Inferring Your Mobile Phone Password via WiFi Signals (opens in new tab)

Couldn't this work against any wifi? Impersonating a public access point gives you some extra unencrypted information so you know the server IP and can more easily infer when a password is being entered, the same things you conceal by using a VPN over public wifi.

But what stops a passive wifi observer who can guess those things or already knows them?

Anybody who plays Runescape will recognize this. They have a pin you can set to gain access to your in game bank. It has a fair few security features to combat keyloggers which were (and still can be) a major issue.

Some security features I can recall.

Random layout of the numbers on both the button itself and which button has which number. This is shuffled on every click.

Upon clicking all numbers and the mouse pointer vanish. This prevents screenshots taken on clicks by some keyloggers from working.

No keyboard input. Annoying but needed to combat keyloggers.

http://vignette2.wikia.nocookie.net/2007scape/images/c/c3/Ba...

My bank did that with a JavaScript number pad. They went back to a standard password field with the new design of the site a couple of years ago. That made me feel less safe because I understood why the were complicating the input.

Another strategy I've seen is to ask some random digits of a longer PIN, with a mask to fill out.

I've seen some secure financial sites that already do that.

Convenient option on Cyanogenmod. Been using it for about 2 years and it's surprisingly easy to get used-to.

Touch typing on a flat, featureless surface? Best of luck with that. I tried, and tended to drift off-center within a few tens of keystrokes. The F and J nubs on physical keyboard are there for Good Reasons - but even without, feeling where exactly you are striking the key (center or corner) gives you feedback to reposition. Touchscreen gives you nothing.

That is a large cost to pay.

As far as I understood, this attack vector has nothing to do with using public wifi.

If you want to be really secure, just never use the internet.

Here is the ACM link: http://dl.acm.org/citation.cfm?id=2978397

I clearly did not read into this enough as it is more impressive than I had remembered. It's quite the eye-opener on how much unique data there is out in the wild...

Ok I think my issue with this is that its akin to saying: Given the same users, in the same position, with the same hardware, performing the same gestures, we discovered the signals are consistent enough that a NNet can figure out a pattern. However, if the users, the hardware, the wifi router, the positions, the orientations, the conditions, or the gestures used change, you would need to retrain your NNet for that situation.

After working on a couple of "ambitious" projects that tried to use wifi or bluetooth signals to mine data, it turns out its not super reliable in real-world situations.

Real moral of the story: Read the article before commenting.

Yes, I think a passive listener in promiscuous mode would work. And more listeners located around the room would be even better, if their signals could be very precisely correlated in time.

In more detail: CSI is available to the _receiver_ of the wifi packet. In other words:

• Your phone can determine CSI for all AP broadcasts. (Useful for indoor positioning)

• The AP can determine CSI for any packet sent to it. Thus your phone would have to be associated. (Or, at least trying to associate.)

• A passive listener in promiscuous mode should still work -- maybe -- though I couldn't say for certain. The CSI value would not be identical to what the AP receives since the listener is in a different physical location and is not synchronized to the AP. The CSI data is In-phase and Quadrature values which can only be interpreted in relation to the clock that is being used to sample the radio signal. But maybe this approach manages to get around clock sync issues somehow.

• If your finger locations change without any wifi packet transmission, there is no way to detect that.

I'd say the best mitigation is to turn off wifi while typing your password. Then turn it on just before hitting "Submit" or "Enter" or whatever.

So then its probably a pretty good idea to randomize the number keypad for the lock screen, which I do. Does this defeat that, I can't think of a way it does..

I think that wifi devices only send a sounding packet when requested from the AP. You need to know you are capturing a sounding packet to determine CSI (or have it send explicitly by the receiver aka explicit beamforming).