Mimicker: Shoulder surfing and offline training attacks on touch input-based implicit authentication schemes

Hassan Khan, Urs Hengartner, and Daniel Vogel

Abstract: Touch input implicit authentication (``touch IA'') employs behavioural biometrics like touch location and pressure to continuously and transparently authenticate smartphone users. We provide the first ever evaluation of targeted mimicry attacks on touch IA and show that it fails against shoulder surfing and offline training attacks. Based on experiments with three diverse touch IA schemes and 256 unique attacker-victim pairs, we show that shoulder surfing attacks have a bypass success rate of 84% with the majority of successful attackers observing the victim's behaviour for less than two minutes. Therefore, the accepted assumption that shoulder surfing attacks on touch IA are infeasible due to the hidden nature of some features is incorrect. For offline training attacks, we created an open-source training app for attackers to train on their victims' touch data. With this training, attackers achieved bypass success rates of 86%, even with only partial knowledge of the underlying features used by the IA scheme. Previous work failed to find these severe vulnerabilities due to its focus on random, non-targeted attacks. Our work demonstrates the importance of considering targeted mimicry attacks to evaluate the security of an implicit authentication scheme. Based on our results, we conclude that touch IA is unsuitable from a security standpoint.

Hassan Khan, Urs Hengartner, and Daniel Vogel. Targeted Mimicry Attacks on Touch Input Based Implicit Authentication Schemes. Proc. of 14th International Conference on Mobile Systems, Applications and Services (MobiSys 2016), Singapore, June 2016, pp. 387-398.

We provide Android apps (and accompanying source code) to demonstrate the vulnerability of three touch input based implicit authentication schemes (Touchalytics, Li et al., and SilentSense) to shoulder surfing and offline training attacks. These apps have been developed and tested on LG Nexus 5 devices. Since these apps use raw touch data collected on LG Nexus 5 devices, they will not work on devices with different screen sizes. For more details, please contact Hassan Khan.

Data collection

An app has been provided that collects raw touch data of a victim. It provides a browser and an image viewer interface. The collected data is saved in the root folder of the Android device which can be used to train the attackers for offline training attacks.
  • Data Collector app (apk, source)
  • Training apps

    The training apps provide an interface to learn and mimic the victim's behaviour. Training models from 32 victims are provided which have been collected on an LG Nexus 5 device.
  • Touchalytics (apk, source)
  • LXG (apk, source)
  • SilentSense (apk, source)
  • Attack apps

    The attack apps provide an interface along with simple tasks to test the attacks.
  • Touchalytics (apk, source)
  • LXG (apk, source)
  • SilentSense (apk, source)

  • Instructions

    Shoulder surfing attacks

    Shoulder surfing videos for a subset of victims have been made available at:

  • Victim01-UpSwipe-TopView
  • Victim01-UpSwipe-SideView
  • Victim01-LeftSwipe-TopView
  • Victim01-LeftSwipe-SideView

  • Victim04-UpSwipe-TopView
  • Victim04-UpSwipe-SideView
  • Victim04-LeftSwipe-TopView
  • Victim04-LeftSwipe-SideView

  • Victim06-UpSwipe-TopView
  • Victim06-UpSwipe-SideView
  • Victim06-LeftSwipe-TopView
  • Victim06-LeftSwipe-SideView

  • Victim08-UpSwipe-TopView
  • Victim08-UpSwipe-SideView
  • Victim08-LeftSwipe-TopView
  • Victim08-LeftSwipe-SideView

  • After watching the shoulder surfing videos, please launch the Attack app and select the appropriate victim from the drop down list to begin the attack.

    Offline Training Attacks

    After training using a training app for a particular IA scheme, download the attack app for that scheme and select the victim from the drop-down list to test your mimicry skills.