Hackers can turn a smartphone into a sonar and steal data

[Carding 4 Carders]

A group of researchers from Lancaster (UK) and Linköping (Sweden) universities demonstrated a new side-channel attack. Experts have turned an ordinary smartphone into a sonar system for stealing confidential information based on the movements of the victim's fingers across the screen.

Researchers managed to calculate the pattern for unlocking an Android smartphone (Samsung S4) using the principle of a sonar system: they produced sound waves and caught their reflection from surrounding objects. The SonarSnoop framework, developed by experts, assumes that the speakers of a mobile device will produce sound, the reflection of which will then be picked up by the microphone of the same device.

As the researchers explained, the speakers send OFDM signals at a frequency of 18-20 kHz, which is inaudible to most people, so users are largely unaware of audio activity. If objects reflecting sound are static, the sound waves they reflect will return at the same time. It is completely different with fingers moving across the screen.

“The received signals are converted into the so-called echo profile matrix, which visualizes these changes (in the sound wave reflected from the fingers - ed.) And allows to determine the movement. By piecing together the movements captured by multiple microphones, we were able to determine when a user was tapping or swiping a finger, ”the researchers said.

More information about the SonarSnoop attack can be found here.

OFDM (Orthogonal frequency-division multiplexing) - orthogonal frequency division multiplexing. Digital modulation scheme using a large number of closely spaced orthogonal subcarriers