Shoulder surfing (computer security)

In computer security, shoulder surfing is a social engineering technique used to obtain information such as personal identification numbers (PINs), passwords, and other confidential data by looking over the victim's shoulder. Unauthorized users watch the keystrokes inputted on a device or listen to sensitive information being spoken, which is also known as eavesdropping.^[1]

Methods and history

Shoulder surfing can be performed at close range (by directly looking over the victim's shoulder) or at long range with, for example, a pair of binoculars or similar hardware.^[2] Attackers do not need technical skills to perform this method, and keen observation of the victims' surroundings and typing patterns is sufficient. In the early 1980s, shoulder surfing was practiced near public pay phones to steal calling card digits and make long-distance calls or to sell them for lower prices than the original purchaser paid. However, the advent of modern-day technologies like hidden cameras and secret microphones makes shoulder surfing easier and gives the attacker more scope to perform long-range shoulder surfing. A hidden camera allows the attacker to capture the whole login process and other confidential data of the victim, which could ultimately lead to financial loss or identity theft.^[3] Shoulder surfing is more likely to occur in crowded places because it is easier to observe the information without attracting the victim's attention.^[4]

There are two types of shoulder-surfing attacks: direct observation attacks, in which authentication information is obtained by directly monitoring the authentication sequence, and recording attacks, in which the authentication information is obtained by recording the authentication sequence for later analysis to open the device. Apart from threats to password or PIN entry, shoulder surfing also occurs in day-to-day situations to uncover private content on handheld mobile devices. Shoulder surfing visual content was found to leak sensitive information about the user and even private information about third parties.^[5]

Countermeasures

Gaze-based password entry

The basic procedure for gaze-based password entry is similar to regular password entry, except that in place of typing a key or touching the screen, the user looks at each desired character or trigger region in sequence (same as eye typing). The approach can, therefore, be used both with character-based passwords by using an on-screen keyboard and with graphical password schemes as surveyed.^[6] A variety of considerations are important for ensuring usability and security. Eye-tracking technology has progressed significantly since its origins in the early 1900s.^[7] State-of-the-art eye trackers offer non-encumbering, remote video-based eye tracking with 1˚ of visual angle accuracy. Eye trackers are a specialized application of computer vision. A camera is used to monitor the user's eyes. One or more infrared light sources illuminate the user's face and produce a glint – a reflection of the light source on the cornea. As the user looks in different directions, the pupil moves, but the location of the glint on the cornea remains fixed. The relative motion and position of the center of the pupil and the glint are used to estimate the gaze vector, which is then mapped to coordinates on the screen plane.

Researchers have proposed ways to counter shoulder surfing on mobile devices by leveraging the front-facing camera for gaze-based password entry. For example, GazeTouchPIN^[8] and GazeTouchPass^[9] combine gaze input through eye movements to the left/right and touch input by tapping on-screen buttons. These methods are more secure than traditional touch-based input (e.g., PIN and Lock Patterns) because they require shoulder surfers to (1) observe the user's eyes, (2) observe the user's touch input, and (3) combine the observations.

Painting album mechanism

Painting album mechanism is an anti-shoulder surfing mechanism, which has characteristics of both recall and recognition graphical techniques. Rather than using a regular PIN or password involving alphanumeric characters, users select a sequence of colors or pictures to unlock the system. The order of the colors and pictures selected during the sign-in process has to match with the order at registration.^[10] This anti-shoulder surfing security method was developed based on survey results of users' affinity of choices,^[11] and through observation on the way children paint pictures. The resulting mechanism was developed from the survey of user choices, and the outcome created three input schemes named Swipe Scheme, Colour Scheme, and Scot Scheme. Swipe Scheme is implemented in Microsoft Windows 8, and in later versions, it is known as Picture Password; however it has drawn criticism for requiring the user to use a secure enough gesture.^[12]

Input Schemes	Input Methods
Swipe Scheme	Swipe the pictures
Color Scheme	Touch the picture then select the colored boxes
Scot Scheme	Swipe the picture, touch the pictures and select the colored boxes, all at the same time

Secret tap method

For access to sensitive information with a low risk of shoulder surfing, the secret tap method is a technique that does not expose the authentication information during entry, even if other individuals try to view the input process. Additionally, the risk of camera recordings also poses a threat. Therefore, it is necessary to make the authentication process more complex in order to prevent authentication information from being stolen. For example, smartphones use biometrics such as fingerprint scanning or facial recognition which cannot be replicated by a shoulder surfer.

The secret tap authentication method can use icons or some other form of system. The goals of a secret tap system are:

• Covert observation resistance: Maintain the resistance strength at a level that prevents the authentication information from being revealed to other individuals, even if the authentication operation is performed numerous times.
• Recording attack resistance: Maintain the resistance strength at a level that prevents the authentication information from being analyzed by other individuals even if the authentication operation is fully recorded.
• Brute-force attack resistance: Maintain the resistance strength at a level that prevents the authentication process from being broken more easily than by a brute-force attack on a four-digit PIN. This policy follows the standard put forth in ISO 9564-1.^[6]
• Usability: Maintain a level of usability that permits operators to perform the authentication operation with ease.

Comparison of risks between alphanumeric and graphical passwords

The primary benefit of graphical passwords compared to alphanumeric passwords is improved memorability. However, the potential detriment of this advantage is the increased risk of shoulder-surfing. Graphical passwords that use graphics or pictures^[13] such as PassFaces, Jiminy,^[14] VIP, Passpoints^[13] or a combination of graphics and audio such as AVAP are likely all subject to this increased risk unless somehow mitigated in implementation. The results indicate the fact that both alphanumeric and graphical password-based authentication mechanisms may have a significant vulnerability to shoulder-surfing unless certain precautions are taken. Despite the common belief that nondictionary passwords are the most secure type of password-based authentication, the results demonstrate that it is, in fact, the most vulnerable configuration to shoulder-surfing.

PIN entry

Personal identification number (or PIN for short) is used to authenticate oneself in various situations, while withdrawing or depositing money from an automatic teller machine, unlocking a phone, a door, a laptop or a PDA. Though this method of authentication is a two step verification process in some situations, it is vulnerable to shoulder surfing attacks. An attacker can obtain the PIN either by directly looking over the victim's shoulder or by recording the whole login process. On items such as mobile phones with glass, glossy screens, the user could leave smudges on the screen, revealing a PIN.^[15] Some highly advanced attacks use thermal cameras to see the thermal signature of the PIN entered.^[16] Thermal attacks take advantage of heat fingerprints remaining on keys after the authenticating person is done entering the secret.^[17] So, various shoulder surfing resistant PIN entry methodologies are used to make the authentication process secure.^[18] Examples include PIN pads with built-in privacy shields. Another example used in ATMs and some entry systems is that of the use of metal PIN pads, making thermal camera attacks nearly impossible due to their material,^[19] shielding, reflectivity or internal heating.^[17] The transfer of heat through wiping with warm objects or hands is found effective to counter thermal attacks in experiments.^[17]

Countermeasure testing

The cognitive trapdoor game has three groups involved in it: a machine verifier, a human prover, and a human observer. The goal of each group is that a human prover has to input the PIN by answering the questions posed by the machine verifier while an observer attempts to shoulder surf the PIN. As the countermeasures are by design harder to easily usurp, it is not easy for the observer to remember the whole login process unless the observer has a recording device.^[20]

Virtual reality

A user could wear a virtual reality headset to mitigate the issues of shoulder surfing; however, gesture controls, buttons pressed, and voice commands could still be attacked.^[21]

See also

• Credit card fraud
• Information diving
• Phishing
• Social engineering (security)