[论文解读] PatternListener: Cracking Android Pattern Lock Using Acoustic Signals

Man Zhou, Qian Wang+5 more|arXiv (Cornell University)|Sep 10, 2018

Advanced Malware Detection Techniques参考文献 34被引用 44

一句话总结

PatternListener 使用来自受害者设备扬声器和麦克风的隐形声学信号来重构 Android 图案解锁，在五次尝试中对 130 个图案的成功率超过 90%。

ABSTRACT

Pattern lock has been widely used for authentication to protect user privacy on mobile devices (e.g., smartphones and tablets). Given its pervasive usage, the compromise of pattern lock could lead to serious consequences. Several attacks have been constructed to crack the lock. However, these approaches require the attackers to either be physically close to the target device or be able to manipulate the network facilities (e.g., WiFi hotspots) used by the victims. Therefore, the effectiveness of the attacks is significantly impacted by the environment of mobile devices. Also, these attacks are not scalable since they cannot easily infer unlock patterns of a large number of devices. Motivated by an observation that fingertip motions on the screen of a mobile device can be captured by analyzing surrounding acoustic signals on it, we propose PatternListener, a novel acoustic attack that cracks pattern lock by analyzing imperceptible acoustic signals reflected by the fingertip. It leverages speakers and microphones of the victim's device to play imperceptible audio and record the acoustic signals reflected by the fingertip. In particular, it infers each unlock pattern by analyzing individual lines that compose the pattern and are the trajectories of the fingertip. We propose several algorithms to construct signal segments according to the captured signals for each line and infer possible candidates of each individual line according to the signal segments. Finally, we map all line candidates into grid patterns and thereby obtain the candidates of the entire unlock pattern. We implement a PatternListener prototype by using off-the-shelf smartphones and thoroughly evaluate it using 130 unique patterns. The real experimental results demonstrate that PatternListener can successfully exploit over 90% patterns within five attempts.

研究动机与目标

• 通过利用内置扬声器和麦克风演示 Android 图案锁的新型漏洞。
• 开发一种声学攻击（PatternListener），在绘制图案时捕捉指尖运动。
• 设计算法，将指尖轨迹分段、推断并映射到解锁图案。
• 评估攻击在不同设备、绘制速度和图案复杂度下的鲁棒性。

提出的方法

• 从设备扬声器播放不可察觉的音频（18–20 kHz），并用设备麦克风记录反射信号。
• 使用相干检测对基带信号进行解调，并从捕获的音频中去除静态分量。
• 识别转折点，将信号分割成对应图案每一条线的片段。
• 通过基于相位的路径长度变化提取相对指尖移动，并将片段映射到 3×3 网格线。
• 为每对扬声器-麦克风构建一条线候选数据库，并计算相似度以推断实际图案。
• 汇集来自多个扬声器-麦克风对的数据，以提高线条推断和图案重建的准确性。

实验结果

研究问题

• RQ1 受害者设备捕获的板载声学信号是否能揭示 Android 图案锁上绘制的图案？
• RQ2 从反射声学信号中，转折点和图案线段的检测有多可靠？
• RQ3 多传感器（多个扬声器/麦克风）数据融合在重建完整解锁图案方面有多有效？
• RQ4 PatternListener 对绘制速度、图案复杂度和设备尺寸的变化有多鲁棒？

主要发现

• PatternListener 可以在五次尝试内破解超过 90% 的 130 个唯一图案。
• 来自指尖的声学反射产生可区分的 C/O 波形波动，用于分段和推断线条。
• 转折点被用于将图案轨迹分割成独立的线段。
• 基于相位的距离变化提供鲁棒的运动特征，相对于基于频率的指标，对绘制速度的不敏感性更高。
• 使用多个扬声器/麦克风对可提高线条推断的准确性，并在不同设备上实现可扩展的图案破解。