Mobile devices record more data than they actually need. The problem is that this recording is not always disclosed to the user. Many applications request excessive permissions, and in the case of browsers, they extract values from the integrated sensors. A group of researchers at the University of Newcastle demonstrated that it is possible to use this maliciously with a new attack called PINLogger, which interprets sensor data and calculates the PIN with an accuracy of 94 percent in just three attempts.
Many Android and iOS games request access to the device's sensors for technical reasons, but I have seen examples that are outright abusive. Why would a game need to see my calendar or contact list? The first thing that comes to mind is that magical word: Advertising. The average user doesn't place much value on the secondary data they generate, but there are people out there willing to pay to get it and provide "a more personalized experience". Now, what if someone finds a way to use such data with malicious intentions? What can our smartphone give away without us noticing?
How PINLogger Works
To begin... the PIN. According to a group of researchers at the University of Newcastle, the JavaScript-based PINLogger attack can listen to the movement and orientation of an Android device without the user's permission, analyze the sensor data flow with a neural network, and from there calculate the PIN. The study indicates that against a four-digit PIN, PINLogger discovers the number 74 percent of the time on the first try, 86 percent on the second, and 94 percent on the third. Unlike other attacks, PINLogger does not require installing software on the smartphone. All it needs is for a browser with the malicious code on a webpage to remain open while the user enters the PIN.
Effectiveness Depends on the Browser and Operating System
Of course, PINLogger's effectiveness depends on the level of sensor access the browser has, and this varies greatly depending on the software and operating system. The examples shared focus on iOS 8 and Android Lollipop, technically unsupported but still widely used. In general, the most invasive browsers are the alternatives, with Baidu and CM Browser at the forefront. For now, JavaScript access is limited to a couple of sensors, but this could change in the future. Maybe it's time to implement sensor access restrictions per application, a whitelist system, or why not, direct manipulation of permissions.
