Heat traces from smartphone screens could reveal entered PIN

Heat traces left on smartphone screens from typing the PIN or swiping a pattern could reveal the secret code, researchers have warned.

What was needed to steal the code was a thermal-imaging camera, as thermal images revealed what parts of the screen were tapped, even after it was left untouched for 30 seconds, The Atlantic reported.

At an upcoming conference on human-computer interactions to be held in the US in May, researchers from the University of Stuttgart and Ludwig Maximilian University of Munich in Germany will present a new study on how PINs or patterns could be extracted from the heat signature left on the smartphone screen of users.

''PINs and patterns remain among the most widely used knowledge-based authentication schemes. As thermal cameras become ubiquitous and affordable, we foresee a new form of threat to user privacy on mobile devices,'' the researchers said.

Thermal cameras could be used to launch thermal attacks, where heat traces, resulting from authentication, could be used to reconstruct passwords.

According to the researchers, while PINs remained vulnerable even with duplicate digits, overlapping patterns significantly decreased rate of success of such attacks.

If the thermal image was taken within 15 seconds of a PIN being entered, it was accurate nearly 90 per cent of the time, but at 30 seconds, it was around 80 per cent accurate.

However, at 45 seconds or more, the accuracy dropped to 35 per cent and below, according to the report.

The researchers devised a six step plan for extracting PIN numbers. A thermal camera set to capture temperatures between about 66 and 90 degrees Fahrenheit took a picture of the screen.

Software could then convert the colour image to grayscale and applied a filter.

In the next step the background was removed completely leaving only the heat traces.