How the way you tap a phone can give hackers your PIN: Criminals can guess four-digit code by using software to monitor movements

Technology

As you tap away on your mobile, do beware.

You could be giving away your private banking details – simply by the way you use your phone.

Hackers have found a way to extract information from every move we make with our phones, including how we type, tilt or even swipe, experts have found.

They can even use the 25 sensors on many phones to access bank data and emails, Newcastle University researchers discovered.

The hack requires malicious software to be downloaded on to a smartphone. Information from the internal sensors is then collected.

Passwords can be guessed from patterns because we tend to use the same fingers and movements to type them. Most smartphones have accelerometers, which track tiny movements, and rotation sensors, which measure twisting.

They also have gyroscope sensors, which use gravity to track position and tilt of the handset.

Personal fitness devices could theoretically be hacked in the same way, to find out where the user is and what they are doing.

Dr Maryam Mehrnezhad, of Newcastle University, said: ‘Most smartphones, tablets and other wearables are now equipped with a multitude of sensors.

'But because mobile apps and websites don’t need to ask permission to access most of them, malicious programmes can covertly listen in on your sensor data and use it to discover a wide range of sensitive information about you, such as phone call timing, physical activities and even your touch actions, PINs and passwords.’

She added that hackers could spy on any web pages opened on a phone, as long as the page hosting the malicious software was left open on another tab.

Thehack requires malicious software to be downloaded on to a smartphone. Information from the internal sensors is then collected

Hackers can even access data when a phone is locked.

The Newcastle team found that each user creates patterns by clicking, scrolling, holding and tapping. With a known website, they could determine what part of the page the user was clicking on and what they were typing.

The team, who are publishing the findings today in the International Journal of Information Security, warned tech companies including Google and Apple about the problem. Dr Mehrnezhad said no one has yet been able to come up with a solution.

She said phone users could protect themselves by only using apps from approved stores and changing passwords regularly.

Source: dailymail