Smartwatches, fitness trackers can give away your ATM PIN

The findings are an early step in understanding security vulnerabilities of wearable devices

Wearable devices can give away your passwords, say scientists who, for the first time, used data from sensors in smartwatches and fitness trackers to crack private PINs with upto 90 per cent accuracy.

The researchers from Binghamton University and the Stevens Institute of Technology in the US using a computer algorithm could crack passwords with 80 per cent accuracy on the first try and more than 90 per cent accuracy after three tries.

"Wearable devices can be exploited. Attackers can reproduce the trajectories of the user's hand then recover secret key entries to ATM cash machines, electronic door locks and keypad-controlled enterprise servers," said Yan Wang, assistant professor at Binghamton University in the US.

Researchers conducted 5,000 key-entry tests on three key-based security systems, including an ATM, with 20 adults wearing a variety of technologies over 11 months.

The team was able to record millimetre-level information of fine-grained hand movements from accelerometers, gyroscopes and magnetometers inside the wearable technologies regardless of a hand's pose.

Those measurements lead to distance and direction estimations between consecutive keystrokes, which the team's "Backward PIN-sequence Inference Algorithm" used to break codes with alarming accuracy without context clues about the keypad.

According to the researchers, this is the first technique that unveils personal PINs by exploiting information from wearable devices without the need for contextual information.

"There are two attacking scenarios that are achievable: internal and sniffing attacks," said Wang.

"In an internal strike, attackers’ access embedded sensors in wrist-worn wearable devices through malware. The malware waits until the victim accesses a key-based security system and sends sensor data back," he said.

"Then the attacker can aggregate the sensor data to determine the victim's PIN," Wang added.

"An attacker can also place a wireless sniffer close to a key-based security system to eavesdrop sensor data from wearable devices sent via Bluetooth to the victim's associated smartphones," he said.

The findings are an early step in understanding security vulnerabilities of wearable devices.

Even though wearable devices track health and medical activities, their size and computing power does not allow for robust security measures, which makes the data within more vulnerable to attack, researchers said.

The team suggest that developers inject a certain type of noise to data so it cannot be used to derive fine-grained hand movements, while still being effective for fitness tracking purposes such as activity recognition or step counts.

The team also suggests better encryption between the wearable device and the host operating system.

Photograph: Tobias Schwarz/Reuters