Abstract:One rising trend in today's consumer electronics is the wearable devices, e.g., smartwatches. With tens of millions of smartwatches shipped, however, the security implications of such devices are not fully understood. Although previous studies have pointed out some privacy concerns about the data that can be collected, like personalized health information, the threat is considered low as the leaked data is not highly sensitive and there is no real attack implemented. In this paper we investigate a security problem coming from sensors in smartwatches, especially the accelerometer. The results show that the actual threat is much beyond people's awareness.Being worn on the wrist, the accelerometer built within a smartwatch can track user's hand movements, which makes inferring user inputs on keyboards possible in theory. But several challenges need to be addressed ahead in the real-world settings: e.g., small and irregular hand movements occur persistently during typing, which degrades the tracking accuracy and sometimes even overwhelms useful signals.In this paper, we present a new and practical side-channel attack to infer user inputs on keyboards by exploiting sensors in smartwatch. Novel keystroke inference models are developed to mitigate the negative impacts of tracking noises. We focus on two major categories of keyboards: one is numeric keypad that is generally used to input digits, and the other is QWERTY keyboard on which a user can type English text. Two prototypes have been built to infer users' banking PINs and English text when they type on POS terminal and QWERTY keyboard respectively. Our results show that for numeric keyboard, the probability of finding banking PINs in the top 3 candidates can reach 65%, while for QWERTY keyboard, a significant accuracy improvement is achieved compared to the previous works, especially of the success rate of finding the correct word in the top 10 candidates.

MAGLeak: A Learning-Based Side-Channel Attack for Password Recognition With Multiple Sensors in IIoT Environment

Malicious Code Detection on Smart Meters -A Side-Channel Based Approach

LeakThief: Stealing the Behavior Information of Laptop Via Leakage Current

DeepMag+: Sniffing Mobile Apps in Magnetic Field Through Deep Learning.

MagAttack - Guessing Application Launching and Operation via Smartphone.

Offensive Security of Keyboard Data Using Machine Learning for Password Authentication in IoT

Anomoly Detection for PLC Based on Magnetic Side Channel

Niffler: A Context-Aware and User-Independent Side-Channel Attack System for Password Inference

Adaptive Human-Machine Interactive Behavior Analysis With Wrist-Worn Devices for Password Inference

Deep learning-based authentication for insider threat detection in critical infrastructure

MagAuth: Secure and Usable Two-Factor Authentication with Magnetic Wrist Wearables

On Designing a Lesser Obtrusive Authentication Protocol to Prevent Machine-Learning-Based Threats in Internet of Things

A Neural Attack Model for Cracking Passwords in Adversarial Environments

Combating Password Vulnerability with Keystroke Dynamics Featured by WiFi Sensing

Machine Learning Based Network Vulnerability Analysis of Industrial Internet of Things

Piezoelectric and Machine Learning Based Keystroke Dynamics For Highly Secure User Authentication

Secure User Authentication Leveraging Keystroke Dynamics via Wi-Fi Sensing

Snoopy: Sniffing Your Smartwatch Passwords via Deep Sequence Learning

When Good Becomes Evil: Keystroke Inference With Smartwatch

A Practical Side-Channel Attack of a LoRaWAN Module Using Deep Learning

Wi-Crack: a smartphone keystroke recognition system based on multi-dimensional information