| Title | WristSpy: Snooping Passcodes in Mobile Payment Using Wrist-worn Wearables |
| Publication Type | Conference Paper |
| Year of Publication | 2019 |
| Authors | Wang, Chen, Liu, Jian, Guo, Xiaonan, Wang, Yan, Chen, Yingying |
| Conference Name | IEEE INFOCOM 2019 - IEEE Conference on Computer Communications |
| Keywords | authorisation, electronic money, Euclidean distance, feature extraction, financial data processing, fine-grained hand movement trajectories, Human Behavior, learning (artificial intelligence), machine-learning based classification, mobile computing, Mobile handsets, mobile payment, multidimensional feature extraction, Online banking, parallel pattern inference, parallel PIN inference, parallel processing, passcode inference system, passcode input scenarios, personal mobile devices, Pins, privacy, pubcrawl, Resiliency, Scalability, single wrist-worn wearable device, Trajectory, wearable computers, Wearable sensors, wearables security, WristSpy |
| Abstract | Mobile payment has drawn considerable attention due to its convenience of paying via personal mobile devices at anytime and anywhere, and passcodes (i.e., PINs or patterns) are the first choice of most consumers to authorize the payment. This paper demonstrates a serious security breach and aims to raise the awareness of the public that the passcodes for authorizing transactions in mobile payments can be leaked by exploiting the embedded sensors in wearable devices (e.g., smartwatches). We present a passcode inference system, WristSpy, which examines to what extent the user's PIN/pattern during the mobile payment could be revealed from a single wrist-worn wearable device under different passcode input scenarios involving either two hands or a single hand. In particular, WristSpy has the capability to accurately reconstruct fine-grained hand movement trajectories and infer PINs/patterns when mobile and wearable devices are on two hands through building a Euclidean distance-based model and developing a training-free parallel PIN/pattern inference algorithm. When both devices are on the same single hand, a highly challenging case, WristSpy extracts multi-dimensional features by capturing the dynamics of minute hand vibrations and performs machine-learning based classification to identify PIN entries. Extensive experiments with 15 volunteers and 1600 passcode inputs demonstrate that an adversary is able to recover a user's PIN/pattern with up to 92% success rate within 5 tries under various input scenarios. |
| DOI | 10.1109/INFOCOM.2019.8737633 |
| Citation Key | wang_wristspy_2019 |
WristSpy: Snooping Passcodes in Mobile Payment Using Wrist-worn Wearables