According to researchers at the University of Newcastle (UK) published in International Journal of Information Security there are numerous sensors in mobile phones that can be used by malicious apps to track things like PIN codes, with the hackers getting access to this data without needing user permission. The internal sensors can provide information that allows the hacker to guess PIN codes with 70% accuracy after 3 attempts, and with 100% accuracy after that.
Most phone users are unaware of this and also the fact that most phones have over 20 of these sensors. It is a difficult issue to resolve for the major manufacturers. Internet of Things devices are even more reliant on sensors, and there have been many concerns about their security also.
The following is an account of the issue from one of the researchers at the university, Maryam Mehrnezhad.
Most smart phones, tablets, and other wearables are now equipped with a multitude of sensors, from the well-known GPS, camera and microphone to instruments such as the gyroscope, proximity, NFC, and rotation sensors and accelerometer.
But because mobile apps and websites don’t need to ask permission to access most of them, malicious programmes can covertly ‘listen in’ on your sensor data and use it to discover a wide range of sensitive information about you such as phone call timing, physical activities and even your touch actions, PINs and passwords.
More worrying, on some browsers, we found that if you open a page on your phone or tablet which hosts one of these malicious code and then open, for example, your online banking account without closing the previous tab, then they can spy on every personal detail you enter.
And worse still, in some cases, unless you close them down completely, they can even spy on you when your phone is locked.
Despite the very real risks, when we asked people which sensors they were most concerned about we found a direct correlation between perceived risk and understanding. So people were far more concerned about the camera and GPS than they were about the silent sensors.
Access to the phone’s camera is one permission needed by downloaded apps, but many sensors are freely accessed without the need for approval from the user. With the rise of the abilities of smartphones and the interests of users in them becoming used as sensors, there are many security issues to be resolved in the future.
More information can be found at: Newcastle University.