Tilt of a mobile lets hackers steal PINs remotely

HACKERS ARE able to steal PINs and passwords just from the way a mobile phone tilts while being held, new research suggests.

Cyber experts at Newcastle University say they have been able to reveal the ease with which malicious websites and apps can spy on us using the motion sensors in our smartphones and tablets.

Analysing the movement of a device as the keyboard was used, they were able to crack four-digit PINs with 70 per cent accuracy on the first guess and 100 per cent by the fifth guess.

But despite the big players in the industry being aware of the problem, a solution has yet to be found.

Lead author Dr Maryam Mehrnezhad, a research fellow in the School of Computing Science, said: “Most smartphones, tablets, and other wearables are now equipped with a multitude of sensors, from the well-known GPS, camera and microphone to instruments such as the gyroscope, rotation sensors and accelerometer.

“But because mobile apps and websites don’t need to ask permission to access most of them, malicious programs can covertly ‘listen in’ on your sensor data and use it to discover a wide range of sensitive information about you such as phone call timing, physical activities and even your touch actions, PINs and passwords.”

Because there is no uniform way of managing sensors across the industry, the researchers believe the findings points towards there being a real threat to personal security.

After publishing the findings today in the International Journal

of Information Security, the team is now looking at the additional risks posed by personal fitness trackers which are linked to online profiles.

Dr Mehrnezhad said: “More worryingly on some browsers we found that if you open a page on your phone or tablet which hosts one of these malicious codes and then open, for example, your online banking account without closing the previous tab, then they can spy on every personal detail you enter.

“And worse still, in some cases, unless you close them down completely, they can even spy on you when your phone is locked.”