A password might not be enough to protect a device from hackers. A new study has shown how criminals can use thermal cameras to retrieve passwords typed in by a person on a smartphone, computer keyboard or even at an ATM.
Researchers from the University of Glasgow have shown how heat-detecting cameras can help crack passwords up to a minute after you type them. They published their findings in the journal ACM Transactions on Privacy and Security last month.
In the study, computer scientists developed an artificial intelligence (AI) system called ThermoSecure, which can retrieve recently typed passwords from the warmth of a person’s fingers. The images of the keyboard and screen of the thermal camera can be analyzed by the AI to correctly guess the computer password in seconds.
new research from @glasgocsled by @MKhamisHCI, shows how thermal camera images of keyboards and screens can be analyzed by AI to correctly guess computer passwords in seconds.
read more ️ pic.twitter.com/Olourew3zf
— University of Glasgow (@UofGlasgow) 10 October 2022
Some 86 percent of passwords were cracked when thermal images were taken within 20 seconds of typing in the secret code and put through their ThermoSecure system, and 76 percent when within 30 seconds. Success dropped to 62 percent after 60 seconds of entry.
The scientists also found that within 20 seconds the system was able to successfully attack even 16-character long passwords with a correct attempt rate of up to 67 percent.
As passwords became shorter, the success rate increased. Twelve-symbol passwords were guessed 82 percent of the time, eight-symbol passwords 93 percent of the time and six-symbol passwords were guessed 100 percent of the time.
With thermal imaging cameras costing less than $220 and AI becoming increasingly accessible, researchers warn criminals will take advantage of thermal images to break into computers and smartphones.
“Access to thermal-imaging cameras is more affordable than ever – they can be found for less than £200 ($220) – and machine learning is also becoming increasingly accessible. People around the world are developing systems similar to ThermoSecure to steal passwords,” explains Dr. Mohammad Khamiso who led the study with Nora Alotabi And John Williamson,
thermal attack
A thermal attack can happen when a person types in their password or passcode on their computer keyboard, smartphone screen or after entering their PIN at a cash point.
A thief can then use a thermal camera to take a picture and record the heat signature of where the person has touched the device. In images captured by heat-detecting cameras, areas appear brighter the more recently they were touched.
The hotter the field, the more recently it was touched, allowing criminals to determine the possible sequence in which the keys were used to try different combinations to crack the password.
The researchers found that by measuring the relative intensity of the hot zones, it was possible to determine the specific letters and numbers of the symbols that make up the password, and to guess the order in which they were used.
“It is important that computer security research keeps pace with these developments to find new ways to reduce risk, and we will continue to develop our technology to try to stay one step ahead of attackers,” Khamis explains. Huh.
Dr Khamis says that wherever possible, long passwords should be used, which are more difficult to guess accurately. Meanwhile, the types of material keyboards can affect their ability to absorb heat, with some plastics more likely to retain heat patterns than others.
“Backlit keyboards also generate more heat, making accurate thermal readings more challenging, so a backlit keyboard with PBT plastic may be inherently safer,” he says. “Ultimately, users can help make their devices and keyboards more secure by adopting alternative authentication methods such as fingerprint or facial recognition, which reduce many of the risks of thermal attack.”
image credit: Header Photo licensed through DepositPhotos.
