Hackers can figure out your password simply by looking at how your smartphone moves: report

Here's how

Hackers can crack PINs and passwords just from the way we tilt our phone when we are typing.

A team of researchers from Newcastle University in the UK have published a report which shows that hackers can decipher pins and passwords on a device simply by tracking its movement using on board data collected by the smartphone’s hardware tracking systems and sensors.

Using the method, Cyber researchers at Newcastle University were able to crack four-digit PINs on smartphone with a 70% accuracy on the first guess and 100% by the fifth guess.

"Most smartphones, tablets, and other wearables are now equipped with a multitude of sensors, from the well-known GPS, camera and microphone to instruments such as the gyroscope, proximity, NFC, and rotation sensors and accelerometer,” said Dr Maryam Mehrnezhad, a Research Fellow in the School of Computing Science and lead author on the paper.



"But because mobile apps and websites don't need to ask permission to access most of them, malicious programs can covertly 'listen in' on your sensor data and use it to discover a wide range of sensitive information about you such as phone call timing, physical activities and even your touch actions, PINs and passwords.”

Sensors are now commonplace in smart devices and are largely responsible for the boom in mobile gaming and health and fitness apps where they track movement to give a better user experience.

However on board sensors collect immense amounts of data that can be used by hacker to gain information on almost anything, even when the smartphone is locked.



"More worrying, on some browsers, we found that if you open a page on your phone or tablet which hosts one of these malicious code and then open, for example, your online banking account without closing the previous tab, then they can spy on every personal detail you enter,” explained Dr Mehrnezhad. "And worse still, in some cases, unless you close them down completely, they can even spy on you when your phone is locked.”

The researchers have now alerted big tech companies, including Apple and Google, though no one has been able to come up with an answer, says Dr Mehrnezhad.

"One way would be to deny access to the browser altogether but we don't want to lose all the benefits associated with in-built motion sensors." she added.

The research has helped some browser developers such as Mozilla, Firefox and Apple Safari to partially fix the issue, however the team at Newcastle is now working with the industry to find a proper solution.