Hassan Khan, Urs Hengartner, and Daniel Vogel
Abstract: Touch input implicit authentication (``touch IA'') employs behavioural biometrics like touch location and pressure to continuously and transparently authenticate smartphone users. We provide the first ever evaluation of targeted mimicry attacks on touch IA and show that it fails against shoulder surfing and offline training attacks. Based on experiments with three diverse touch IA schemes and 256 unique attacker-victim pairs, we show that shoulder surfing attacks have a bypass success rate of 84% with the majority of successful attackers observing the victim's behaviour for less than two minutes. Therefore, the accepted assumption that shoulder surfing attacks on touch IA are infeasible due to the hidden nature of some features is incorrect. For offline training attacks, we created an open-source training app for attackers to train on their victims' touch data. With this training, attackers achieved bypass success rates of 86%, even with only partial knowledge of the underlying features used by the IA scheme. Previous work failed to find these severe vulnerabilities due to its focus on random, non-targeted attacks. Our work demonstrates the importance of considering targeted mimicry attacks to evaluate the security of an implicit authentication scheme. Based on our results, we conclude that touch IA is unsuitable from a security standpoint.
Hassan Khan, Urs Hengartner, and Daniel Vogel. Targeted Mimicry Attacks on Touch Input Based Implicit Authentication Schemes. Proc. of 14th International Conference on Mobile Systems, Applications and Services (MobiSys 2016), Singapore, June 2016, pp. 387-398.
We provide Android apps (and accompanying source code) to demonstrate the vulnerability of three touch input based implicit authentication schemes (Touchalytics, Li et al., and SilentSense) to shoulder surfing and offline training attacks. These apps have been developed and tested on LG Nexus 5 devices. Since these apps use raw touch data collected on LG Nexus 5 devices, they will not work on devices with different screen sizes. For more details, please contact Hassan Khan.
Data collection
An app has been provided that collects raw touch data of a victim. It provides a browser and an image viewer interface. The collected data is saved in the root folder of the Android device which can be used to train the attackers for offline training attacks.Training apps
The training apps provide an interface to learn and mimic the victim's behaviour. Training models from 32 victims are provided which have been collected on an LG Nexus 5 device.Attack apps
The attack apps provide an interface along with simple tasks to test the attacks.Instructions
Shoulder surfing attacks
Shoulder surfing videos for a subset of victims have been made available at:After watching the shoulder surfing videos, please launch the Attack app and select the appropriate victim from the drop down list to begin the attack.
