephone poles and other objects commonly found in or near roads. When designing protection for a device or a system, people make assumptions about what threats will occur. We have revealed how a phone can listen in on a user’s finger-typing to discover a secret password-and how simply carrying a phone in your pocket can tell data companies where you are and where you’re going. But the research I conduct with my colleagues Sashank Narain, Triet Vo-Huu, Ken Block and Amirali Sanatinia at Northeastern University, in a field called “ side-channel attacks,” uncovers ways that apps can avoid or escape those restrictions. Most people expect that turning their phone’s location services off disables this sort of mobile surveillance. Apps on the phone can use those sensors to perform tasks users aren’t expecting-like following a user’s movements turn by turn along city streets. The vulnerability comes from the wide range of sensors phones are equipped with-not just GPS and communications interfaces, but gyroscopes and accelerometers that can tell whether a phone is being held upright or on its side and can measure other movements too. My group’s recent research has shown how mobile phones can also track their users through stores and cities and around the world-even when users turn off their phones’ location-tracking services. But this threat is not limited to Fitbits and similar devices. military officials were recently caught off guard by revelations that servicemembers’ digital fitness trackers were storing the locations of their workouts-including at or near military bases and clandestine sites around the world. The following essay is reprinted with permission from The Conversation, an online publication covering the latest research. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |