By Josh Lebowitz
Just when you thought you were doing everything right to keep your online account passwords safe…
You’re a savvy DEFEND magazine reader. You know about brute force and phishing attacks, skimmers (a.k.a. fake card readers) and any number of other strategies hackers use to guess or steal your passwords, right?
Well, here’s another – new – one to start worrying about (cue the collective groan of a beleaguered populace).
A study published last week describes an experiment where researchers devised an algorithm, combining data from the accelerometers, gyroscopes and magnetometers in smartwatches, that enabled the researchers to pinpoint a user’s hand movements to then guess, with alarming accuracy, the passwords and pins that had just been typed onto a computer keyboard or bank ATM’s keypad.
Hmm, that sure doesn’t sound good. Wait, it gets worse.
The algorithm was able to reconstruct the user’s passwords with 80% accuracy on the first try. Within three attempts the success rate jumped to 90%. So now we’ve got something else to worry about in an increasingly challenging, menacing and threat-laden online world.
John Peterson, Vice President, Enterprise Products & General Manager, Comodo, adds, “As this study shows, Smartwatch consumers, especially those wearing a device on their typing hand, should be aware that their hand motions can be tracked very precisely to steal their passwords. This highlights the need for encryption between Bluetooth and WiFi enabled devices.”
And while new Bluetooth connections are generally well encrypted, it seems likely that if well-meaning researchers can write an algorithm to accurately steal passwords from smartwatch users, the Blackhat community won’t be far behind.
And this is the sound of me not buying a smartwatch.
