Your smartwatch is giving away your ATM PIN

http://www.eurekalert.org/pub_releases/2016-07/bu-ysi070616.php

Public Release: 6-Jul-2016
Your smartwatch is giving away your ATM PIN
Binghamton University

Wearable devices can give away your passwords, according to new research.

In the paper "Friend or Foe?: Your Wearable Devices Reveal Your Personal PIN" scientists from Binghamton University and the Stevens Institute of Technology combined data from embedded sensors in wearable technologies, such as smartwatches and fitness trackers, along with a computer algorithm to crack private PINs and passwords with 80-percent accuracy on the first try and more than 90-percent accuracy after three tries.

•••••

"Wearable devices can be exploited," said Wang. "Attackers can reproduce the trajectories of the user's hand then recover secret key entries to ATM cash machines, electronic door locks and keypad-controlled enterprise servers."

Researchers conducted 5,000 key-entry tests on three key-based security systems, including an ATM, with 20 adults wearing a variety of technologies over 11 months. The team was able to record millimeter-level information of fine-grained hand movements from accelerometers, gyroscopes and magnetometers inside the wearable technologies regardless of a hand's pose. Those measurements lead to distance and direction estimations between consecutive keystrokes, which the team's "Backward PIN-sequence Inference Algorithm" used to break codes with alarming accuracy without context clues about the keypad.

According to the research team, this is the first technique that reveals personal PINs by exploiting information from wearable devices without the need for contextual information.

•••••